| |
| |||||||
Log-Analyse und Auswertung: Download Protect 2.2.1 unter Firefox/Windows 8.1Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
05.08.2014, 22:56
| #1 |
| |  Download Protect 2.2.1 unter Firefox/Windows 8.1 Guten Abend, kurze Vorgeschichte: ich habe heute das Laptop einer guten Freundin bekommen mit dem Problem, dass nach der Anmeldung sich nichts mehr bedienen lies und der Bildschirm in kurzen Abständen von komplett blau (kein bluescreen) zum Desktop und wieder zurück wechselte. Mit einer einfachen Systemwiederherstellung war dieses Problem am Ende erledigt. Allerdings kam zwischendurch eine "0x800700b7" Fehlermeldung von Windows. Die Wiederherstellung an sich dauerte mit rund 20 Minuten auch viiiel länger als in meiner bisherigen Erfahrung. Aktuell: Mit dem Start von Firefox bekam ich dann die Installation von dem Download Protect 2.2.1 Add-On an den Kopf geworfen und durch bisschen Recherche lande ich nun hier. Hallo!  Wie in eurer Anleitung beschrieben gibt's folgende Logs: - defogger: da kein Emulator installiert, nicht ausgeführt - FRST: FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 05-08-2014 23:02:12
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
() C:\Windows\System32\FXSCOM64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\PROGRA~2\SupTab\SEARCH~2.DLL File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - DefaultScope {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.244.0.3 209.244.0.4
FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\user.js
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [757872 2014-06-19] (Cherished Technololgy LIMITED)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
R2 TiumbnailExtractionHost; C:\WINDOWS\system32\FXSCOM64.exe [119296 2014-05-25] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-06] (Fuyu LIMITED)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 23:02 - 2014-08-05 23:02 - 00021289 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-05 23:02 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-06 18:25 - 2014-07-06 18:32 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-06 18:25 - 2014-07-06 18:28 - 00002640 _____ () C:\WINDOWS\System32\Tasks\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:28 - 00000302 _____ () C:\WINDOWS\Tasks\UpdaterEX.job
2014-07-06 18:25 - 2014-07-06 18:25 - 00000042 _____ () C:\Users\Mimi\AppData\Roaming\WB.CFG
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\Documents\PC Speed Maximizer
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-06 18:23 - 2014-07-06 18:23 - 28114944 _____ () C:\Users\Mimi\Downloads\SkypeSetup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-05 23:02 - 2014-08-05 23:02 - 00021289 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:02 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 23:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-05 22:57 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-05 16:37 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-05 16:35 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-05 16:34 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-05 16:33 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-05 16:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:55 - 2014-03-04 00:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-05 15:18 - 2014-03-25 21:04 - 00419328 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-05 13:30 - 2014-03-25 17:52 - 01284851 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-05 13:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-05 11:19 - 2013-11-14 00:18 - 00968498 _____ () C:\WINDOWS\PFRO.log
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
2014-07-14 22:06 - 2014-07-14 22:06 - 00000000 ____D () C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
2014-07-14 20:03 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:32 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-07-14 17:30 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-13 22:34 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
2014-07-06 18:32 - 2014-07-06 18:25 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-07-06 18:28 - 2014-07-06 18:25 - 00002640 _____ () C:\WINDOWS\System32\Tasks\UpdaterEX
2014-07-06 18:28 - 2014-07-06 18:25 - 00000302 _____ () C:\WINDOWS\Tasks\UpdaterEX.job
2014-07-06 18:25 - 2014-07-06 18:25 - 00000042 _____ () C:\Users\Mimi\AppData\Roaming\WB.CFG
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\Documents\PC Speed Maximizer
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\UpdaterEX
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2014-07-06 18:25 - 2014-07-06 18:25 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-07-06 18:23 - 2014-07-06 18:23 - 28114944 _____ () C:\Users\Mimi\Downloads\SkypeSetup.exe
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-05 15:31
==================== End Of Log ============================
Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-08-2014
Ran by Mimi at 2014-08-05 23:03:23
Running from C:\Users\Mimi\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (HKLM-x32\...\Adobe Photoshop Elements 11) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 11 (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 12.5.100.20928 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1016.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{AE7512E0-E5C5-CD28-EE55-F778BDD73A88}) (Version: 8.0.891.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bitcasa version 0.9.20.4133 (HKLM\...\{EDA09459-AD7D-4434-BA0C-647F6703EA12}_is1) (Version: 0.9.20.4133 - Bitcasa Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0928.0545.8475 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0928.546.8475 - Advanced Micro Devices, Inc.) Hidden
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4421.02 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.4421.02 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Easy File Share (HKLM-x32\...\{A7C37D4B-F37A-42E8-9B6A-B28C18AD4C12}) (Version: 1.3.4 - Samsung Electronics CO.,LTD.)
Elements 11 Organizer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
ETDWare X64 11.7.5.5_WHQL (HKLM\...\Elantech) (Version: 11.7.5.5 - ELAN Microelectronic Corp.)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Help Desk (HKLM\...\{3D85CD3F-00E0-4E14-82D6-1F9397DDD09B}) (Version: 1.0.8 - Samsung Electronics CO., LTD.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33070) (Version: 3.6.1.33070.11 - Intel)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.36702 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) PRO/Wireless Driver (Version: 16.01.5000.0577 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3412 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{E77289CF-12B9-4CAB-A49E-FEAE947F4D95}) (Version: 15.5.4.0423 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{0728A184-F899-4356-B93D-8228674F0DEB}) (Version: 2.6.1209.0268 - Motorola Solutions, Inc.)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (HKLM\...\{6097158B-0184-4140-BEC3-7885794D2571}) (Version: 3.5.40.0 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{c9967fbd-e3c3-4ed0-992a-5b33260f2944}) (Version: 16.1.5 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 16.01.5000.0269 - Intel Corporation) Hidden
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.6120.5004 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.1.0.18 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.2.3.51 - Symantec Corporation)
Norton Online Backup ARA (x32 Version: 4.1.0.14 - Symantec Corporation) Hidden
Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
PowerXpressHybrid (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
PSE11 STI Installer (x32 Version: 11.0 - Adobe Systems Incorporated) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
Raccolta foto (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.4.907.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6761 - Realtek Semiconductor Corp.)
Recovery (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 6.0.6.5 - Samsung Electronics CO., LTD.)
S Agent (Version: 1.0.9 - Samsung Electronics CO., LTD.) Hidden
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.13.3.38 - Client Connect LTD) <==== ATTENTION
Settings (HKLM-x32\...\{8CB5C357-12E5-41B1-A024-D57D4E6F32D9}) (Version: 2.0.1 - Samsung Electronics CO., LTD.)
Skype Click to Call (HKLM-x32\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 6.16 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
Support Center (HKLM\...\{3EB3E946-FB88-45C2-A19B-410D254657D9}) (Version: 2.1.20 - Samsung Electronics CO., LTD.)
Support Center FAQ (x32 Version: 1.0.6 - Samsung Electronics CO., LTD.) Hidden
SW Update (HKLM-x32\...\{F5B5BA56-8FEB-494B-84E6-C8DA9C2BEE50}) (Version: 2.1.6 - Samsung Electronics CO., LTD.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM-x32\...\{AAD986C1-5AC0-4E83-AEA4-44E10B78FB4A}) (Version: 1.2.00 - Samsung Electronics CO., LTD.)
Windows Live (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
WindowsMangerProtect20.0.0.502 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.502 - WindowsProtect LIMITED) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
14-07-2014 15:26:43 Windows Update
25-07-2014 19:57:06 Geplanter Prüfpunkt
03-08-2014 19:10:45 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0A00814E-B838-4F1B-B324-3D19B5E8F52F} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {0D088F4D-BFED-4D80-BAF9-9A306CF5EC00} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)
Task: {193D7CCA-9341-4D55-9554-FD81CA24EE0B} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {36A68B68-6839-43DF-9183-E7013A56BACC} - System32\Tasks\Settings => C:\Program Files (x86)\Samsung\Settings\sSettings.exe [2012-11-30] (Samsung Electronics CO., LTD.)
Task: {372DF15D-44D1-4950-99C7-2DCD7604237D} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4A25F201-66C4-4B12-BB6D-B08F1DBF9B30} - System32\Tasks\UpdaterEX => C:\Users\Mimi\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {6497046C-59A9-41B7-B1D5-1E932E10AC16} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-06-16] (Microsoft Corporation)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6B5F1B93-37EC-47EF-B2D5-A800A9717173} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {6B8651D8-2659-410C-B7A2-3A04D7E7654B} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {79C5A075-5387-4F8A-9172-BDA03AEA28F5} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {7A0AEC93-AB2A-429D-B0C8-54CFEF56661B} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {8218CA1A-291C-49B4-BDFC-E21E76A61105} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9573E73F-F7E7-4C2D-AF44-8F132BB51F9A} - System32\Tasks\SAgent => C:\Program Files\Samsung\S Agent\CommonAgent.exe [2012-10-25] (Samsung Electronics CO., LTD.)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {AC9FD6AC-6806-4359-86CE-78B1B04FB7B5} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2012-06-14] (Intel Corporation)
Task: {CA16D346-3114-4F80-9B27-29D13F6513F7} - \CreateChoiceProcessTask No Task File <==== ATTENTION
Task: {CB30FDD9-A09A-4381-AA37-7C2CE488D257} - System32\Tasks\advRecovery => C:\Program Files\Samsung\Recovery\WCScheduler.exe [2012-09-17] (SEC)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {DE485150-987B-43AE-A495-5666621CC448} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\UpdaterEX.job => C:\Users\Mimi\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2011-06-22 07:42 - 2011-06-22 07:42 - 00034304 _____ () C:\WINDOWS\System32\ssp4ml6.dll
2014-05-25 10:41 - 2014-05-25 10:41 - 00119296 _____ () C:\WINDOWS\system32\FXSCOM64.exe
2012-11-30 09:26 - 2012-11-30 09:26 - 00082312 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
2014-01-25 03:22 - 2014-01-25 03:22 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00028792 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdWrapper.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 01068664 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmd.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsBase.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00056440 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\HookDllPS2.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00211064 _____ () C:\Program Files (x86)\Samsung\Settings\CmdServer\WinCRT.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00026744 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsAPI.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00110712 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsBase.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00060536 _____ () C:\Program Files (x86)\Samsung\Settings\EasyMovieEnhancer.dll
2012-11-30 09:26 - 2012-11-30 09:26 - 00103032 _____ () C:\Program Files (x86)\Samsung\Settings\EasySettingsCmdClient.dll
2013-01-03 07:14 - 2012-06-25 20:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\WINDOWS\system32\Drivers\btmhsf.sys:Microsoft_Appcompat_ReinstallUpgrade
AlternateDataStreams: C:\Users\Mimi\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "AdobeAAMUpdater-1.0"
HKLM\...\StartupApproved\Run: => "Bitcasa"
HKLM\...\StartupApproved\Run32: => "Adobe Reader Speed Launcher"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "RemoteControl10"
HKCU\...\StartupApproved\Run: => "Skype"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10821063
Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10821063
Error: (08/05/2014 07:45:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 10807110
Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 10807110
Error: (08/05/2014 07:45:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (08/05/2014 04:36:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CCC.exe, Version: 3.5.0.0, Zeitstempel: 0x4f8350e0
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17055, Zeitstempel: 0x532954fb
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000000000005bf8
ID des fehlerhaften Prozesses: 0xf70
Startzeit der fehlerhaften Anwendung: 0xCCC.exe0
Pfad der fehlerhaften Anwendung: CCC.exe1
Pfad des fehlerhaften Moduls: CCC.exe2
Berichtskennung: CCC.exe3
Vollständiger Name des fehlerhaften Pakets: CCC.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CCC.exe5
Error: (08/05/2014 04:36:47 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: CCC.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.ObjectDisposedException
Stapel:
bei System.Threading.TimerQueueTimer.Change(UInt32, UInt32)
bei ATI.ACE.CCC.Implementation.CCC_Main.CCCNewThreadBegin(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object)
bei System.Threading.ThreadHelper.ThreadStart(System.Object)
Error: (08/05/2014 04:34:10 PM) (Source: ATIeRecord) (EventID: 16386) (User: )
Description: ATI EEU Client has failed to start
Error: (08/05/2014 03:37:39 PM) (Source: ESENT) (EventID: 455) (User: )
Description: svchost (1492) SRUJet: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\WINDOWS\system32\SRU\SRU005A5.log.
System errors:
=============
Error: (08/05/2014 04:30:46 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Norton 360" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (08/05/2014 03:23:22 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Intel® Centrino® Wireless Bluetooth® + High Speed Service" wurde nicht richtig gestartet.
Error: (08/05/2014 02:51:03 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet:
%%2147770990
Error: (08/05/2014 01:50:04 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: Microsoft.WindowsLive.Mail.AppXj3e9v0xw9sf8t58nqr15tqqb2yq4zsfg.mca
Error: (08/05/2014 00:54:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 05.08.2014 um 11:29:41 unerwartet heruntergefahren.
Error: (08/05/2014 11:29:41 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 05.08.2014 um 11:20:55 unerwartet heruntergefahren.
Error: (08/05/2014 10:47:35 AM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (08/05/2014 10:46:35 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert und an den Remoteendpunkt gesendet. Dies kann dazu führen, dass die Verbindung beendet wird. Die schwerwiegende Warnung hat folgenden für das TLS-Protokoll definierten Code: 40. Der Windows-SChannel-Fehlerstatus lautet: 252.
Error: (08/04/2014 10:17:55 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Error: (08/04/2014 10:17:25 PM) (Source: DCOM) (EventID: 10010) (User: MIRIAM)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 8077.6 MB
Available physical RAM: 6795.03 MB
Total Pagefile: 16781.6 MB
Available Pagefile: 15459.62 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:907.21 GB) (Free:837.08 GB) NTFS
Drive d: (MULTIBOOT) (Removable) (Total:14.89 GB) (Free:12.2 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 03092743)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)
==================== End Of Log ============================
- Gmer: schickte beim Start des Programms und am Ende des Scans folgende Meldung:  und folgende Meldung ebenfalls am Ende des Scans:  (Hab ich verpennt irgendwas zu deaktivieren?) Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-05 23:24:59
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000025 rev. 0,00MB
Running: Gmer-19357.exe; Driver: C:\Users\Mimi\AppData\Local\Temp\ugldypod.sys
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atiesrxx.exe[996] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\atieclxx.exe[1040] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\WLANExt.exe[1256] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff870041f6a 4 bytes [04, 70, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1864] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff870041f82 4 bytes [04, 70, F8, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[1728] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe[2160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2744] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\WINDOWS\Explorer.EXE[2412] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff87c48169a 4 bytes [48, 7C, F8, 7F]
.text C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff87c4816a2 4 bytes [48, 7C, F8, 7F]
.text C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff87c48181a 4 bytes [48, 7C, F8, 7F]
.text C:\Windows\System32\igfxpers.exe[3916] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff87c481832 4 bytes [48, 7C, F8, 7F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff870041f6a 4 bytes [04, 70, F8, 7F]
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[4808] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff870041f82 4 bytes [04, 70, F8, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [712:736] fffff96000865b90
Thread C:\WINDOWS\Explorer.EXE [2412:1056] 00007ff86f06d6bc
Thread C:\Windows\System32\SettingSyncHost.exe [2604:2548] 00007ff872c664f4
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
Disk \Device\Harddisk0\DR0 sector 0: rootkit-like behavior
---- EOF - GMER 2.1 ----
Meines Erachtens ist auch einiges an unnötiger Software installiert, aber das dürfte erstmal nebensächlich sein. Über Hilfe bin ich (wir) sehr dankbar! Viele Grüße, Simon |
|
06.08.2014, 02:47
| #2 |
| /// the machine /// TB-Ausbilder    | Download Protect 2.2.1 unter Firefox/Windows 8.1 hi,
__________________Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
06.08.2014, 09:02
| #3 |
| | Download Protect 2.2.1 unter Firefox/Windows 8.1 Moin, danke für die fixe Antwort. Hab ein paar Logs dabei:
__________________MBAM Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.08.2014 Suchlauf-Zeit: 09:18:20 Logdatei: mbam.txt Administrator: Nein Version: 2.00.2.1012 Malware Datenbank: v2014.03.04.09 Rootkit Datenbank: v2014.02.20.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Mimi Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 252157 Verstrichene Zeit: 8 Min, 58 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 1 PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, 1244, Löschen bei Neustart, [2326e51a5d1dbe78a8922276ea17748c] Module: 0 (No malicious items detected) Registrierungsschlüssel: 5 PUP.Optional.IePluginService.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\IePluginServices, In Quarantäne, [2326e51a5d1dbe78a8922276ea17748c], PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, In Quarantäne, [e663926d6515fd3950623c83e81b0000], PUP.Optional.CrossRider.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Crossrider, In Quarantäne, [60e944bbbfbbc96ddf97f0cfe91aa060], PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [0a3f42bd7307c6705e1a1f7524de14ec], PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [e26700ff4d2d57dfd1fd9b0fe1226d93], Registrierungswerte: 1 PUP.Optional.InstallCore.A, HKU\S-1-5-21-4177645711-3970229063-862042014-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0V1D1S1R1D0V1O, In Quarantäne, [e26700ff4d2d57dfd1fd9b0fe1226d93] Registrierungsdaten: 2 PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}),Ersetzt,[af9ad72899e1d462f2bf85aa8282cd33] PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.sweet-page.com/web/?type=ds&ts=1404663753&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9FD205754&q={searchTerms}),Ersetzt,[fe4b926d3347ef478b265cd36e963dc3] Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.IePluginService.A, C:\ProgramData\IePluginServices\PluginService.exe, Löschen bei Neustart, [2326e51a5d1dbe78a8922276ea17748c], Physische Sektoren: 0 (No malicious items detected) (end) AdwCleaner Programm ist beim ersten Löschen abgestürzt. Zweiter Versuch klappte. Code:
ATTFilter # AdwCleaner v3.302 - Bericht erstellt am 06/08/2014 um 09:37:02
# Aktualisiert 30/07/2014 von Xplode
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Mimi - MIRIAM
# Gestartet von : C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : TiumbnailExtractionHost
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\IePluginServices
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\Program Files (x86)\SupTab
Ordner Gelöscht : C:\Program Files (x86)\{27EA5D06-3363-4C45-AA22-D4AA3CF528A1}
Ordner Gelöscht : C:\Program Files\{6C52C230-9950-4FFB-80AF-C37F06029831}
Ordner Gelöscht : C:\Users\Mimi\AppData\Roaming\UpdaterEX
Ordner Gelöscht : C:\Users\Mimi\Documents\PC Speed Maximizer
Datei Gelöscht : C:\WINDOWS\System32\FXSCOM64.exe
Datei Gelöscht : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\user.js
***** [ Tasks ] *****
Task Gelöscht : UpdaterEX
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\bopakagnckmlgajfccecajhnimjiiedh
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Download Protect]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\UpdaterEX
Schlüssel Gelöscht : HKLM\Software\GlobalUpdate
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\SupDp
Schlüssel Gelöscht : HKLM\Software\SupTab
Schlüssel Gelöscht : HKLM\Software\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~1.DLL
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SupTab\SEARCH~2.DLL
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17126
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "14639063ab64a589e6732ba7b999f4e8");
*************************
AdwCleaner[R0].txt - [3385 octets] - [06/08/2014 09:33:19]
AdwCleaner[R1].txt - [3504 octets] - [06/08/2014 09:36:13]
AdwCleaner[S0].txt - [290 octets] - [06/08/2014 09:34:56]
AdwCleaner[S1].txt - [3088 octets] - [06/08/2014 09:37:02]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [3148 octets] ##########
JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8.1 x64
Ran by Mimi on 06.08.2014 at 9:41:51,70
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"
~~~ FireFox
Emptied folder: C:\Users\Mimi\AppData\Roaming\mozilla\firefox\profiles\ebxpazlm.default\minidumps [13 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.08.2014 at 9:50:29,11
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und ein frisches FRST Logfile FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 06-08-2014 09:53:27
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\ismagent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\CrashReportSender.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.244.0.3 209.244.0.4
FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:33 - 2014-08-06 09:39 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:17 - 2014-08-06 09:31 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-06 09:16 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-06 09:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-06 09:15 - 2014-08-06 09:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:16 - 2014-08-05 23:14 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:02 - 2014-08-06 09:53 - 00019067 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-06 09:53 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 09:53 - 2014-08-05 23:02 - 00019067 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-06 09:53 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:50 - 2014-03-04 00:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:40 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-06 09:40 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-06 09:39 - 2014-08-06 09:33 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:38 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-06 09:38 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:37 - 2013-11-14 00:18 - 00969386 _____ () C:\WINDOWS\PFRO.log
2014-08-06 09:31 - 2014-08-06 09:17 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:31 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-06 09:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:28 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-06 09:28 - 2013-01-03 07:43 - 00000000 ____D () C:\WINDOWS\it
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-06 09:11 - 2014-08-06 09:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:24 - 2014-03-25 21:04 - 00432128 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-05 23:14 - 2014-08-05 23:16 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-05 13:30 - 2014-03-25 17:52 - 01284851 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-05 13:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 20:03 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-07-14 17:32 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:32 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-07-14 17:30 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-13 22:34 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe
Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-06 09:50
==================== End Of Log ============================
Gruß, Simon |
|
06.08.2014, 15:36
| #4 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2.1 unter Firefox/Windows 8.1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.08.2014, 20:06
| #5 | |
| | Download Protect 2.2.1 unter Firefox/Windows 8.1Zitat:
Logs: Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-08-2014
Ran by Mimi at 2014-08-06 19:57:26 Run:1
Running from C:\Users\Mimi\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
FF HKLM-x32\...\Firefox\Extensions: [{0EB76B06-2587-43A4-B867-6C54A691E426}] - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi
FF Extension: Download Protect - C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi [2014-06-19]
*****************
HKLM\Software\Wow6432Node\Mozilla\Firefox\Extensions\\{0EB76B06-2587-43A4-B867-6C54A691E426} => value deleted successfully.
C:\WINDOWS\Installer\{9FFDE68B-1BE1-4FF9-9394-0BC2DEAC0885}\{0EB76B06-2587-43A4-B867-6C54A691E426}.xpi => Moved successfully.
==== End of Fixlog ====
ESET Online Scanner liefert gleich nach Akzeptieren der AGB's folgendes: "Updates funktionieren nicht. Ist ein Proxy eingerichtet?" Proxy ist keiner da. Macht vielleicht die doppelte Fritzbox Probleme? (Eine Internetanschluss vom Haus, die andere danach an einem Switch angeschlossen und nur für WLAN zuständig.) und der Log der checkup.txt Code:
ATTFilter Results of screen317's Security Check version 0.99.86
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 14.0.0.145
Adobe Reader 10.1.10 Adobe Reader out of Date!
Mozilla Firefox 29.0.1 Firefox out of Date!
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
frischer FRST Log FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014
Ran by Mimi (administrator) on MIRIAM on 06-08-2014 20:53:35
Running from C:\Users\Mimi\Desktop
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\Samsung\Settings\CmdServer\EasySettingsCmdServer.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\Settings\sSettings.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\S Agent\CommonAgent.exe
(Samsung Electronics CO., LTD.) C:\Program Files\Samsung\Support Center\GuaranaAgent.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe
() C:\Users\Mimi\Desktop\SecurityCheck.exe
() C:\Users\Mimi\Desktop\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13213328 2012-10-18] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2872176 2012-10-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Bitcasa] => C:\Program Files\Bitcasa\Bitcasa.exe [3952128 2012-11-27] (Bitcasa, Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [499608 2011-06-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-09-27] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [97392 2012-08-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-13] (Intel Corporation)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [2994880 2012-08-15] (Symantec Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4177645711-3970229063-862042014-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Mimi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
SSODL: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator - {5FF49FE8-B332-4CB9-B102-FB6951629E55} - C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SYSTEM32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\system32\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32: 1EldosIconOverlay -> {C23D6939-E330-4ADB-880A-EE89BA989460} => C:\windows\SysWOW64\CbFsMntNtf3.dll (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: EldosIconOverlay -> {5BB532A2-BF14-4CCC-86B7-71B81EF6F8BC} => C:\windows\SysWow64\CbFsMntNtf3.dll (EldoS Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MASMJS
SearchScopes: HKCU - {46D999B3-558C-44C1-8EE0-08750C5C29D1} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\..\Interfaces\{D6F005BC-183A-40F1-AC1B-A3D51D5BFE34}: [NameServer]192.168.0.100
FireFox:
========
FF ProfilePath: C:\Users\Mimi\AppData\Roaming\Mozilla\Firefox\Profiles\ebxpazlm.default
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de?hl=de&gl=de
FF Keyword.URL: hxxp://www.google.de/search?hl=de&gl=de&lr=&ie=UTF-8&oe=UTF-8&meta=lr=lang_de&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-07-14]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AdobeActiveFileMonitor11.0; C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [171664 2012-11-06] (Adobe Systems Incorporated)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R2 Easy Launcher; C:\Program Files (x86)\Samsung\Settings\CmdServer\EasyLauncher.exe [1591176 2012-11-30] (Samsung Electronics CO., LTD.) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128896 2012-07-18] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-08-28] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.1.0.18\N360.exe [264360 2013-10-08] (Symantec Corporation)
S2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [3943104 2012-08-15] (Symantec Corporation)
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2878152 2012-12-21] (Samsung Electronics CO., LTD.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3378416 2013-08-28] (Intel® Corporation)
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-12-13] (Advanced Micro Devices, Inc.)
S1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20131002.001\BHDrvx64.sys [1525848 2013-09-26] (Symantec Corporation)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
R1 cbfs3; C:\windows\system32\drivers\cbfs3.sys [352456 2012-08-06] (EldoS Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0401000.00E\ccSetx64.sys [168608 2012-05-26] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20130930.001\IDSVia64.sys [520280 2013-09-24] (Symantec Corporation)
S3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\ENG64.SYS [126040 2013-10-04] (Symantec Corporation)
S3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20131004.035\EX64.SYS [2099288 2013-10-04] (Symantec Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\Netwew00.sys [3345376 2013-10-08] (Intel Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-08-09] (Corel Corporation)
R3 RadioHIDMini; C:\Windows\System32\drivers\RadioHIDMini.sys [23408 2012-07-27] (Windows (R) Win 7 DDK provider)
S3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-07-14] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [47072 2012-10-09] (Windows (R) Win 7 DDK provider)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188896 2012-10-09] (Windows (R) Win 7 DDK provider)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 20:11 - 2014-04-14 05:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll
2014-08-06 20:04 - 2014-08-06 20:04 - 00854410 _____ () C:\Users\Mimi\Desktop\SecurityCheck.exe
2014-08-06 20:00 - 2014-08-06 20:00 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-06 20:00 - 2014-07-01 00:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-08-06 20:00 - 2014-06-28 09:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-08-06 20:00 - 2014-06-28 09:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2014-08-06 20:00 - 2014-06-06 15:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-08-06 20:00 - 2014-06-06 14:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2014-08-06 19:59 - 2014-08-06 19:59 - 02347384 _____ (ESET) C:\Users\Mimi\Desktop\esetsmartinstaller_deu.exe
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:33 - 2014-08-06 09:39 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:17 - 2014-08-06 09:56 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-08-06 09:16 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-08-06 09:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-08-06 09:15 - 2014-08-06 09:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:15 - 2014-08-06 09:11 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:16 - 2014-08-05 23:14 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:02 - 2014-08-06 20:53 - 00018952 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-05 23:01 - 2014-08-06 20:53 - 00000000 ____D () C:\FRST
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-07-14 17:32 - 2014-08-06 20:10 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-08-05 15:59 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-07-14 17:16 - 2014-08-05 16:10 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-07-14 17:16 - 2014-07-14 17:17 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-08-05 16:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-07-07 21:15 - 2014-08-05 15:50 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-08-06 20:54 - 2014-08-05 23:02 - 00018952 _____ () C:\Users\Mimi\Desktop\FRST.txt
2014-08-06 20:53 - 2014-08-05 23:01 - 00000000 ____D () C:\FRST
2014-08-06 20:53 - 2014-03-04 00:15 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4177645711-3970229063-862042014-1001
2014-08-06 20:41 - 2014-03-25 21:04 - 00452608 ___SH () C:\Users\Mimi\Desktop\Thumbs.db
2014-08-06 20:41 - 2014-03-25 20:30 - 00003918 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{DBBE89A8-5831-412F-8BAE-855B806DEBD3}
2014-08-06 20:13 - 2014-03-25 17:52 - 01114603 _____ () C:\WINDOWS\WindowsUpdate.log
2014-08-06 20:13 - 2012-07-26 09:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-08-06 20:12 - 2014-03-05 13:25 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-08-06 20:12 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-08-06 20:11 - 2014-03-05 13:24 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-08-06 20:10 - 2014-07-14 17:32 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-08-06 20:10 - 2013-11-14 09:13 - 00000000 ____D () C:\Program Files\Windows Journal
2014-08-06 20:04 - 2014-08-06 20:04 - 00854410 _____ () C:\Users\Mimi\Desktop\SecurityCheck.exe
2014-08-06 20:02 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-08-06 20:00 - 2014-08-06 20:00 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-06 19:59 - 2014-08-06 19:59 - 02347384 _____ (ESET) C:\Users\Mimi\Desktop\esetsmartinstaller_deu.exe
2014-08-06 19:58 - 2014-03-25 20:30 - 00000000 __RDO () C:\Users\Mimi\SkyDrive
2014-08-06 19:56 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-08-06 19:53 - 2014-03-04 00:48 - 00000000 ____D () C:\Users\Mimi\AppData\Local\CrashDumps
2014-08-06 19:51 - 2013-01-03 07:27 - 00000000 ____D () C:\ProgramData\WinClon
2014-08-06 19:50 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-08-06 09:56 - 2014-08-06 09:17 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-08-06 09:50 - 2014-08-06 09:50 - 00000810 _____ () C:\Users\Mimi\Desktop\JRT.txt
2014-08-06 09:41 - 2014-08-06 09:41 - 00000000 ____D () C:\WINDOWS\ERUNT
2014-08-06 09:39 - 2014-08-06 09:33 - 00000000 ____D () C:\AdwCleaner
2014-08-06 09:38 - 2013-08-22 16:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-08-06 09:37 - 2014-08-06 09:37 - 00003236 _____ () C:\Users\Mimi\Desktop\AdwCleaner[S1].txt
2014-08-06 09:37 - 2013-11-14 00:18 - 00969386 _____ () C:\WINDOWS\PFRO.log
2014-08-06 09:28 - 2014-04-08 15:01 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-08-06 09:28 - 2013-08-22 15:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-08-06 09:28 - 2013-01-03 07:43 - 00000000 ____D () C:\WINDOWS\it
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-06 09:16 - 2014-08-06 09:16 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-08-06 09:11 - 2014-08-06 09:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Mimi\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01361309 _____ () C:\Users\Mimi\Desktop\adwcleaner_3.302.exe
2014-08-06 09:11 - 2014-08-06 09:15 - 01016261 _____ (Thisisu) C:\Users\Mimi\Desktop\JRT.exe
2014-08-05 23:24 - 2014-08-05 23:24 - 00008188 _____ () C:\Users\Mimi\Desktop\gmer.log
2014-08-05 23:14 - 2014-08-05 23:16 - 00380416 _____ () C:\Users\Mimi\Desktop\Gmer-19357.exe
2014-08-05 23:03 - 2014-08-05 23:03 - 00031898 _____ () C:\Users\Mimi\Desktop\Addition.txt
2014-08-05 23:00 - 2014-08-05 23:00 - 02094080 _____ (Farbar) C:\Users\Mimi\Desktop\FRST64.exe
2014-08-05 16:11 - 2014-03-25 17:33 - 00000000 ____D () C:\Users\Mimi
2014-08-05 16:11 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-08-05 16:11 - 2013-11-14 09:13 - 00000000 ____D () C:\WINDOWS\ShellNew
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 __RSD () C:\WINDOWS\Media
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-08-05 16:11 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-08-05 16:10 - 2014-07-14 17:16 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-08-05 16:10 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-05 16:10 - 2014-04-08 15:01 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iTunes
2014-08-05 16:10 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-08-05 16:10 - 2013-08-22 17:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-08-05 16:10 - 2012-07-26 10:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP
2014-08-05 16:00 - 2013-08-22 17:36 - 00000000 ____D () C:\WINDOWS\registration
2014-08-05 16:00 - 2013-08-22 15:36 - 00000000 ____D () C:\WINDOWS\system32\Sysprep
2014-08-05 15:59 - 2014-07-14 17:17 - 00000000 ____D () C:\WINDOWS\system32\Drivers\N360x64
2014-08-05 15:56 - 2014-03-04 00:32 - 00000000 ____D () C:\Program Files\iPod
2014-08-05 15:50 - 2014-07-07 21:15 - 00000000 ____D () C:\Users\Mimi\AppData\Roaming\Skype
2014-08-05 15:37 - 2014-08-05 15:37 - 00000000 _____ () C:\Recovery.txt
2014-08-05 15:35 - 2013-11-14 09:27 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-08-05 15:35 - 2013-11-14 09:11 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2014-08-05 15:35 - 2013-11-14 09:11 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2014-08-05 15:32 - 2014-03-14 18:04 - 00266752 ___SH () C:\Users\Mimi\Downloads\Thumbs.db
2014-08-05 15:31 - 2013-08-22 16:46 - 00302552 _____ () C:\WINDOWS\setupact.log
2014-08-05 15:18 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\sonstiges
2014-08-03 12:38 - 2014-04-28 08:09 - 00000000 ____D () C:\Users\Mimi\Desktop\biochemie
2014-07-22 21:53 - 2014-04-01 08:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2014-07-16 20:20 - 2014-05-06 21:01 - 00000000 ____D () C:\Users\Mimi\Desktop\physiologie
2014-07-16 20:20 - 2014-04-27 20:12 - 00000000 ____D () C:\Users\Mimi\Desktop\uni
2014-07-16 20:20 - 2014-03-14 19:58 - 00000000 ____D () C:\Users\Mimi\Desktop\wp
2014-07-14 17:23 - 2014-07-14 17:23 - 00177752 _____ (Symantec Corporation) C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS
2014-07-14 17:23 - 2014-07-14 17:23 - 00008222 _____ () C:\WINDOWS\system32\Drivers\SYMEVENT64x86.CAT
2014-07-14 17:23 - 2014-07-14 17:23 - 00003206 _____ () C:\WINDOWS\System32\Tasks\Norton WSC Integration
2014-07-14 17:23 - 2014-07-14 17:23 - 00002411 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-07-14 17:23 - 2014-07-14 17:23 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-07-14 17:17 - 2014-07-14 17:16 - 00000000 ____D () C:\Program Files (x86)\Norton 360
2014-07-14 17:16 - 2013-01-03 07:21 - 00000000 ____D () C:\ProgramData\Norton
2014-07-14 17:12 - 2014-07-14 17:12 - 00000000 ____D () C:\ProgramData\PCSettings
2014-07-09 12:29 - 2014-04-08 15:01 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-07-08 17:58 - 2014-03-13 15:35 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Microsoft Help
2014-07-07 21:16 - 2014-07-07 21:16 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00002533 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-07-07 21:15 - 2014-07-07 21:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-07 21:05 - 2014-03-04 00:06 - 00000000 ____D () C:\Users\Mimi\AppData\Local\Packages
Files to move or delete:
====================
C:\ProgramData\MakeMarkerFile.exe
C:\Users\EasySurvey\EasySurvey.exe
Some content of TEMP:
====================
C:\Users\Mimi\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-08-06 09:50
==================== End Of Log ============================
--- --- --- --- --- --- Gruß, Simon Und direkter Nachtrag: Download Protect taucht nicht mehr bei den Firefox Add-Ons auf  Eine weitere Frage stellt sich mir noch: Es ist wohl Norton und McAfee installiert. Beides zugleich und noch die Windows Firewall drauf ist wohl nicht ratsam. Kann ich da eine Meinung bekommen was behalten und was runterwerfen? Oder komplett umsteigen? Ich nutze seit Jahren Avira und bin hochzufrieden mit. Aber da es sich wie gesagt nicht um mein Laptop handelt, wollte ich hier noch eine Meinung einholen  Gruß, Simon |
|
07.08.2014, 16:51
| #6 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2.1 unter Firefox/Windows 8.1 Beides deinstallieren, Avira is auch Müll. Ich empfehle immer Emsisoft. Adobe und Firefox updaten. Upload gemacht?
__________________ --> Download Protect 2.2.1 unter Firefox/Windows 8.1 |
|
07.08.2014, 20:17
| #7 |
| | Download Protect 2.2.1 unter Firefox/Windows 8.1 Hallo, ja, Upload der Quarantine.zip hab ich gemacht, blos vergessen zu erwähnen. Sehen die Log's gut aus und die Reise ist am Ende? Großes  schonmal! |
|
08.08.2014, 16:24
| #8 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2.1 unter Firefox/Windows 8.1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
S2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -service [X]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.08.2014, 15:43
| #9 |
| | Download Protect 2.2.1 unter Firefox/Windows 8.1 Hallo, das Laptop ist für paar Tage nicht mehr in meiner Hand, werde die letzten paar Schritte aber noch nachholen. Ansonsten kann ich nur ein doppeltes und riesiges aussprechen und noch ein schönes Wochenende wünschen.(PS: Thread brauch kein Abo mehr ) |
|
10.08.2014, 06:15
| #10 |
| /// the machine /// TB-Ausbilder | Download Protect 2.2.1 unter Firefox/Windows 8.1 Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Download Protect 2.2.1 unter Firefox/Windows 8.1 |
| bildschirm, bluescreen, branding, download protect 2.2.1, flash player, homepage, installation, kein bluescreen, mozilla, problem, pup.optional.crossrider.a, pup.optional.iepluginservice.a, pup.optional.installcore.a, pup.optional.sweetpage.a, realtek, software, svchost.exe, sweet-page, sweet-page entfernen, sweetpage, sweetpage entfernen, symantec, warnung, windowsmangerprotect |
Hybrid-Darstellung
