| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: WINDOWS 7 kommen ständig PopUps usw...Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
04.06.2014, 17:28
| #16 | |
| /// TB-Ausbilder   |  WINDOWS 7 kommen ständig PopUps usw...Zitat:
die geposteten Schritte bitte ausführen und Logdateien posten... wenn du noch immer einen sauberen Rechner willst.  |
|
04.06.2014, 18:27
| #17 |
 | WINDOWS 7 kommen ständig PopUps usw...Code:
ATTFilter # AdwCleaner v3.211 - Bericht erstellt am 04/06/2014 um 18:19:10
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : - -PC
# Gestartet von : C:\Users\\Desktop\adwcleaner_3.211.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Skillbrains
Ordner Gelöscht : C:\Users\\AppData\Local\Skillbrains
Ordner Gelöscht : C:\Users\Elvira\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok
Ordner Gelöscht : C:\Users\Elvira\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg
Ordner Gelöscht : C:\Users\Elvira\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Datei Gelöscht : C:\Windows\Tasks\update-sys.job
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_lightshot (1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_lightshot (1)_RASMANCS
Schlüssel Gelöscht : HKCU\Software\SkillBrains
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\SkillBrains
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16545
-\\ Mozilla Firefox v28.0 (de)
[ Datei : C:\Users\Elvira\AppData\Roaming\Mozilla\Firefox\Profiles\2aglban5.default\prefs.js ]
[ Datei : C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\prefs.js ]
[ Datei : C:\Users\Jürgen\AppData\Roaming\Mozilla\Firefox\Profiles\kkmo767h.default\prefs.js ]
[ Datei : C:\Users\Martina\AppData\Roaming\Mozilla\Firefox\Profiles\mzwqgr73.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\Martina\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [133039 octets] - [01/06/2014 21:35:34]
AdwCleaner[R1].txt - [2561 octets] - [04/06/2014 18:16:48]
AdwCleaner[S0].txt - [125015 octets] - [01/06/2014 21:36:52]
AdwCleaner[S1].txt - [2377 octets] - [04/06/2014 18:19:10]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2437 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 04.06.2014 Suchlauf-Zeit: 18:25:24 Logdatei: mbam.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.03.04.09 Rootkit Datenbank: v2014.02.20.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 326426 Verstrichene Zeit: 12 Min, 27 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 53 Trojan.BHO, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}, In Quarantäne, [76d30bf4abcf3afc5197aca4aa582bd5], Trojan.BHO, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}, In Quarantäne, [76d30bf4abcf3afc5197aca4aa582bd5], Trojan.BHO, HKU\S-1-5-21-2465613748-4109621216-2680054910-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}, Löschen bei Neustart, [76d30bf4abcf3afc5197aca4aa582bd5], Trojan.BHO, HKU\S-1-5-21-2465613748-4109621216-2680054910-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}, Löschen bei Neustart, [76d30bf4abcf3afc5197aca4aa582bd5], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, Löschen bei Neustart, [2c1d5ca37cfe44f262d193e31ee4d828], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, In Quarantäne, [2c1d5ca37cfe44f262d193e31ee4d828], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, Löschen bei Neustart, [2c1d5ca37cfe44f262d193e31ee4d828], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, Löschen bei Neustart, [2c1d5ca37cfe44f262d193e31ee4d828], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}, In Quarantäne, [2c1d5ca37cfe44f262d193e31ee4d828], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, Löschen bei Neustart, [f7525ca37604fc3a27dcf57e14ee26da], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, In Quarantäne, [f7525ca37604fc3a27dcf57e14ee26da], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, Löschen bei Neustart, [f7525ca37604fc3a27dcf57e14ee26da], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, Löschen bei Neustart, [f7525ca37604fc3a27dcf57e14ee26da], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{82E1477C-B154-48D3-9891-33D83C26BCD3}, In Quarantäne, [f7525ca37604fc3a27dcf57e14ee26da], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, Löschen bei Neustart, [2722c6391763fb3b8b77bfb411f1f10f], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, In Quarantäne, [2722c6391763fb3b8b77bfb411f1f10f], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, Löschen bei Neustart, [2722c6391763fb3b8b77bfb411f1f10f], PUP.Optional.Delta.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{C1AF5FA5-852C-4C90-812E-A7F75E011D87}, In Quarantäne, [2722c6391763fb3b8b77bfb411f1f10f], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, Löschen bei Neustart, [f950de215a20da5c73c1d2a48c7622de], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, In Quarantäne, [f950de215a20da5c73c1d2a48c7622de], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, Löschen bei Neustart, [f950de215a20da5c73c1d2a48c7622de], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, Löschen bei Neustart, [f950de215a20da5c73c1d2a48c7622de], PUP.Optional.Incredibar, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{F9639E4A-801B-4843-AEE3-03D9DA199E77}, In Quarantäne, [f950de215a20da5c73c1d2a48c7622de], PUP.Optional.Wajam.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\NATIVEMESSAGINGHOSTS\com.wajam.chrome.messaging.host, In Quarantäne, [e1683dc2dd9d43f3a3c4a2eb8a7847b9], PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, Löschen bei Neustart, [c584c23d512965d149a91f92bb48f907], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, Löschen bei Neustart, [65e46d92cdad8babfcab07a3ac570af6], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, Löschen bei Neustart, [22276b94a8d26fc78b1b03a74fb408f8], PUP.Optional.DealPly.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DealPlyLive, Löschen bei Neustart, [7ecb22dd0c6ec67046f29b1131d21fe1], PUP.Optional.Iminent.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, Löschen bei Neustart, [99b0d02f0d6d38fe80f3ebaaa9597c84], PUP.Optional.PriceGong.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, Löschen bei Neustart, [d3768c73e79396a0b9e88806b84aa25e], PUP.Optional.SavingsSidekick.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Savings Sidekick, Löschen bei Neustart, [70d9ab54e298b0866673eea079899d63], PUP.Optional.Iminent, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}, Löschen bei Neustart, [5aeffd0299e10d296b72ffc1bc473dc3], PUP.Optional.BProtector.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\BPROTECTSETTINGS, Löschen bei Neustart, [8abf26d9a2d854e2bf47ddd1788b4db3], PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, Löschen bei Neustart, [e56448b70476c670ee04fcb5729121df], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, Löschen bei Neustart, [c782b04f7cfe39fde8bf1d8d689b8d73], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, Löschen bei Neustart, [89c043bcc8b296a0efb7c9e1e2213fc1], PUP.Optional.DealPly.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DealPlyLive, Löschen bei Neustart, [e56412ed502aae8841f71b9157acd52b], PUP.Optional.Iminent.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, Löschen bei Neustart, [6edb6d92e59531056112662f2bd7f808], PUP.Optional.PriceGong.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, Löschen bei Neustart, [a7a2718ee892e056574a5836788aa858], PUP.Optional.SavingsSidekick.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Savings Sidekick, Löschen bei Neustart, [ac9dc33ccdad65d11fbae8a618eace32], PUP.Optional.BProtector.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\BPROTECTSETTINGS, Löschen bei Neustart, [24256a95067468ce57af09a55aa925db], PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, Löschen bei Neustart, [43062cd341390c2a7f73dfd205fe37c9], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr, In Quarantäne, [a5a4b6491565ef47792e307ab053cb35], PUP.Optional.DataMngr.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [53f6be41d2a89e98edb949616a9925db], PUP.Optional.DealPly.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DealPlyLive, In Quarantäne, [19308877c4b6c96dea4e1a92a95aa759], PUP.Optional.Iminent.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Iminent, In Quarantäne, [a2a7e41bafcb9e985e15455044be639d], PUP.Optional.CrossRider.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [5aef9768285263d3dc9aefd0da295fa1], PUP.Optional.FevenPro.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Feven Pro 1.2, In Quarantäne, [d574718ed0aa69cd6a52e1ad6f9346ba], PUP.Optional.HQVideoProfession.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HQ-Video-Profession-1.3, In Quarantäne, [cc7d5aa5611980b6b09ea6e728da8977], PUP.Optional.Feven.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLEDBROWSEREXTENSIONS\Feven, In Quarantäne, [57f219e6fe7c013562d36d4cd52e3cc4], PUP.Optional.BProtector.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\BPROTECTSETTINGS, In Quarantäne, [aa9f639c4a302b0b50b65f4f6b9852ae], PUP.Optional.SweetIM.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM, In Quarantäne, [3a0f9e6159219a9ccfee713ac1429c64], PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT, In Quarantäne, [f059a25d8febc3735e94199808fb24dc], Registrierungswerte: 11 PUP.Optional.InstallBrain.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, MYSTART, Löschen bei Neustart, [c584c23d512965d149a91f92bb48f907] PUP.BProtector, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, Löschen bei Neustart, [c7820ef18cee181e4b5e6f3b19ea52ae], PUM.Bad.Proxy, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:13828, Löschen bei Neustart, [b0991fe0e199f93dd703b90aa162f20e] PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, Löschen bei Neustart, [e56448b70476c670ee04fcb5729121df], PUP.BProtector, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, Löschen bei Neustart, [0a3f7f809bdf80b6ffaa1a9024df857b] PUM.Bad.Proxy, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:13828, Löschen bei Neustart, [b198b54a136745f11cbe962d82818977] PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, MYSTART, Löschen bei Neustart, [43062cd341390c2a7f73dfd205fe37c9] PUP.BProtector, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}, In Quarantäne, [6adf34cb097156e04b5e3e6c19ea2dd3] PUM.Bad.Proxy, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|ProxyServer, http=127.0.0.1:13828, In Quarantäne, [6bde827de9911026efeb477c23e0e020] PUP.Optional.SweetIM.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SWEETIM|simapp_id, 92543519317707452, In Quarantäne, [3a0f9e6159219a9ccfee713ac1429c64] PUP.Optional.InstallBrain.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\WNLT|URL, In Quarantäne, [f059a25d8febc3735e94199808fb24dc], Registrierungsdaten: 3 PUP.Optional.Conduit, HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=),Löschen bei Neustart,[59f0ac539edcf145badce5494aba41bf] PUP.Optional.Conduit, HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com?SearchSource=10&ctid=CT2625848&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=),Löschen bei Neustart,[66e38778ec8e1125465076b80ff51ae6] PUP.Optional.Conduit.A, HKU\S-1-5-21-2465613748-4109621216-2680054910-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://search.conduit.com/?ctid=CT3318857&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=, Gut: (hxxp://www.google.com), Schlecht: (hxxp://search.conduit.com/?ctid=CT3318857&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SP266CEBB9-47FA-46C0-833E-798853BA4B3B&SSPV=),Ersetzt,[91b86b9484f636001c8f65c0be469a66] Ordner: 0 (No malicious items detected) Dateien: 22 Trojan.BHO, C:\Users\\AppData\LocalLow\systems ie bho\bho.dll, In Quarantäne, [76d30bf4abcf3afc5197aca4aa582bd5], PUP.Optional.Bandoo, C:\Users\Elvira\Downloads\iLividSetupV1 (1).exe, In Quarantäne, [6edb05faf783b0863a69eb600df4c937], PUP.Optional.Bandoo, C:\Users\Elvira\Downloads\iLividSetupV1.exe, In Quarantäne, [0742d926e496ce68861d67e4cc358080], PUP.Optional.Softonic.A, C:\Users\Elvira\Downloads\SoftonicDownloader_fuer_apache-openoffice (1).exe, In Quarantäne, [f75244bb205a56e021e2540ed62b659b], PUP.Optional.Softonic.A, C:\Users\Elvira\Downloads\SoftonicDownloader_fuer_apache-openoffice.exe, In Quarantäne, [2227bc435f1b39fd5ea5550d6f922bd5], PUP.BundleInstaller.VG, C:\Users\\Downloads\video_downloader (1).exe, In Quarantäne, [8fbade211c5ee84e6987b4168d73eb15], PUP.BundleInstaller.VG, C:\Users\\Downloads\video_downloader (2).exe, In Quarantäne, [ce7b6d920377b581856b43873cc4f010], PUP.BundleInstaller.VG, C:\Users\\Downloads\video_downloader.exe, In Quarantäne, [a7a20ff074068caab33d7e4c51af1ee2], PUP.Optional.Somoto.A, C:\Users\\Downloads\VLCMediaPlayerSetup-2OP91Rf.exe, In Quarantäne, [89c032cdaad01a1c7f7672138d73639d], PUP.Optional.Bundlore, C:\Users\\Downloads\setup.exe, In Quarantäne, [074289767a0055e1082eb98e05fcd12f], PUP.Optional.Solimba, C:\Users\\Downloads\Setup (1).exe, In Quarantäne, [b89130cf24562412a5e4083fa25f9a66], PUP.Optional.Solimba, C:\Users\\Downloads\Setup (2).exe, In Quarantäne, [2d1ce6191a603ff71c6dde698081e917], PUP.Optional.Somoto.A, C:\Users\Jürgen\Downloads\!CRASSROOTSOFL_downloader-8FQAXFa8.exe, In Quarantäne, [1f2a8a7586f469cd9505f62b8b798f71], PUP.Optional.Somoto.A, C:\Users\Jürgen\Downloads\DaBomb_downloader-9IthlL0Z.exe, In Quarantäne, [3e0b3ec13842350189113ce510f416ea], PUP.Casino, C:\Users\Jürgen\Downloads\Everest Poker.exe, In Quarantäne, [0742857af48659dd3b588117f907758b], PUP.Optional.Bandoo, C:\Users\Jürgen\Downloads\iLividSetup-r515-n-bc.exe, In Quarantäne, [c68366997dfd83b381228cbf23de3ac6], PUP.Optional.OptimumInstaller.A, C:\Users\Jürgen\Downloads\Groovestream.exe, In Quarantäne, [d475bc4348322e08139e96f9837e3cc4], PUP.Optional.Softonic.A, C:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe, In Quarantäne, [7dcc847b7efcee48bf44e77b936e5aa6], PUP.Optional.Softonic.A, C:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot.exe, In Quarantäne, [6edb88775e1c59ddca391d45a65bff01], PUP.Optional.Softonic.A, C:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_minecraft (1).exe, In Quarantäne, [c881b44bd6a456e06b98075b25dc11ef], PUP.Optional.Softonic.A, C:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_minecraft.exe, In Quarantäne, [52f77a853149e74f8182bda5629f2dd3], PUP.Optional.Conduit.A, C:\Users\Jürgen\Downloads\Setup_brch.exe, In Quarantäne, [38117d8262182b0b0b66a0ecde23a858], Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter Zoek.exe v5.0.0.0 Updated 02-June-2014
Tool run by on 04.06.2014 at 18:39:31,96.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\\Desktop\zoek.exe [Scan all users] [Script inserted]
==== Older Logs ======================
C:\zoek-results2014-06-01-213745.log 65553 bytes
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014 Ran by (administrator) on -PC on 04-06-2014 19:14:37 Running from C:\Users\\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.EXE (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe ( ) C:\Windows\System32\lxbkcoms.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files (x86)\XSManager\WTGService.exe (4G Systems GmbH & Co. KG) C:\Windows\service4g.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmon.exe () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (4G Systems GmbH & Co. KG) C:\Windows\starter4g.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe (Microsoft Corporation) C:\Windows\System32\wscript.exe (Comvigo, Inc.) C:\Windows\SysWOW64\qimlsrv.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Comvigo, Inc.) C:\Windows\SysWOW64\dsrviml.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Farbar) C:\Users\\Desktop\FRST64 (1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor) HKLM\...\Run: [lxbkbmgr.exe] => C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-30] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [starter4g] => C:\Windows\starter4g.exe [160424 2011-03-30] (4G Systems GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [601928 2013-06-19] (BlueStack Systems, Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [LightShot] => C:\Users\\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3588952 2014-04-25] (Electronic Arts) HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-29] () HKU\S-1-5-21-2465613748-4109621216-2680054910-1001-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [Google Update] => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-21] (Google Inc.) HKU\S-1-5-21-2465613748-4109621216-2680054910-1002-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [Google Update] => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-07-21] (Google Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs () Startup: C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.) Startup: C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\searchplugins\%Protector Process Name%.xml FF SearchPlugin: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\searchplugins\yandex.ru-230807.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\staged [2014-06-03] FF Extension: Search Assistant - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18] FF Extension: ep - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24] Chrome: ======= CHR HomePage: CHR Extension: (Google Docs) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-01] CHR Extension: (Google Drive) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-01] CHR Extension: (YouTube) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-21] CHR Extension: (Google-Suche) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-21] CHR Extension: (Google Wallet) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Google Mail) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-21] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.) R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( ) R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( ) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [327392 2012-04-05] () R2 XS Stick Service; C:\Windows\service4g.exe [145064 2011-03-30] (4G Systems GmbH & Co. KG) ==================== Drivers (Whitelisted) ==================== R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG) R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems) S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-10-05] (Mobile Connector) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-04] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 RTL8187B; C:\Windows\System32\DRIVERS\rtl8187B.sys [450048 2010-03-31] (Realtek Semiconductor Corporation ) R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [762472 2011-10-31] (Realtek Semiconductor Corporation ) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-04 19:14 - 2014-06-04 19:14 - 02068992 _____ (Farbar) C:\Users\\Desktop\FRST64 (1).exe 2014-06-04 19:13 - 2014-06-04 19:14 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (1).exe 2014-06-04 18:41 - 2014-06-01 23:37 - 00065553 _____ () C:\zoek-results2014-06-01-213745.log 2014-06-04 18:39 - 2014-06-04 18:53 - 00002954 _____ () C:\runcheck.txt 2014-06-04 16:26 - 2014-06-04 16:26 - 00000000 _____ () C:\Windows\SysWOW64\shoB3C7.tmp 2014-06-03 21:40 - 2014-06-03 21:42 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64.exe 2014-06-03 16:27 - 2014-06-03 16:27 - 00000000 ____D () C:\Users\\AppData\Roaming\Security Systems 2014-06-03 16:26 - 2014-06-03 16:26 - 02620112 _____ (Skillbrains ) C:\Users\\Desktop\setup-lightshot3-2-0-0.exe 2014-06-03 00:21 - 2014-06-03 00:21 - 00832944 _____ () C:\Windows\Minidump\060314-22698-01.dmp 2014-06-02 23:17 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Documents\AdwCleaner[S0].txt 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-06-02 22:58 - 2014-06-02 22:59 - 01110476 _____ () C:\Users\\Downloads\7z920.exe 2014-06-02 16:53 - 2014-06-02 16:53 - 00000000 _____ () C:\Windows\SysWOW64\sho1DE3.tmp 2014-06-02 00:03 - 2014-06-02 00:05 - 00033347 _____ () C:\Users\\Downloads\Addition.txt 2014-06-02 00:02 - 2014-06-02 00:04 - 00041741 _____ () C:\Users\\Downloads\FRST.txt 2014-06-01 23:39 - 2014-06-01 23:39 - 00065175 _____ () C:\Users\\Desktop\zoek-results.txt 2014-06-01 23:35 - 2014-06-04 19:14 - 00000000 ____D () C:\Users\\AppData\Local\Temp 2014-06-01 23:35 - 2014-06-04 16:18 - 00000000 ____D () C:\Users\Martina\AppData\Local\temp 2014-06-01 23:35 - 2014-06-03 20:55 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\temp 2014-06-01 23:35 - 2014-06-02 16:42 - 00000000 ____D () C:\Users\Elvira\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-01 23:01 - 2014-06-04 18:41 - 00000381 _____ () C:\zoek-results.log 2014-06-01 22:58 - 2014-06-01 23:30 - 00000000 ____D () C:\zoek_backup 2014-06-01 22:55 - 2014-06-04 19:11 - 00020015 _____ () C:\Users\\Desktop\mbam.txt 2014-06-01 22:10 - 2014-06-04 19:10 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-01 22:10 - 2014-06-04 19:08 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-01 22:10 - 2014-06-04 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-01 22:10 - 2014-06-04 19:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-01 22:10 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-01 22:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-01 22:10 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-01 22:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-01 22:08 - 2014-06-01 22:08 - 00005727 _____ () C:\Users\\Desktop\JRT.txt 2014-06-01 21:57 - 2014-06-01 21:57 - 00000000 ____D () C:\Windows\ERUNT 2014-06-01 21:53 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Desktop\AdwCleaner[S0].txt 2014-06-01 21:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-06-01 21:33 - 2014-06-04 18:19 - 00000000 ____D () C:\AdwCleaner 2014-06-01 21:32 - 2014-06-01 21:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-01 21:31 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Desktop\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Desktop\JRT.exe 2014-06-01 21:30 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Desktop\adwcleaner_3.211.exe 2014-06-01 21:29 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Downloads\zoek.exe 2014-06-01 21:28 - 2014-06-01 21:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Downloads\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Downloads\JRT.exe 2014-06-01 01:19 - 2014-06-01 01:19 - 00051290 _____ () C:\ComboFix.txt 2014-05-31 21:17 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-05-31 21:17 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-05-31 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-05-31 21:15 - 2014-06-01 01:19 - 00000000 ____D () C:\Qoobox 2014-05-31 21:14 - 2014-06-01 01:16 - 00000000 ____D () C:\Windows\erdnt 2014-05-31 21:12 - 2014-05-31 21:08 - 05203398 ____R (Swearware) C:\Users\\Desktop\ComboFix.exe 2014-05-31 21:07 - 2014-05-31 21:08 - 05203398 _____ (Swearware) C:\Users\\Downloads\ComboFix.exe 2014-05-31 20:38 - 2014-06-03 21:46 - 00037405 _____ () C:\Users\\Desktop\Addition.txt 2014-05-31 20:37 - 2014-06-04 19:15 - 00017228 _____ () C:\Users\\Desktop\FRST.txt 2014-05-31 20:37 - 2014-06-04 19:14 - 00000000 ____D () C:\FRST 2014-05-31 20:10 - 2014-05-31 20:11 - 00250250 _____ () C:\Users\\Downloads\140520063508.jpeg 2014-05-31 16:02 - 2014-05-31 16:02 - 00052891 _____ () C:\Users\Jürgen\Downloads\7B1.tmp 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\PopCap Games 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\EA Core 2014-05-29 15:43 - 2014-05-29 15:43 - 00001286 _____ () C:\Users\Public\Desktop\Pflanzen gegen Zombies.lnk 2014-05-29 15:43 - 2014-05-29 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pflanzen gegen Zombies 2014-05-17 10:44 - 2014-05-17 10:44 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job 2014-05-14 22:03 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 22:03 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 22:03 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 22:03 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 22:03 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 22:03 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 14:00 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-14 14:00 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-14 14:00 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-14 14:00 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-14 14:00 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-14 14:00 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-14 14:00 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-14 14:00 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-14 14:00 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 14:00 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 14:00 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-14 14:00 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-14 14:00 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-14 14:00 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-14 14:00 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-14 14:00 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-14 14:00 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-12 19:41 - 2014-05-12 19:41 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (17).exe 2014-05-11 17:57 - 2014-05-11 17:58 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (16).exe 2014-05-11 10:47 - 2014-05-11 10:47 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job 2014-05-11 07:51 - 2014-05-11 07:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job 2014-05-10 19:18 - 2014-05-10 19:19 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (15).exe ==================== One Month Modified Files and Folders ======= 2014-06-04 19:15 - 2014-05-31 20:37 - 00017228 _____ () C:\Users\\Desktop\FRST.txt 2014-06-04 19:15 - 2013-08-29 02:01 - 00000000 ____D () C:\Users\\AppData\Local\PMB Files 2014-06-04 19:14 - 2014-06-04 19:14 - 02068992 _____ (Farbar) C:\Users\\Desktop\FRST64 (1).exe 2014-06-04 19:14 - 2014-06-04 19:13 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (1).exe 2014-06-04 19:14 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\\AppData\Local\Temp 2014-06-04 19:14 - 2014-05-31 20:37 - 00000000 ____D () C:\FRST 2014-06-04 19:11 - 2014-06-01 22:55 - 00020015 _____ () C:\Users\\Desktop\mbam.txt 2014-06-04 19:10 - 2014-06-01 22:10 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-04 19:08 - 2014-06-01 22:10 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-04 19:08 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-04 19:08 - 2014-06-01 22:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-04 19:05 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-04 19:05 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-04 19:02 - 2012-07-21 10:07 - 01431936 _____ () C:\Windows\WindowsUpdate.log 2014-06-04 19:01 - 2012-09-12 01:43 - 00000000 ____D () C:\ProgramData\Origin 2014-06-04 18:59 - 2012-09-12 01:43 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-06-04 18:58 - 2013-12-10 00:50 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-06-04 18:56 - 2009-07-14 06:51 - 00179161 _____ () C:\Windows\setupact.log 2014-06-04 18:55 - 2010-10-01 09:36 - 00608174 _____ () C:\Windows\PFRO.log 2014-06-04 18:53 - 2014-06-04 18:39 - 00002954 _____ () C:\runcheck.txt 2014-06-04 18:41 - 2014-06-01 23:01 - 00000381 _____ () C:\zoek-results.log 2014-06-04 18:19 - 2014-06-01 21:33 - 00000000 ____D () C:\AdwCleaner 2014-06-04 16:26 - 2014-06-04 16:26 - 00000000 _____ () C:\Windows\SysWOW64\shoB3C7.tmp 2014-06-04 16:18 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Martina\AppData\Local\temp 2014-06-03 23:31 - 2013-12-04 02:02 - 02277616 _____ () C:\Windows\IE11_main.log 2014-06-03 21:46 - 2014-05-31 20:38 - 00037405 _____ () C:\Users\\Desktop\Addition.txt 2014-06-03 21:42 - 2014-06-03 21:40 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64.exe 2014-06-03 21:32 - 2014-02-28 16:37 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2014-06-03 21:30 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-06-03 20:55 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\temp 2014-06-03 16:27 - 2014-06-03 16:27 - 00000000 ____D () C:\Users\\AppData\Roaming\Security Systems 2014-06-03 16:27 - 2012-07-22 23:07 - 00000779 _____ () C:\Users\\AppData\Local\UserProducts.xml 2014-06-03 16:27 - 2012-07-22 23:07 - 00000392 _____ () C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job 2014-06-03 16:27 - 2012-07-22 23:07 - 00000000 ____D () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LightShot 2014-06-03 16:26 - 2014-06-03 16:26 - 02620112 _____ (Skillbrains ) C:\Users\\Desktop\setup-lightshot3-2-0-0.exe 2014-06-03 13:56 - 2014-03-06 18:07 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-06-03 00:21 - 2014-06-03 00:21 - 00832944 _____ () C:\Windows\Minidump\060314-22698-01.dmp 2014-06-03 00:21 - 2012-11-25 09:51 - 600737197 _____ () C:\Windows\MEMORY.DMP 2014-06-03 00:21 - 2012-11-25 09:51 - 00000000 ____D () C:\Windows\Minidump 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-06-02 22:59 - 2014-06-02 22:58 - 01110476 _____ () C:\Users\\Downloads\7z920.exe 2014-06-02 19:33 - 2012-07-21 15:29 - 00002380 _____ () C:\Users\Martina\Desktop\Google Chrome.lnk 2014-06-02 16:53 - 2014-06-02 16:53 - 00000000 _____ () C:\Windows\SysWOW64\sho1DE3.tmp 2014-06-02 16:42 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Elvira\AppData\Local\temp 2014-06-02 15:17 - 2012-07-21 21:59 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\Mozilla 2014-06-02 00:05 - 2014-06-02 00:03 - 00033347 _____ () C:\Users\\Downloads\Addition.txt 2014-06-02 00:04 - 2014-06-02 00:02 - 00041741 _____ () C:\Users\\Downloads\FRST.txt 2014-06-01 23:39 - 2014-06-01 23:39 - 00065175 _____ () C:\Users\\Desktop\zoek-results.txt 2014-06-01 23:37 - 2014-06-04 18:41 - 00065553 _____ () C:\zoek-results2014-06-01-213745.log 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-01 23:30 - 2014-06-01 22:58 - 00000000 ____D () C:\zoek_backup 2014-06-01 23:24 - 2012-07-21 10:25 - 00000000 ____D () C:\Users\ 2014-06-01 22:10 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-01 22:08 - 2014-06-01 22:08 - 00005727 _____ () C:\Users\\Desktop\JRT.txt 2014-06-01 21:57 - 2014-06-01 21:57 - 00000000 ____D () C:\Windows\ERUNT 2014-06-01 21:53 - 2014-06-02 23:17 - 00124182 _____ () C:\Users\\Documents\AdwCleaner[S0].txt 2014-06-01 21:53 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Desktop\AdwCleaner[S0].txt 2014-06-01 21:40 - 2012-07-21 15:21 - 00000000 ____D () C:\Users\Martina 2014-06-01 21:40 - 2012-07-21 15:12 - 00000000 ____D () C:\Users\Elvira 2014-06-01 21:40 - 2012-07-21 14:35 - 00000000 ____D () C:\Users\Jürgen 2014-06-01 21:40 - 2012-07-21 10:25 - 00000000 ___RD () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-06-01 21:31 - 2014-06-01 21:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-01 21:31 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Desktop\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:29 - 01285120 _____ () C:\Users\\Downloads\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-01 21:28 - 2014-06-01 21:31 - 01016261 _____ (Thisisu) C:\Users\\Desktop\JRT.exe 2014-06-01 21:28 - 2014-06-01 21:30 - 01327971 _____ () C:\Users\\Desktop\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Downloads\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Downloads\JRT.exe 2014-06-01 21:19 - 2010-10-01 08:53 - 00000000 ____D () C:\ProgramData\Norton 2014-06-01 08:29 - 2009-07-14 19:58 - 00699884 _____ () C:\Windows\system32\perfh007.dat 2014-06-01 08:29 - 2009-07-14 19:58 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2014-06-01 08:29 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-01 01:19 - 2014-06-01 01:19 - 00051290 _____ () C:\ComboFix.txt 2014-06-01 01:19 - 2014-05-31 21:15 - 00000000 ____D () C:\Qoobox 2014-06-01 01:19 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-06-01 01:16 - 2014-05-31 21:14 - 00000000 ____D () C:\Windows\erdnt 2014-06-01 01:15 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-05-31 21:08 - 2014-05-31 21:12 - 05203398 ____R (Swearware) C:\Users\\Desktop\ComboFix.exe 2014-05-31 21:08 - 2014-05-31 21:07 - 05203398 _____ (Swearware) C:\Users\\Downloads\ComboFix.exe 2014-05-31 20:11 - 2014-05-31 20:10 - 00250250 _____ () C:\Users\\Downloads\140520063508.jpeg 2014-05-31 19:54 - 2014-01-21 14:44 - 00000000 ____D () C:\Users\Jürgen\Documents\FIFA 14 2014-05-31 16:02 - 2014-05-31 16:02 - 00052891 _____ () C:\Users\Jürgen\Downloads\7B1.tmp 2014-05-30 08:22 - 2012-07-21 15:20 - 00002375 _____ () C:\Users\Elvira\Desktop\Google Chrome.lnk 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\PopCap Games 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\EA Core 2014-05-29 15:43 - 2014-05-29 15:43 - 00001286 _____ () C:\Users\Public\Desktop\Pflanzen gegen Zombies.lnk 2014-05-29 15:43 - 2014-05-29 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pflanzen gegen Zombies 2014-05-29 15:43 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-05-29 15:41 - 2010-10-01 08:19 - 00116460 _____ () C:\Windows\DirectX.log 2014-05-29 15:38 - 2012-09-12 01:55 - 00000000 ____D () C:\Program Files (x86)\Origin Games 2014-05-29 15:05 - 2012-09-12 01:55 - 00000000 ____D () C:\Users\Jürgen\AppData\Roaming\Origin 2014-05-28 15:35 - 2012-08-14 02:38 - 00000000 ____D () C:\Users\Jürgen\AppData\Roaming\.minecraft 2014-05-28 08:14 - 2012-07-21 10:38 - 00002380 _____ () C:\Users\\Desktop\Google Chrome.lnk 2014-05-26 15:56 - 2014-01-08 17:58 - 00000000 ____D () C:\Users\Jürgen\Tracing 2014-05-23 19:34 - 2012-07-21 14:48 - 00002375 _____ () C:\Users\Jürgen\Desktop\Google Chrome.lnk 2014-05-21 10:29 - 2012-07-21 10:25 - 00000000 ___RD () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-17 19:31 - 2012-07-21 15:21 - 00000000 ___RD () C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-17 19:31 - 2012-07-21 15:21 - 00000000 ___RD () C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-17 10:44 - 2014-05-17 10:44 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job 2014-05-15 16:07 - 2012-07-21 15:12 - 00000000 ___RD () C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-15 16:07 - 2012-07-21 15:12 - 00000000 ___RD () C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-15 16:05 - 2012-07-21 14:35 - 00000000 ___RD () C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-15 16:05 - 2012-07-21 14:35 - 00000000 ___RD () C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-15 16:01 - 2014-04-30 17:52 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-14 22:00 - 2013-07-13 07:57 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 22:00 - 2010-10-01 10:17 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-12 19:41 - 2014-05-12 19:41 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (17).exe 2014-05-12 07:26 - 2014-06-01 22:10 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-06-01 22:10 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-01 22:10 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-11 17:58 - 2014-05-11 17:57 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (16).exe 2014-05-11 10:47 - 2014-05-11 10:47 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job 2014-05-11 07:51 - 2014-05-11 07:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job 2014-05-10 19:19 - 2014-05-10 19:18 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (15).exe 2014-05-09 08:14 - 2014-05-14 14:00 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-14 14:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 02:46 - 2014-05-14 22:03 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 02:21 - 2014-05-14 22:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 02:21 - 2014-05-14 22:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 01:32 - 2014-05-14 22:03 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 01:14 - 2014-05-14 22:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 01:14 - 2014-05-14 22:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll Some content of TEMP: ==================== C:\Users\Elvira\AppData\Local\Temp\avgnt.exe C:\Users\Elvira\AppData\Local\Temp\GURE1EC.exe C:\Users\Elvira\AppData\Local\Temp\rtdrvmon.exe C:\Users\\AppData\Local\Temp\7za.exe C:\Users\\AppData\Local\Temp\avgnt.exe C:\Users\\AppData\Local\Temp\FoxySecuritySetup.exe C:\Users\\AppData\Local\Temp\hijackthis.exe C:\Users\\AppData\Local\Temp\NirCmd.exe C:\Users\\AppData\Local\Temp\PEVZ.EXE C:\Users\\AppData\Local\Temp\Quarantine.exe C:\Users\\AppData\Local\Temp\remove.exe C:\Users\\AppData\Local\Temp\rtdrvmon.exe C:\Users\\AppData\Local\Temp\sed.exe C:\Users\\AppData\Local\Temp\shortcut.exe C:\Users\\AppData\Local\Temp\swreg.exe C:\Users\\AppData\Local\Temp\swxcacls.exe C:\Users\\AppData\Local\Temp\wget.exe C:\Users\\AppData\Local\Temp\zoek-delete.exe C:\Users\Jürgen\AppData\Local\Temp\avgnt.exe C:\Users\Jürgen\AppData\Local\Temp\rtdrvmon.exe C:\Users\Martina\AppData\Local\Temp\avgnt.exe C:\Users\Martina\AppData\Local\Temp\rtdrvmon.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-01 11:24 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by at 2014-06-04 19:15:26
Running from C:\Users\\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Alcatraz (HKLM-x32\...\Alcatraz/DE-German_is1) (Version: - City Interactive)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
Apowersoft kostenloser Bildschirmrekorder V1.2.4 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.2.4 - Apowersoft)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
Arma 3 Tools (HKLM-x32\...\Steam App 233800) (Version: - Bohemia Interactive)
ATI Catalyst Install Manager (HKLM\...\{8DF9D3DF-6D03-A04F-217F-F2577D973DBE}) (Version: 3.0.795.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{9D84E30F-6757-4A56-BCB5-51ADE3AE8631}) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help English (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help French (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help German (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0930.2237.38732 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0930.2237.38732 - ATI) Hidden
Cross Fire En (HKLM-x32\...\Cross Fire_is1) (Version: - Z8Games.com)
Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1181 - SG INTERACTIVE)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.2.0.0 - Electronic Arts)
FIFA 14 (HKLM-x32\...\{AA7A2800-1E75-4240-855B-03AFF8E5171E}) (Version: 1.0.0.7 - Electronic Arts)
Foxy Security (HKLM-x32\...\Foxy Security) (Version: - )
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.14.1022 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.14.1022 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.23.0 - DealPly Technologies Ltd) <==== ATTENTION
Hama Black Force Pad (HKLM-x32\...\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}) (Version: 2007.01.01 - )
HydraVision (x32 Version: 4.2.180.0 - ATI Technologies Inc.) Hidden
IM Lock (HKLM-x32\...\IMLock) (Version: - Comvigo, Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
ISY N150 Micro WLAN USB-Adapter (HKLM-x32\...\{B20F9D1C-A0A5-4cd8-8306-DA03872311B1}) (Version: 1.00.0155 - ISY)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version: - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Need For Speed™ World (HKLM-x32\...\{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1) (Version: 1.0.0.993 - Electronic Arts)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.2.2065 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6121 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6194 - Realtek Semiconductor Corp.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sniper - Art of Victory (HKLM-x32\...\sniper_de_is1) (Version: - City Interactive)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.8.1 - TeamSpeak Systems GmbH)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WiseConvert (HKLM-x32\...\WiseConvert) (Version: 1.0 - WiseConvert)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
==================== Restore Points =========================
30-05-2014 06:27:09 Windows Update
31-05-2014 01:00:50 Windows Update
31-05-2014 05:58:19 Windows Update
01-06-2014 00:18:30 Windows Update
01-06-2014 21:01:41 zoek.exe restore point
01-06-2014 23:46:03 TuneUp Utilities 2013 wird entfernt
01-06-2014 23:47:18 TuneUp Utilities Language Pack (de-DE) wird entfernt
02-06-2014 00:53:25 Windows Update
02-06-2014 14:42:32 Windows Update
02-06-2014 17:36:37 Windows Update
02-06-2014 22:16:17 Windows Update
03-06-2014 01:00:18 Windows Update
03-06-2014 21:28:14 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-06-01 01:15 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {00CDF369-5C82-4B09-A8B8-22E0110976DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {162D19D2-88E6-425F-ACF9-085709C10976} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003Core => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {180C32E6-A575-49A3-AA4D-7E9EDC44A1AA} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: {1FD7E7FA-4C1B-46AA-B808-A6B47969B523} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {25715EC7-88B9-4811-B0FD-540AC855053B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} - \PC Performer Manager No Task File <==== ATTENTION
Task: {620FBD68-8B3D-47C5-BEE1-EA19B1705EC4} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2465613748-4109621216-2680054910-1001
Task: {62745FA6-88B4-4F26-B2F4-09469D925348} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {635AC757-77D2-41EE-A578-F6A8974BF31D} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {6875CA21-089D-4DC0-A439-FE49B1E33DB4} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {6E350C8D-3672-4719-8CF1-5A8B8CA44909} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {77E350C2-2250-4BEE-B575-EF12CA6A03F8} - \update-sys No Task File <==== ATTENTION
Task: {820F5D76-F745-4811-BE70-3E99A14E89D9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {9C4EF4AE-24AC-494E-BB1E-389E59772369} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-11] (Adobe Systems Incorporated)
Task: {A66165D0-A739-46B9-AA91-33C0AE65F710} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003UA => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {ABD96266-25AF-494C-B2F5-17C5D8F015E2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {B3ACA1F2-AC10-4A74-A012-61E186CB35DD} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {BEE6EDB5-D13A-4C37-B3C9-40075E803219} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {D1301EC2-67C9-4E08-9A87-56DB18075640} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
==================== Loaded Modules (whitelisted) =============
2012-10-05 10:38 - 2012-04-05 17:35 - 00327392 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2013-08-29 01:39 - 2013-08-29 01:40 - 04287536 _____ () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
2010-08-04 15:58 - 2010-08-04 15:58 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-09-30 22:36 - 2010-09-30 22:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-02-14 11:30 - 2014-02-14 11:30 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\bfd5296be62268bc7a31a424f0d1ad5f\IsdiInterop.ni.dll
2010-10-01 09:40 - 2010-03-03 20:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\\Downloads\Bestaetigung_Rechnung_zu_Ihrer_byebye_Reise_21200789.eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 100c
Startzeit: 01cf7f6385094897
Endzeit: 0
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: cbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1604
Startzeit: 01cf7f6206b8e485
Endzeit: 5
Anwendungspfad: C:\Users\\Downloads\FRST64.exe
Berichts-ID: 4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 30.5.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 378
Startzeit: 01cf7f61ef976bca
Endzeit: 16
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: 33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 04:24:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 01:44:07 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/03/2014 00:23:08 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/02/2014 11:25:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
System errors:
=============
Error: (06/03/2014 11:31:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 01:44:07 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 03:09:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 00:23:08 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 00:21:54 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000116 (0xfffffa8009e0f010, 0xfffff88003c14f94, 0x0000000000000000, 0x0000000000000002)C:\Windows\MEMORY.DMP060314-22698-01
Error: (06/03/2014 00:21:45 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.06.2014 um 00:19:46 unerwartet heruntergefahren.
Error: (06/02/2014 11:26:02 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (06/02/2014 11:25:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/02/2014 11:23:54 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.06.2014 um 23:22:30 unerwartet heruntergefahren.
Error: (06/02/2014 07:46:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Microsoft Office Sessions:
=========================
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1100c01cf7f63850948970C:\Users\\Desktop\FRST64.execbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1160401cf7f6206b8e4855C:\Users\\Downloads\FRST64.exe4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe30.5.2014.037801cf7f61ef976bca16C:\Users\\Desktop\FRST64.exe33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 04:24:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 01:44:07 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/03/2014 00:23:08 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/02/2014 11:25:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
CodeIntegrity Errors:
===================================
Date: 2014-06-01 01:13:13.041
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-01 01:13:12.901
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 56%
Total physical RAM: 3959.48 MB
Available physical RAM: 1714.81 MB
Total Pagefile: 7917.15 MB
Available Pagefile: 5101 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:727.71 GB) (Free:494.02 GB) NTFS
Drive d: (Volume) (Fixed) (Total:195.31 GB) (Free:195.22 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:8 GB) (Free:2.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 30B6D843)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=728 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
04.06.2014, 18:28
| #18 |
| | WINDOWS 7 kommen ständig PopUps usw...Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by at 2014-06-04 19:15:26
Running from C:\Users\\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Alcatraz (HKLM-x32\...\Alcatraz/DE-German_is1) (Version: - City Interactive)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
Apowersoft kostenloser Bildschirmrekorder V1.2.4 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.2.4 - Apowersoft)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
Arma 3 Tools (HKLM-x32\...\Steam App 233800) (Version: - Bohemia Interactive)
ATI Catalyst Install Manager (HKLM\...\{8DF9D3DF-6D03-A04F-217F-F2577D973DBE}) (Version: 3.0.795.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{9D84E30F-6757-4A56-BCB5-51ADE3AE8631}) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help English (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help French (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help German (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0930.2237.38732 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0930.2237.38732 - ATI) Hidden
Cross Fire En (HKLM-x32\...\Cross Fire_is1) (Version: - Z8Games.com)
Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1181 - SG INTERACTIVE)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.2.0.0 - Electronic Arts)
FIFA 14 (HKLM-x32\...\{AA7A2800-1E75-4240-855B-03AFF8E5171E}) (Version: 1.0.0.7 - Electronic Arts)
Foxy Security (HKLM-x32\...\Foxy Security) (Version: - )
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.14.1022 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.14.1022 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.23.0 - DealPly Technologies Ltd) <==== ATTENTION
Hama Black Force Pad (HKLM-x32\...\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}) (Version: 2007.01.01 - )
HydraVision (x32 Version: 4.2.180.0 - ATI Technologies Inc.) Hidden
IM Lock (HKLM-x32\...\IMLock) (Version: - Comvigo, Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
ISY N150 Micro WLAN USB-Adapter (HKLM-x32\...\{B20F9D1C-A0A5-4cd8-8306-DA03872311B1}) (Version: 1.00.0155 - ISY)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version: - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Need For Speed™ World (HKLM-x32\...\{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1) (Version: 1.0.0.993 - Electronic Arts)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.2.2065 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6121 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6194 - Realtek Semiconductor Corp.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sniper - Art of Victory (HKLM-x32\...\sniper_de_is1) (Version: - City Interactive)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.8.1 - TeamSpeak Systems GmbH)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WiseConvert (HKLM-x32\...\WiseConvert) (Version: 1.0 - WiseConvert)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
==================== Restore Points =========================
30-05-2014 06:27:09 Windows Update
31-05-2014 01:00:50 Windows Update
31-05-2014 05:58:19 Windows Update
01-06-2014 00:18:30 Windows Update
01-06-2014 21:01:41 zoek.exe restore point
01-06-2014 23:46:03 TuneUp Utilities 2013 wird entfernt
01-06-2014 23:47:18 TuneUp Utilities Language Pack (de-DE) wird entfernt
02-06-2014 00:53:25 Windows Update
02-06-2014 14:42:32 Windows Update
02-06-2014 17:36:37 Windows Update
02-06-2014 22:16:17 Windows Update
03-06-2014 01:00:18 Windows Update
03-06-2014 21:28:14 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-06-01 01:15 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {00CDF369-5C82-4B09-A8B8-22E0110976DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {162D19D2-88E6-425F-ACF9-085709C10976} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003Core => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {180C32E6-A575-49A3-AA4D-7E9EDC44A1AA} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: {1FD7E7FA-4C1B-46AA-B808-A6B47969B523} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {25715EC7-88B9-4811-B0FD-540AC855053B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} - \PC Performer Manager No Task File <==== ATTENTION
Task: {620FBD68-8B3D-47C5-BEE1-EA19B1705EC4} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2465613748-4109621216-2680054910-1001
Task: {62745FA6-88B4-4F26-B2F4-09469D925348} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {635AC757-77D2-41EE-A578-F6A8974BF31D} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {6875CA21-089D-4DC0-A439-FE49B1E33DB4} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {6E350C8D-3672-4719-8CF1-5A8B8CA44909} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {77E350C2-2250-4BEE-B575-EF12CA6A03F8} - \update-sys No Task File <==== ATTENTION
Task: {820F5D76-F745-4811-BE70-3E99A14E89D9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {9C4EF4AE-24AC-494E-BB1E-389E59772369} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-11] (Adobe Systems Incorporated)
Task: {A66165D0-A739-46B9-AA91-33C0AE65F710} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003UA => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {ABD96266-25AF-494C-B2F5-17C5D8F015E2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {B3ACA1F2-AC10-4A74-A012-61E186CB35DD} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {BEE6EDB5-D13A-4C37-B3C9-40075E803219} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {D1301EC2-67C9-4E08-9A87-56DB18075640} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
==================== Loaded Modules (whitelisted) =============
2012-10-05 10:38 - 2012-04-05 17:35 - 00327392 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2013-08-29 01:39 - 2013-08-29 01:40 - 04287536 _____ () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
2010-08-04 15:58 - 2010-08-04 15:58 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-09-30 22:36 - 2010-09-30 22:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-02-14 11:30 - 2014-02-14 11:30 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\bfd5296be62268bc7a31a424f0d1ad5f\IsdiInterop.ni.dll
2010-10-01 09:40 - 2010-03-03 20:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\\Downloads\Bestaetigung_Rechnung_zu_Ihrer_byebye_Reise_21200789.eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 100c
Startzeit: 01cf7f6385094897
Endzeit: 0
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: cbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1604
Startzeit: 01cf7f6206b8e485
Endzeit: 5
Anwendungspfad: C:\Users\\Downloads\FRST64.exe
Berichts-ID: 4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 30.5.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 378
Startzeit: 01cf7f61ef976bca
Endzeit: 16
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: 33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 04:24:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 01:44:07 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/03/2014 00:23:08 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/02/2014 11:25:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
System errors:
=============
Error: (06/03/2014 11:31:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 01:44:07 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 03:09:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 00:23:08 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 00:21:54 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000116 (0xfffffa8009e0f010, 0xfffff88003c14f94, 0x0000000000000000, 0x0000000000000002)C:\Windows\MEMORY.DMP060314-22698-01
Error: (06/03/2014 00:21:45 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.06.2014 um 00:19:46 unerwartet heruntergefahren.
Error: (06/02/2014 11:26:02 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (06/02/2014 11:25:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/02/2014 11:23:54 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.06.2014 um 23:22:30 unerwartet heruntergefahren.
Error: (06/02/2014 07:46:41 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Microsoft Office Sessions:
=========================
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1100c01cf7f63850948970C:\Users\\Desktop\FRST64.execbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1160401cf7f6206b8e4855C:\Users\\Downloads\FRST64.exe4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe30.5.2014.037801cf7f61ef976bca16C:\Users\\Desktop\FRST64.exe33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 04:24:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 01:44:07 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/03/2014 00:23:08 AM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (06/02/2014 11:25:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
CodeIntegrity Errors:
===================================
Date: 2014-06-01 01:13:13.041
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-01 01:13:12.901
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 56%
Total physical RAM: 3959.48 MB
Available physical RAM: 1714.81 MB
Total Pagefile: 7917.15 MB
Available Pagefile: 5101 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:727.71 GB) (Free:494.02 GB) NTFS
Drive d: (Volume) (Fixed) (Total:195.31 GB) (Free:195.22 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:8 GB) (Free:2.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 30B6D843)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=728 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
05.06.2014, 07:58
| #19 |
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
FF Extension: Search Assistant - C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18]
FF Extension: ep - C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24]
Task: {2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} - \PC Performer Manager No Task File <==== ATTENTION
Task: {77E350C2-2250-4BEE-B575-EF12CA6A03F8} - \update-sys No Task File <==== ATTENTION
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {B3ACA1F2-AC10-4A74-A012-61E186CB35DD} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {6E350C8D-3672-4719-8CF1-5A8B8CA44909} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
|
|
05.06.2014, 13:40
| #20 |
| | WINDOWS 7 kommen ständig PopUps usw...Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-06-2014
Ran by at 2014-06-05 14:30:44 Run:2
Running from C:\Users\\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
FF Extension: Search Assistant - C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18]
FF Extension: ep - C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24]
Task: {2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} - \PC Performer Manager No Task File <==== ATTENTION
Task: {77E350C2-2250-4BEE-B575-EF12CA6A03F8} - \update-sys No Task File <==== ATTENTION
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {B3ACA1F2-AC10-4A74-A012-61E186CB35DD} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: {6E350C8D-3672-4719-8CF1-5A8B8CA44909} - System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
end
*****************
C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} not found.
C:\Users\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2D13B59E-4C34-49F2-81B8-8A7F2D96CC2F} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer Manager => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{77E350C2-2250-4BEE-B575-EF12CA6A03F8} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77E350C2-2250-4BEE-B575-EF12CA6A03F8} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-sys => Key deleted successfully.
C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000.job => Moved successfully.
C:\Windows\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003.job => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B3ACA1F2-AC10-4A74-A012-61E186CB35DD} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B3ACA1F2-AC10-4A74-A012-61E186CB35DD} => Key deleted successfully.
C:\Windows\System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-S-1-5-21-2465613748-4109621216-2680054910-1000 => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{6E350C8D-3672-4719-8CF1-5A8B8CA44909} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6E350C8D-3672-4719-8CF1-5A8B8CA44909} => Key deleted successfully.
C:\Windows\System32\Tasks\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\update-S-1-5-21-2465613748-4109621216-2680054910-1003 => Key deleted successfully.
==== End of Fixlog ====
|
|
05.06.2014, 15:10
| #21 |
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... FRST bitte erneut ausführen, aber dieses Mal nicht in Code-Tags einfügen, sondern die beiden TXT Dateien als Anhang hier hinzufügen... und bitte nichts an der logdatei ändern!!
Geändert von M-K-D-B (05.06.2014 um 15:24 Uhr) |
|
05.06.2014, 17:51
| #22 |
| | WINDOWS 7 kommen ständig PopUps usw...Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=ee9ca530ab79504c87fa62cf05d90258
# engine=18573
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2014-06-05 04:28:25
# local_time=2014-06-05 06:28:25 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 14724 146537880 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 15040 153615552 0 0
# scanned=334635
# found=5
# cleaned=0
# scan_time=13506
sh=61468A7CC90A3B17FE6FC3BD3483DD14876A9677 ft=1 fh=c71c00114730e175 vn="Variante von Win32/AdWare.AD150.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit-soft\Re-markit155.exe.vir"
sh=42DC75BF8CC0BE5A72011A479CBAE014657031D5 ft=1 fh=4c5161a413076e38 vn="Variante von Win32/AdWare.AddLyrics.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit-soft\Re-markit_wd.exe.vir"
sh=DD6EAABBBD5D972B1BE04D6691815BECB6C883CD ft=1 fh=c71c0011587627e9 vn="Variante von Win32/AdWare.AddLyrics.AM Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit-soft\ReMar.exe.vir"
sh=98FBAF1BAD657D5BBEE81FC5941E703E21A7EDA8 ft=1 fh=c9945bcee3152d3c vn="Win32/AdWare.AddLyrics.AE Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Re-markit-soft\Uninstall.exe.vir"
sh=9F053D0E91F5601A7FDE8DF8F00B0442BC9B9BDF ft=1 fh=66c37f768c3da5e2 vn="Variante von MSIL/Spy.Keylogger.LO Trojaner" ac=I fn="C:\Users\Jürgen\Downloads\FIFA 13 Münzen Hack.exe"
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-06-2014 Ran by (administrator) on -PC on 05-06-2014 18:39:03 Running from C:\Users\\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe ( ) C:\Windows\System32\lxbkcoms.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files (x86)\XSManager\WTGService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (4G Systems GmbH & Co. KG) C:\Windows\service4g.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Service.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-Network.exe (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (BlueStack Systems) C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\System32\alg.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe (Microsoft Corporation) C:\Windows\System32\wscript.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (4G Systems GmbH & Co. KG) C:\Windows\starter4g.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmon.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (Comvigo, Inc.) C:\Windows\SysWOW64\qimlsrv.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Comvigo, Inc.) C:\Windows\SysWOW64\dsrviml.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE (Farbar) C:\Users\\Desktop\FRST64 (3).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor) HKLM\...\Run: [lxbkbmgr.exe] => C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-30] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [starter4g] => C:\Windows\starter4g.exe [160424 2011-03-30] (4G Systems GmbH & Co. KG) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-05-27] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [601928 2013-06-19] (BlueStack Systems, Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [LightShot] => C:\Users\\AppData\Local\Skillbrains\lightshot\LightShot.exe Flags: uninsdeletevalue HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3588952 2014-04-25] (Electronic Arts) HKU\S-1-5-21-2465613748-4109621216-2680054910-1000\...\Run: [Pando Media Booster] => C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [4287536 2013-08-29] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML.lnk ShortcutTarget: IML.lnk -> C:\Windows\System32\iml.vbs () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\IML64.lnk ShortcutTarget: IML64.lnk -> C:\Windows\SysWOW64\iml.vbs () Startup: C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Game Alarm.lnk ShortcutTarget: Game Alarm.lnk -> C:\Games\Game Alarm\gamealarm.exe (Europe Support Ltd. N.V.) Startup: C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = Hyrican® Informationssysteme AG HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.0.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF SearchPlugin: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\searchplugins\%Protector Process Name%.xml FF SearchPlugin: C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\searchplugins\yandex.ru-230807.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\staged [2014-06-03] FF Extension: Search Assistant - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18] FF Extension: ep - C:\Users\\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24] Chrome: ======= CHR HomePage: CHR Extension: (Google Docs) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-01] CHR Extension: (Google Drive) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-01] CHR Extension: (YouTube) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-07-21] CHR Extension: (Google-Suche) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-07-21] CHR Extension: (Google Wallet) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Google Mail) - C:\Users\\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-07-21] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-05-27] (Avira Operations GmbH & Co. KG) R2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [393032 2013-06-19] (BlueStack Systems, Inc.) R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [384840 2013-06-19] (BlueStack Systems, Inc.) R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( ) R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( ) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 WTGService; C:\Program Files (x86)\XSManager\WTGService.exe [327392 2012-04-05] () R2 XS Stick Service; C:\Windows\service4g.exe [145064 2011-03-30] (4G Systems GmbH & Co. KG) ==================== Drivers (Whitelisted) ==================== R3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-04-29] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG) R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [70984 2013-06-19] (BlueStack Systems) S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-10-05] (Mobile Connector) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-05] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 RTL8187B; C:\Windows\System32\DRIVERS\rtl8187B.sys [450048 2010-03-31] (Realtek Semiconductor Corporation ) R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [762472 2011-10-31] (Realtek Semiconductor Corporation ) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-05 18:38 - 2014-06-05 18:38 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (3).exe 2014-06-05 18:38 - 2014-06-05 18:38 - 02068992 _____ (Farbar) C:\Users\\Desktop\FRST64 (3).exe 2014-06-05 14:33 - 2014-06-05 14:33 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-05 14:32 - 2014-06-05 14:32 - 02347384 _____ (ESET) C:\Users\\Downloads\esetsmartinstaller_deu.exe 2014-06-05 14:29 - 2014-06-05 14:30 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (2).exe 2014-06-04 19:13 - 2014-06-04 19:14 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (1).exe 2014-06-04 18:41 - 2014-06-01 23:37 - 00065553 _____ () C:\zoek-results2014-06-01-213745.log 2014-06-04 18:39 - 2014-06-04 18:53 - 00002954 _____ () C:\runcheck.txt 2014-06-04 16:26 - 2014-06-04 16:26 - 00000000 _____ () C:\Windows\SysWOW64\shoB3C7.tmp 2014-06-03 21:40 - 2014-06-03 21:42 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64.exe 2014-06-03 16:27 - 2014-06-03 16:27 - 00000000 ____D () C:\Users\\AppData\Roaming\Security Systems 2014-06-03 16:26 - 2014-06-03 16:26 - 02620112 _____ (Skillbrains ) C:\Users\\Desktop\setup-lightshot3-2-0-0.exe 2014-06-03 00:21 - 2014-06-03 00:21 - 00832944 _____ () C:\Windows\Minidump\060314-22698-01.dmp 2014-06-02 23:17 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Documents\AdwCleaner[S0].txt 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-06-02 22:58 - 2014-06-02 22:59 - 01110476 _____ () C:\Users\\Downloads\7z920.exe 2014-06-02 16:53 - 2014-06-02 16:53 - 00000000 _____ () C:\Windows\SysWOW64\sho1DE3.tmp 2014-06-02 00:03 - 2014-06-02 00:05 - 00033347 _____ () C:\Users\\Downloads\Addition.txt 2014-06-02 00:02 - 2014-06-02 00:04 - 00041741 _____ () C:\Users\\Downloads\FRST.txt 2014-06-01 23:39 - 2014-06-01 23:39 - 00065175 _____ () C:\Users\\Desktop\zoek-results.txt 2014-06-01 23:35 - 2014-06-05 18:39 - 00000000 ____D () C:\Users\\AppData\Local\Temp 2014-06-01 23:35 - 2014-06-04 16:18 - 00000000 ____D () C:\Users\Martina\AppData\Local\temp 2014-06-01 23:35 - 2014-06-03 20:55 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\temp 2014-06-01 23:35 - 2014-06-02 16:42 - 00000000 ____D () C:\Users\Elvira\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-01 23:01 - 2014-06-04 18:41 - 00000381 _____ () C:\zoek-results.log 2014-06-01 22:58 - 2014-06-01 23:30 - 00000000 ____D () C:\zoek_backup 2014-06-01 22:55 - 2014-06-04 19:11 - 00020015 _____ () C:\Users\\Desktop\mbam.txt 2014-06-01 22:10 - 2014-06-05 18:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-01 22:10 - 2014-06-04 19:08 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-01 22:10 - 2014-06-04 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-01 22:10 - 2014-06-04 19:08 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-01 22:10 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-01 22:10 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-06-01 22:10 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-06-01 22:10 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-06-01 22:08 - 2014-06-01 22:08 - 00005727 _____ () C:\Users\\Desktop\JRT.txt 2014-06-01 21:57 - 2014-06-01 21:57 - 00000000 ____D () C:\Windows\ERUNT 2014-06-01 21:53 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Desktop\AdwCleaner[S0].txt 2014-06-01 21:36 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-06-01 21:33 - 2014-06-04 18:19 - 00000000 ____D () C:\AdwCleaner 2014-06-01 21:32 - 2014-06-01 21:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-01 21:31 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Desktop\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Desktop\JRT.exe 2014-06-01 21:30 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Desktop\adwcleaner_3.211.exe 2014-06-01 21:29 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Downloads\zoek.exe 2014-06-01 21:28 - 2014-06-01 21:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Downloads\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Downloads\JRT.exe 2014-06-01 01:19 - 2014-06-01 01:19 - 00051290 _____ () C:\ComboFix.txt 2014-05-31 21:17 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-05-31 21:17 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-05-31 21:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-05-31 21:17 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-05-31 21:15 - 2014-06-01 01:19 - 00000000 ____D () C:\Qoobox 2014-05-31 21:14 - 2014-06-01 01:16 - 00000000 ____D () C:\Windows\erdnt 2014-05-31 21:12 - 2014-05-31 21:08 - 05203398 ____R (Swearware) C:\Users\\Desktop\ComboFix.exe 2014-05-31 21:07 - 2014-05-31 21:08 - 05203398 _____ (Swearware) C:\Users\\Downloads\ComboFix.exe 2014-05-31 20:38 - 2014-06-04 19:17 - 00037074 _____ () C:\Users\\Desktop\Addition.txt 2014-05-31 20:37 - 2014-06-05 18:39 - 00016708 _____ () C:\Users\\Desktop\FRST.txt 2014-05-31 20:37 - 2014-06-05 18:39 - 00000000 ____D () C:\FRST 2014-05-31 20:10 - 2014-05-31 20:11 - 00250250 _____ () C:\Users\\Downloads\140520063508.jpeg 2014-05-31 16:02 - 2014-05-31 16:02 - 00052891 _____ () C:\Users\Jürgen\Downloads\7B1.tmp 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\PopCap Games 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\EA Core 2014-05-29 15:43 - 2014-05-29 15:43 - 00001286 _____ () C:\Users\Public\Desktop\Pflanzen gegen Zombies.lnk 2014-05-29 15:43 - 2014-05-29 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pflanzen gegen Zombies 2014-05-17 10:44 - 2014-05-17 10:44 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job 2014-05-14 22:03 - 2014-05-06 02:46 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-14 22:03 - 2014-05-06 02:21 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-14 22:03 - 2014-05-06 02:21 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-14 22:03 - 2014-05-06 01:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-14 22:03 - 2014-05-06 01:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-14 22:03 - 2014-05-06 01:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-05-14 14:00 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-14 14:00 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-14 14:00 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-05-14 14:00 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-05-14 14:00 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-05-14 14:00 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-05-14 14:00 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-05-14 14:00 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-05-14 14:00 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-05-14 14:00 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-05-14 14:00 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-05-14 14:00 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-05-14 14:00 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2014-05-14 14:00 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe 2014-05-14 14:00 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll 2014-05-14 14:00 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2014-05-14 14:00 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-05-14 14:00 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-05-14 14:00 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll 2014-05-14 14:00 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2014-05-14 14:00 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-05-12 19:41 - 2014-05-12 19:41 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (17).exe 2014-05-11 17:57 - 2014-05-11 17:58 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (16).exe 2014-05-11 10:47 - 2014-05-11 10:47 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job 2014-05-11 07:51 - 2014-05-11 07:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job 2014-05-10 19:18 - 2014-05-10 19:19 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (15).exe ==================== One Month Modified Files and Folders ======= 2014-06-05 18:39 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\\AppData\Local\Temp 2014-06-05 18:39 - 2014-05-31 20:37 - 00016708 _____ () C:\Users\\Desktop\FRST.txt 2014-06-05 18:39 - 2014-05-31 20:37 - 00000000 ____D () C:\FRST 2014-06-05 18:39 - 2013-08-29 02:01 - 00000000 ____D () C:\Users\\AppData\Local\PMB Files 2014-06-05 18:38 - 2014-06-05 18:38 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (3).exe 2014-06-05 18:38 - 2014-06-05 18:38 - 02068992 _____ (Farbar) C:\Users\\Desktop\FRST64 (3).exe 2014-06-05 18:28 - 2012-07-21 10:07 - 01470809 _____ () C:\Windows\WindowsUpdate.log 2014-06-05 18:18 - 2014-06-01 22:10 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-05 14:33 - 2014-06-05 14:33 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-05 14:32 - 2014-06-05 14:32 - 02347384 _____ (ESET) C:\Users\\Downloads\esetsmartinstaller_deu.exe 2014-06-05 14:30 - 2014-06-05 14:29 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (2).exe 2014-06-05 14:26 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-05 14:26 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-05 14:21 - 2012-09-12 01:43 - 00000000 ____D () C:\ProgramData\Origin 2014-06-05 14:19 - 2012-09-12 01:43 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-06-05 14:18 - 2013-12-10 00:50 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics 2014-06-05 14:16 - 2009-07-14 06:51 - 00179217 _____ () C:\Windows\setupact.log 2014-06-05 14:15 - 2010-10-01 09:36 - 00608524 _____ () C:\Windows\PFRO.log 2014-06-05 00:36 - 2013-12-04 02:02 - 02284937 _____ () C:\Windows\IE11_main.log 2014-06-04 19:17 - 2014-05-31 20:38 - 00037074 _____ () C:\Users\\Desktop\Addition.txt 2014-06-04 19:14 - 2014-06-04 19:13 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64 (1).exe 2014-06-04 19:11 - 2014-06-01 22:55 - 00020015 _____ () C:\Users\\Desktop\mbam.txt 2014-06-04 19:08 - 2014-06-01 22:10 - 00001113 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-06-04 19:08 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-06-04 19:08 - 2014-06-01 22:10 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-06-04 18:53 - 2014-06-04 18:39 - 00002954 _____ () C:\runcheck.txt 2014-06-04 18:41 - 2014-06-01 23:01 - 00000381 _____ () C:\zoek-results.log 2014-06-04 18:19 - 2014-06-01 21:33 - 00000000 ____D () C:\AdwCleaner 2014-06-04 16:26 - 2014-06-04 16:26 - 00000000 _____ () C:\Windows\SysWOW64\shoB3C7.tmp 2014-06-04 16:18 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Martina\AppData\Local\temp 2014-06-03 21:42 - 2014-06-03 21:40 - 02068992 _____ (Farbar) C:\Users\\Downloads\FRST64.exe 2014-06-03 21:32 - 2014-02-28 16:37 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2014-06-03 21:30 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-06-03 20:55 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\temp 2014-06-03 16:27 - 2014-06-03 16:27 - 00000000 ____D () C:\Users\\AppData\Roaming\Security Systems 2014-06-03 16:27 - 2012-07-22 23:07 - 00000779 _____ () C:\Users\\AppData\Local\UserProducts.xml 2014-06-03 16:27 - 2012-07-22 23:07 - 00000000 ____D () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LightShot 2014-06-03 16:26 - 2014-06-03 16:26 - 02620112 _____ (Skillbrains ) C:\Users\\Desktop\setup-lightshot3-2-0-0.exe 2014-06-03 13:56 - 2014-03-06 18:07 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-06-03 00:21 - 2014-06-03 00:21 - 00832944 _____ () C:\Windows\Minidump\060314-22698-01.dmp 2014-06-03 00:21 - 2012-11-25 09:51 - 600737197 _____ () C:\Windows\MEMORY.DMP 2014-06-03 00:21 - 2012-11-25 09:51 - 00000000 ____D () C:\Windows\Minidump 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip 2014-06-02 22:59 - 2014-06-02 22:59 - 00000000 ____D () C:\Program Files (x86)\7-Zip 2014-06-02 22:59 - 2014-06-02 22:58 - 01110476 _____ () C:\Users\\Downloads\7z920.exe 2014-06-02 19:33 - 2012-07-21 15:29 - 00002380 _____ () C:\Users\Martina\Desktop\Google Chrome.lnk 2014-06-02 16:53 - 2014-06-02 16:53 - 00000000 _____ () C:\Windows\SysWOW64\sho1DE3.tmp 2014-06-02 16:42 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Elvira\AppData\Local\temp 2014-06-02 15:17 - 2012-07-21 21:59 - 00000000 ____D () C:\Users\Jürgen\AppData\Local\Mozilla 2014-06-02 00:05 - 2014-06-02 00:03 - 00033347 _____ () C:\Users\\Downloads\Addition.txt 2014-06-02 00:04 - 2014-06-02 00:02 - 00041741 _____ () C:\Users\\Downloads\FRST.txt 2014-06-01 23:39 - 2014-06-01 23:39 - 00065175 _____ () C:\Users\\Desktop\zoek-results.txt 2014-06-01 23:37 - 2014-06-04 18:41 - 00065553 _____ () C:\zoek-results2014-06-01-213745.log 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Public\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default\AppData\Local\temp 2014-06-01 23:35 - 2014-06-01 23:35 - 00000000 ____D () C:\Users\Default User\AppData\Local\temp 2014-06-01 23:30 - 2014-06-01 22:58 - 00000000 ____D () C:\zoek_backup 2014-06-01 23:24 - 2012-07-21 10:25 - 00000000 ____D () C:\Users\ 2014-06-01 22:10 - 2014-06-01 22:10 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-01 22:08 - 2014-06-01 22:08 - 00005727 _____ () C:\Users\\Desktop\JRT.txt 2014-06-01 21:57 - 2014-06-01 21:57 - 00000000 ____D () C:\Windows\ERUNT 2014-06-01 21:53 - 2014-06-02 23:17 - 00124182 _____ () C:\Users\\Documents\AdwCleaner[S0].txt 2014-06-01 21:53 - 2014-06-01 21:53 - 00124182 _____ () C:\Users\\Desktop\AdwCleaner[S0].txt 2014-06-01 21:40 - 2012-07-21 15:21 - 00000000 ____D () C:\Users\Martina 2014-06-01 21:40 - 2012-07-21 15:12 - 00000000 ____D () C:\Users\Elvira 2014-06-01 21:40 - 2012-07-21 14:35 - 00000000 ____D () C:\Users\Jürgen 2014-06-01 21:40 - 2012-07-21 10:25 - 00000000 ___RD () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-06-01 21:31 - 2014-06-01 21:32 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Desktop\mbam-setup-2.0.2.1012.exe 2014-06-01 21:31 - 2014-06-01 21:31 - 01285120 _____ () C:\Users\\Desktop\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:29 - 01285120 _____ () C:\Users\\Downloads\zoek.exe 2014-06-01 21:31 - 2014-06-01 21:28 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-01 21:28 - 2014-06-01 21:31 - 01016261 _____ (Thisisu) C:\Users\\Desktop\JRT.exe 2014-06-01 21:28 - 2014-06-01 21:30 - 01327971 _____ () C:\Users\\Desktop\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01327971 _____ () C:\Users\\Downloads\adwcleaner_3.211.exe 2014-06-01 21:28 - 2014-06-01 21:28 - 01016261 _____ (Thisisu) C:\Users\\Downloads\JRT.exe 2014-06-01 21:19 - 2010-10-01 08:53 - 00000000 ____D () C:\ProgramData\Norton 2014-06-01 08:29 - 2009-07-14 19:58 - 00699884 _____ () C:\Windows\system32\perfh007.dat 2014-06-01 08:29 - 2009-07-14 19:58 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2014-06-01 08:29 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-06-01 01:19 - 2014-06-01 01:19 - 00051290 _____ () C:\ComboFix.txt 2014-06-01 01:19 - 2014-05-31 21:15 - 00000000 ____D () C:\Qoobox 2014-06-01 01:19 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-06-01 01:16 - 2014-05-31 21:14 - 00000000 ____D () C:\Windows\erdnt 2014-06-01 01:15 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-05-31 21:08 - 2014-05-31 21:12 - 05203398 ____R (Swearware) C:\Users\\Desktop\ComboFix.exe 2014-05-31 21:08 - 2014-05-31 21:07 - 05203398 _____ (Swearware) C:\Users\\Downloads\ComboFix.exe 2014-05-31 20:11 - 2014-05-31 20:10 - 00250250 _____ () C:\Users\\Downloads\140520063508.jpeg 2014-05-31 19:54 - 2014-01-21 14:44 - 00000000 ____D () C:\Users\Jürgen\Documents\FIFA 14 2014-05-31 16:02 - 2014-05-31 16:02 - 00052891 _____ () C:\Users\Jürgen\Downloads\7B1.tmp 2014-05-30 08:22 - 2012-07-21 15:20 - 00002375 _____ () C:\Users\Elvira\Desktop\Google Chrome.lnk 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\PopCap Games 2014-05-29 15:46 - 2014-05-29 15:46 - 00000000 ____D () C:\ProgramData\EA Core 2014-05-29 15:43 - 2014-05-29 15:43 - 00001286 _____ () C:\Users\Public\Desktop\Pflanzen gegen Zombies.lnk 2014-05-29 15:43 - 2014-05-29 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pflanzen gegen Zombies 2014-05-29 15:43 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-05-29 15:41 - 2010-10-01 08:19 - 00116460 _____ () C:\Windows\DirectX.log 2014-05-29 15:38 - 2012-09-12 01:55 - 00000000 ____D () C:\Program Files (x86)\Origin Games 2014-05-29 15:05 - 2012-09-12 01:55 - 00000000 ____D () C:\Users\Jürgen\AppData\Roaming\Origin 2014-05-28 15:35 - 2012-08-14 02:38 - 00000000 ____D () C:\Users\Jürgen\AppData\Roaming\.minecraft 2014-05-28 08:14 - 2012-07-21 10:38 - 00002380 _____ () C:\Users\\Desktop\Google Chrome.lnk 2014-05-26 15:56 - 2014-01-08 17:58 - 00000000 ____D () C:\Users\Jürgen\Tracing 2014-05-23 19:34 - 2012-07-21 14:48 - 00002375 _____ () C:\Users\Jürgen\Desktop\Google Chrome.lnk 2014-05-21 10:29 - 2012-07-21 10:25 - 00000000 ___RD () C:\Users\\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-17 19:31 - 2012-07-21 15:21 - 00000000 ___RD () C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-17 19:31 - 2012-07-21 15:21 - 00000000 ___RD () C:\Users\Martina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-17 10:44 - 2014-05-17 10:44 - 00001072 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job 2014-05-15 16:07 - 2012-07-21 15:12 - 00000000 ___RD () C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-15 16:07 - 2012-07-21 15:12 - 00000000 ___RD () C:\Users\Elvira\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-15 16:05 - 2012-07-21 14:35 - 00000000 ___RD () C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-05-15 16:05 - 2012-07-21 14:35 - 00000000 ___RD () C:\Users\Jürgen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-05-15 16:01 - 2014-04-30 17:52 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-05-14 22:00 - 2013-07-13 07:57 - 00000000 ____D () C:\Windows\system32\MRT 2014-05-14 22:00 - 2010-10-01 10:17 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-05-12 19:41 - 2014-05-12 19:41 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (17).exe 2014-05-12 07:26 - 2014-06-01 22:10 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-05-12 07:26 - 2014-06-01 22:10 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-05-12 07:25 - 2014-06-01 22:10 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-05-11 17:58 - 2014-05-11 17:57 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (16).exe 2014-05-11 10:47 - 2014-05-11 10:47 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job 2014-05-11 07:51 - 2014-05-11 07:51 - 00001076 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job 2014-05-10 19:19 - 2014-05-10 19:18 - 00994160 _____ () C:\Users\Jürgen\Downloads\setup (15).exe 2014-05-09 08:14 - 2014-05-14 14:00 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-05-09 08:11 - 2014-05-14 14:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-05-06 02:46 - 2014-05-14 22:03 - 17847808 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-05-06 02:21 - 2014-05-14 22:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-05-06 02:21 - 2014-05-14 22:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-05-06 01:32 - 2014-05-14 22:03 - 12347392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-05-06 01:14 - 2014-05-14 22:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-05-06 01:14 - 2014-05-14 22:03 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll Some content of TEMP: ==================== C:\Users\Elvira\AppData\Local\Temp\avgnt.exe C:\Users\Elvira\AppData\Local\Temp\GURE1EC.exe C:\Users\Elvira\AppData\Local\Temp\rtdrvmon.exe C:\Users\\AppData\Local\Temp\7za.exe C:\Users\\AppData\Local\Temp\avgnt.exe C:\Users\\AppData\Local\Temp\FoxySecuritySetup.exe C:\Users\\AppData\Local\Temp\hijackthis.exe C:\Users\\AppData\Local\Temp\NirCmd.exe C:\Users\\AppData\Local\Temp\PEVZ.EXE C:\Users\\AppData\Local\Temp\Quarantine.exe C:\Users\\AppData\Local\Temp\remove.exe C:\Users\\AppData\Local\Temp\rtdrvmon.exe C:\Users\\AppData\Local\Temp\sed.exe C:\Users\\AppData\Local\Temp\shortcut.exe C:\Users\\AppData\Local\Temp\swreg.exe C:\Users\\AppData\Local\Temp\swxcacls.exe C:\Users\\AppData\Local\Temp\wget.exe C:\Users\\AppData\Local\Temp\zoek-delete.exe C:\Users\Jürgen\AppData\Local\Temp\avgnt.exe C:\Users\Jürgen\AppData\Local\Temp\rtdrvmon.exe C:\Users\Martina\AppData\Local\Temp\avgnt.exe C:\Users\Martina\AppData\Local\Temp\rtdrvmon.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-01 11:24 ==================== End Of Log ============================ --- --- --- --- --- --- FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-06-2014
Ran by at 2014-06-05 18:39:51
Running from C:\Users\\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.7.700.224 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.182 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Alcatraz (HKLM-x32\...\Alcatraz/DE-German_is1) (Version: - City Interactive)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - ATI Technologies Inc.) Hidden
Apowersoft kostenloser Bildschirmrekorder V1.2.4 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.2.4 - Apowersoft)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version: - Bohemia Interactive)
Arma 3 Tools (HKLM-x32\...\Steam App 233800) (Version: - Bohemia Interactive)
ATI Catalyst Install Manager (HKLM\...\{8DF9D3DF-6D03-A04F-217F-F2577D973DBE}) (Version: 3.0.795.0 - ATI Technologies, Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.4.642 - Avira)
Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)
BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM-x32\...\{9D84E30F-6757-4A56-BCB5-51ADE3AE8631}) (Version: 0.7.14.901 - BlueStack Systems, Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0930.2237.38732 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0930.2237.38732 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help English (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help French (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help German (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0930.2236.38732 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0930.2237.38732 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0930.2237.38732 - ATI) Hidden
Cross Fire En (HKLM-x32\...\Cross Fire_is1) (Version: - Z8Games.com)
Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1181 - SG INTERACTIVE)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
FIFA 13 (HKLM-x32\...\{A29E18C2-7AB1-4b6b-848C-5D5E2C85F0C0}) (Version: 1.2.0.0 - Electronic Arts)
FIFA 14 (HKLM-x32\...\{AA7A2800-1E75-4240-855B-03AFF8E5171E}) (Version: 1.0.0.7 - Electronic Arts)
Foxy Security (HKLM-x32\...\Foxy Security) (Version: - )
Free Audio CD to MP3 Converter version 1.3.12.1228 (HKLM-x32\...\Free Audio CD to MP3 Converter_is1) (Version: 1.3.12.1228 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.14.1022 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.14.1022 - DVDVideoSoft Ltd.)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.114 - Google Inc.)
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.23.0 - DealPly Technologies Ltd) <==== ATTENTION
Hama Black Force Pad (HKLM-x32\...\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}) (Version: 2007.01.01 - )
HydraVision (x32 Version: 4.2.180.0 - ATI Technologies Inc.) Hidden
IM Lock (HKLM-x32\...\IMLock) (Version: - Comvigo, Inc.)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
ISY N150 Micro WLAN USB-Adapter (HKLM-x32\...\{B20F9D1C-A0A5-4cd8-8306-DA03872311B1}) (Version: 1.00.0155 - ISY)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lexmark X1100 Series (HKLM\...\Lexmark X1100 Series) (Version: - Lexmark International, Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (x32 Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Need For Speed™ World (HKLM-x32\...\{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1) (Version: 1.0.0.993 - Electronic Arts)
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.0.2.2065 - Electronic Arts, Inc.)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6121 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6194 - Realtek Semiconductor Corp.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sniper - Art of Victory (HKLM-x32\...\sniper_de_is1) (Version: - City Interactive)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.8.1 - TeamSpeak Systems GmbH)
VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WiseConvert (HKLM-x32\...\WiseConvert) (Version: 1.0 - WiseConvert)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1) (Version: - Wargaming.net)
XSManager (HKLM-x32\...\XSManager) (Version: 3.2 - XSManager)
==================== Restore Points =========================
31-05-2014 01:00:50 Windows Update
31-05-2014 05:58:19 Windows Update
01-06-2014 00:18:30 Windows Update
01-06-2014 21:01:41 zoek.exe restore point
01-06-2014 23:46:03 TuneUp Utilities 2013 wird entfernt
01-06-2014 23:47:18 TuneUp Utilities Language Pack (de-DE) wird entfernt
02-06-2014 00:53:25 Windows Update
02-06-2014 14:42:32 Windows Update
02-06-2014 17:36:37 Windows Update
02-06-2014 22:16:17 Windows Update
03-06-2014 01:00:18 Windows Update
03-06-2014 21:28:14 Windows Update
04-06-2014 22:24:29 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2014-06-01 01:15 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {00CDF369-5C82-4B09-A8B8-22E0110976DE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {162D19D2-88E6-425F-ACF9-085709C10976} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003Core => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {180C32E6-A575-49A3-AA4D-7E9EDC44A1AA} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
Task: {1FD7E7FA-4C1B-46AA-B808-A6B47969B523} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {25715EC7-88B9-4811-B0FD-540AC855053B} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {620FBD68-8B3D-47C5-BEE1-EA19B1705EC4} - System32\Tasks\Games\UpdateCheck_S-1-5-21-2465613748-4109621216-2680054910-1001
Task: {62745FA6-88B4-4F26-B2F4-09469D925348} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {635AC757-77D2-41EE-A578-F6A8974BF31D} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {6875CA21-089D-4DC0-A439-FE49B1E33DB4} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {820F5D76-F745-4811-BE70-3E99A14E89D9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {9C4EF4AE-24AC-494E-BB1E-389E59772369} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-11] (Adobe Systems Incorporated)
Task: {A66165D0-A739-46B9-AA91-33C0AE65F710} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1003UA => C:\Users\Jürgen\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {ABD96266-25AF-494C-B2F5-17C5D8F015E2} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: {BEE6EDB5-D13A-4C37-B3C9-40075E803219} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\SysWOW64\FlashPlayerUpdateService.exe
Task: {D1301EC2-67C9-4E08-9A87-56DB18075640} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe [2012-07-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000Core1cf6cdd52a1ae5.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1000UA.job => C:\Users\\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001Core1cf71ac260e523e.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1001UA.job => C:\Users\Elvira\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002Core1cf6cf59b1b4d7c.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2465613748-4109621216-2680054910-1002UA.job => C:\Users\Martina\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013.job => C:\Program Files (x86)\TuneUp Utilities 2013\OneClick.exe
==================== Loaded Modules (whitelisted) =============
2005-09-13 16:27 - 2005-09-13 16:27 - 00054784 _____ () C:\Windows\system32\lxbkcnv4.dll
2012-10-05 10:38 - 2012-04-05 17:35 - 00327392 ____N () C:\Program Files (x86)\XSManager\WTGService.exe
2013-08-29 01:39 - 2013-08-29 01:40 - 04287536 _____ () C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe
2010-08-04 15:58 - 2010-08-04 15:58 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-09-30 22:36 - 2010-09-30 22:36 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2014-02-14 11:30 - 2014-02-14 11:30 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\bfd5296be62268bc7a31a424f0d1ad5f\IsdiInterop.ni.dll
2010-10-01 09:40 - 2010-03-03 20:08 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-05-28 08:14 - 2014-05-14 01:40 - 00716616 _____ () C:\Users\\AppData\Local\Google\Chrome\Application\35.0.1916.114\libglesv2.dll
2014-05-28 08:14 - 2014-05-14 01:40 - 00126280 _____ () C:\Users\\AppData\Local\Google\Chrome\Application\35.0.1916.114\libegl.dll
2014-05-28 08:14 - 2014-05-14 01:40 - 04217672 _____ () C:\Users\\AppData\Local\Google\Chrome\Application\35.0.1916.114\pdf.dll
2014-05-28 08:14 - 2014-05-14 01:40 - 00414536 _____ () C:\Users\\AppData\Local\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll
2014-05-28 08:14 - 2014-05-14 01:40 - 01732424 _____ () C:\Users\\AppData\Local\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\Users\\Downloads\Bestaetigung_Rechnung_zu_Ihrer_byebye_Reise_21200789.eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\\Downloads\nachricht.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (06/05/2014 06:38:37 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/05/2014 06:36:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/05/2014 02:32:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/05/2014 02:32:54 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 100c
Startzeit: 01cf7f6385094897
Endzeit: 0
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: cbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 1.6.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1604
Startzeit: 01cf7f6206b8e485
Endzeit: 5
Anwendungspfad: C:\Users\\Downloads\FRST64.exe
Berichts-ID: 4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 30.5.2014.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 378
Startzeit: 01cf7f61ef976bca
Endzeit: 16
Anwendungspfad: C:\Users\\Desktop\FRST64.exe
Berichts-ID: 33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (06/05/2014 02:20:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
Error: (06/05/2014 00:36:39 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 11:31:23 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 01:44:07 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 03:09:18 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (06/03/2014 00:23:08 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (06/03/2014 00:21:54 AM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000116 (0xfffffa8009e0f010, 0xfffff88003c14f94, 0x0000000000000000, 0x0000000000000002)C:\Windows\MEMORY.DMP060314-22698-01
Error: (06/03/2014 00:21:45 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.06.2014 um 00:19:46 unerwartet heruntergefahren.
Error: (06/02/2014 11:26:02 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (06/02/2014 11:25:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Microsoft Office Sessions:
=========================
Error: (06/05/2014 06:38:37 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\\Downloads\esetsmartinstaller_deu.exe
Error: (06/05/2014 06:36:25 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (06/05/2014 02:32:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\\Downloads\esetsmartinstaller_deu.exe
Error: (06/05/2014 02:32:54 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\\Downloads\esetsmartinstaller_deu.exe
Error: (06/03/2014 09:39:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1100c01cf7f63850948970C:\Users\\Desktop\FRST64.execbecc728-eb56-11e3-8157-1c6f6549ce08
Error: (06/03/2014 09:31:11 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst konnte nicht heruntergefahren werden. Aufgetretener Fehler: System.InvalidOperationException: UpdatePendingStatus kann nur während der Verarbeitung von Befehlen zum Starten, Beenden, Anhalten und Fortsetzen aufgerufen werden.
bei System.ServiceProcess.ServiceBase.RequestAdditionalTime(Int32 milliseconds)
bei BlueStacks.hyperDroid.Service.Service.OnStop()
bei BlueStacks.hyperDroid.Service.Service.OnShutdown()
bei System.ServiceProcess.ServiceBase.DeferredShutdown()
Error: (06/03/2014 09:29:02 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe1.6.2014.1160401cf7f6206b8e4855C:\Users\\Downloads\FRST64.exe4e779dbf-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 09:28:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe30.5.2014.037801cf7f61ef976bca16C:\Users\\Desktop\FRST64.exe33eeb150-eb55-11e3-a84b-1c6f6549ce08
Error: (06/03/2014 04:24:56 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
Error: (06/03/2014 04:24:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jürgen\Downloads\SoftonicDownloader_fuer_lightshot (1).exe
CodeIntegrity Errors:
===================================
Date: 2014-06-01 01:13:13.041
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-06-01 01:13:12.901
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 52%
Total physical RAM: 3959.48 MB
Available physical RAM: 1876.68 MB
Total Pagefile: 7917.15 MB
Available Pagefile: 4752.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:727.71 GB) (Free:491.42 GB) NTFS
Drive d: (Volume) (Fixed) (Total:195.31 GB) (Free:195.22 GB) NTFS
Drive e: (Recovery) (Fixed) (Total:8 GB) (Free:2.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 30B6D843)
Partition 1: (Active) - (Size=500 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=728 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=195 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
05.06.2014, 19:00
| #23 | ||
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... Servus, machst du deinen Benutzernamen unkenntlich? Zitat:
Zitat:
Wenn ja, wie lautet der Benutzername? Ich muss das wissen... daher habe ich auch geschrieben, nichts an der Logdatei zu verändern... ich vermute, dass du deinen Benutzernamen immer rausgelöscht hast... daher funktioniert auch mein Fix nur zum Teil. |
|
05.06.2014, 19:21
| #24 |
| | WINDOWS 7 kommen ständig PopUps usw... jo, den habe ich rausgelöscht. mein Benutzername ist Haasler |
|
05.06.2014, 19:40
| #25 |
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... Reste entfernen Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
FF Extension: Search Assistant - C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18]
FF Extension: ep - C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24]
C:\Users\Jürgen\Downloads\setup*.exe
Reboot:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Downloade Dir bitte  SecurityCheck und:
|
|
05.06.2014, 19:52
| #26 |
| | WINDOWS 7 kommen ständig PopUps usw... Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-06-2014 Ran by Haasler at 2014-06-05 20:37:40 Run:1 Running from C:\Users\Haasler\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** start FF Extension: Search Assistant - C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} [2012-09-18] FF Extension: ep - C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi [2014-02-24] C:\Users\Jürgen\Downloads\setup*.exe Reboot: end ***************** C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\{B3834E60-12A8-11E0-A289-939FDFD72085} => Moved successfully. C:\Users\Haasler\AppData\Roaming\Mozilla\Firefox\Profiles\3elvxd57.default\Extensions\jid1-0xtMKhXFEs4jIg@jetpack.xpi => Moved successfully. C:\Users\Jürgen\Downloads\setup*.exe => Moved successfully. The system needed a reboot. ==== End of Fixlog ==== |
|
05.06.2014, 20:00
| #27 |
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... fehlt noch SecurityCheck. |
|
05.06.2014, 20:16
| #28 |
| | WINDOWS 7 kommen ständig PopUps usw... Results of screen317's Security Check version 0.99.83 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` JavaFX 2.1.1 Java 7 Update 55 Adobe Flash Player 13.0.0.182 Adobe Reader 9 Adobe Reader XI Mozilla Firefox (28.0) Google Chrome 34.0.1847.131 Google Chrome 35.0.1916.114 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
06.06.2014, 11:33
| #29 |
| /// TB-Ausbilder | WINDOWS 7 kommen ständig PopUps usw... Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber.  Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Du verwendest veraltete Software auf deinem Rechner, was ein Sicherheitsrisiko darstellt. Daher solltest du veraltete Software deinstallieren und anschließend die aktuellste Version installieren. Folge dem Pfad Start > Systemsteuerung > Sofware / Programme deinstallieren. Deinstalliere die folgenden Programme von deinem Rechner:
Downloade und installiere dir bitte nun:Starte deinen Rechner nach der Installation neu auf. Schritt 2 Die Reihenfolge ist hier entscheidend.
Schritt 3 Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann. |
|
07.06.2014, 18:39
| #30 |
| | WINDOWS 7 kommen ständig PopUps usw... So, alles so gemacht, wie Du geschrieben hast. Hoffe mein PC bleibt sauber. Habe im mom keine Fragen mehr. Ein herzliches DANKE !!! Eine Spende an das Trojaner-Board folgt . Gruß Jackson11 1000 Dank |
|
Linear-Darstellung
