| |
| |||||||
Log-Analyse und Auswertung: Blaue doppelt unterstrichene Wörter, Werbung (Firefox)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.08.2014, 23:25
| #1 | |
 |  Blaue doppelt unterstrichene Wörter, Werbung (Firefox) Hallo! Zunächst einmal allerherzlichsten Dank für diese Einrichtung und eure Arbeit hier! Ich wollte eigentlich nicht noch zusätzliche bescheren und habe deshalb etwas chaotisch versucht, mich mithilfe der von euch empfohlenen Programme selbstständig durchzumogeln. Bin allerdings kläglich gescheitert. Das Problem ist folgendes: Vor einigen Tagen wurde auf meinen PC VLC Media Player (zusätzliche Stichworte, die mit dem Download irgendwie zusammenhängen: Baidu und ArabSeed) runtergeladen. Rasch durchgeklickt, nicht gelesen. Seither schlage ich mich mit blauen, doppelt unterstrichenen Wörtern auf allen möglichen Internetseiten herum, die bei Berührung des Mauszeigers auf eine JAVA-Update-Werbung verweisen. Wenn man über Bilder fährt, erscheint dort oft ebenfalls irgendwelche Werbung. Malewarebytes, standardmässiges Antivirenprogramm auf dem PC, hat ein bisschen was gefunden, aber die "Symptome" blieben und sind auch jetzt noch da, obwohl laut Malewarebytes wieder alles im grünen Bereich ist. Deshalb habe ich mich an euren Programmen versucht (die ihr in ähnlichen Fällen erwähnt hattet). adw-cleaner hatte etwas gefunden. Daraufhin habe ich löschen geklickt und jetzt findet er, wenn ich sein Geschreibsel richtig deute, nichts mehr. Doch die Probleme sind immer noch da. ESET fand dann, anders als seine Vorgänger, nach wie vor schockierende 36 infizierte Dateien, doch bei dem kann ich sie nicht löschen?! Also schwirren sie wohl nach wie vor herum. Leider habe ich den Bericht nicht mehr. Was ich zumindest liefern kann sind die Texte von -Defogger -FRST -GMER -Adw, zwei Durchgänge Defogger Zitat:
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-08-2014 Ran by ********* (administrator) on *********-PC on 30-08-2014 22:45:53 Running from C:\Users\*********\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d15ed671de43d681\stacsv64.exe (Hewlett-Packard) C:\Windows\System32\hpservice.exe (Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (DigitalPersona, Inc.) C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Gadwin Systems, Inc.) C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Dropbox, Inc.) C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d15ed671de43d681\AESTSr64.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (DigitalPersona, Inc.) C:\Program Files (x86)\DigitalPersona\Bin\DpAgent.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Mindjet) C:\Program Files (x86)\Mindjet\MindManager 7\MmReminderService.exe (Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe (DigitalPersona, Inc.) C:\Program Files\DigitalPersona\Bin\DpAgent.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe (Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe (CyberLink) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe (Vodafone) C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1814312 2009-08-15] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-10-21] (IDT, Inc.) HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [610872 2009-08-25] () HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation) HKLM-x32\...\Run: [HPCam_Menu] => c:\Program Files (x86)\Hewlett-Packard\Media\Webcam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.) HKLM-x32\...\Run: [DpAgent] => C:\Program Files (x86)\DigitalPersona\Bin\dpagent.exe [842816 2009-07-01] (DigitalPersona, Inc.) HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [322104 2009-08-20] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS) HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [MMReminderService] => C:\Program Files (x86)\Mindjet\MindManager 7\MMReminderService.exe [37144 2007-12-13] (Mindjet) HKLM-x32\...\Run: [Reader Library Launcher] => C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [186408 2013-12-04] (Geek Software GmbH) HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] => C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [707472 2013-12-13] (Cisco Systems, Inc.) HKLM-x32\...\Run: [MobileBroadband] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\MobileBroadband.exe [76288 2013-03-25] (Vodafone) HKLM-x32\...\Run: [VmbNotifier] => C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe [1861632 2013-03-25] (Vodafone) HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-08-20] (Hewlett-Packard Company) HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Run: [HPADVISOR] => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Run: [Gadwin PrintScreen 3.5] => C:\Program Files (x86)\Gadwin Systems\PrintScreen\PrintScreen.exe [1101824 2006-07-08] (Gadwin Systems, Inc.) HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Run: [Gadywagoyp] => C:\Users\*********\AppData\Roaming\Ywpiyd\gero.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {249d5b00-fabc-11df-a065-88a39d9f9f68} - H:\iStudio.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {29e59d41-63c0-11e2-883b-002713a0bc74} - G:\AutoRun.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {29e59d53-63c0-11e2-883b-002713a0bc74} - H:\AutoRun.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {2c926d73-f443-11e2-afb1-c80aa90a8d59} - G:\AutoRun.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {3ab5124b-6497-11e2-af54-001e101f3315} - G:\AutoRun.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {577254b8-3e25-11e1-8691-002713a0bc74} - I:\Startme.exe HKU\S-1-5-21-2935208858-379123278-2216804909-1001\...\MountPoints2: {6a9e6f23-5d61-11e1-9fd2-002713a0bc74} - G:\LaunchU3.exe -a Lsa: [Notification Packages] scecli DPPWDFLT Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCON/12 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCON/12 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: DigitalPersona Personal Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: CmjBrowserHelperObject Object -> {07A11D74-9D25-4fea-A833-8B0D76A5577A} -> C:\Program Files (x86)\Mindjet\MindManager 7\Mm7InternetExplorer.dll (Mindjet) BHO-x32: DigitalPersona Personal Extension -> {395610AE-C624-4f58-B89E-23733EA00F9A} -> C:\Program Files (x86)\DigitalPersona\Bin\DpOtsPluginIe8.dll (DigitalPersona, Inc.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} https://uzhvpn1.uzh.ch/CACHE/stc/18/binaries/vpnweb.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-01-09] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 62.240.110.198 62.240.110.197 FireFox: ======== FF ProfilePath: C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\zzygvqq5.default FF Homepage: hxxp://www.google.ch/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @sony.com/eBookLibrary -> C:\Program Files (x86)\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Site Advisor - C:\Users\*********\AppData\Roaming\Mozilla\Firefox\Profiles\zzygvqq5.default\Extensions\{6d0f26ba-45b8-4871-9c07-43ab341d5b73} [2014-08-25] FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt FF Extension: DigitalPersona Extension - C:\Program Files (x86)\DigitalPersona\Bin\FirefoxExt [2010-03-08] FF HKCU\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\DigitalPersona\Bin\firefoxext Chrome: ======= CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d15ed671de43d681\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation) R2 DpHost; C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe [322624 2009-07-01] (DigitalPersona, Inc.) [File not signed] R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed] R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] () S3 Sony SCSI Helper Service; C:\Program Files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe [73728 2010-04-02] (Sony Corporation) [File not signed] R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_d15ed671de43d681\STacSV64.exe [240640 2009-10-21] (IDT, Inc.) R2 VmbService; C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbService.exe [8704 2013-03-25] (Vodafone) [File not signed] R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X] S2 TuneUp.UtilitiesSvc; "C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-30] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation) S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [51712 2011-02-18] (Apple, Inc.) [File not signed] S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-12-13] (Cisco Systems, Inc.) R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files (x86)\Hewlett-Packard\Media\DVD\000.fcl [146928 2009-10-16] (CyberLink Corp.) S3 BprotectEx; \??\C:\Windows\System32\drivers\BprotectEx.sys [X] S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X] S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X] S1 ggdmxtqg; \??\C:\Windows\system32\drivers\ggdmxtqg.sys [X] S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S1 muosxvjv; \??\C:\Windows\system32\drivers\muosxvjv.sys [X] S3 PCFApiUtil; \??\C:\Program Files (x86)\Baidu Security\PC Faster\4.0.0.0\PCFApiUtil64.sys [X] S1 pgqyxzkb; \??\C:\Windows\system32\drivers\pgqyxzkb.sys [X] S3 TuneUpUtilitiesDrv; \??\C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [X] S1 vejicfgc; \??\C:\Windows\system32\drivers\vejicfgc.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 22:43 - 2014-08-30 22:43 - 00000474 _____ () C:\Users\*********\Desktop\defogger_disable.log 2014-08-30 22:43 - 2014-08-30 22:43 - 00000000 _____ () C:\Users\*********\defogger_reenable 2014-08-30 22:39 - 2014-08-30 22:39 - 00050477 _____ () C:\Users\*********\Downloads\Defogger.exe 2014-08-30 22:33 - 2014-08-30 22:33 - 00000000 ____D () C:\Windows\ERUNT 2014-08-30 22:31 - 2014-08-30 22:31 - 01016261 _____ (Thisisu) C:\Users\*********\Downloads\JRT.exe 2014-08-30 22:19 - 2014-08-30 22:19 - 01364531 _____ () C:\Users\*********\Downloads\adwcleaner_3.308(1).exe 2014-08-30 21:27 - 2014-08-30 21:27 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte 2014-08-29 22:26 - 2014-08-29 22:26 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-29 22:25 - 2014-08-29 22:26 - 02347384 _____ (ESET) C:\Users\*********\Downloads\esetsmartinstaller_deu.exe 2014-08-29 22:21 - 2014-08-30 22:21 - 00000000 ____D () C:\AdwCleaner 2014-08-29 22:21 - 2014-08-29 22:22 - 00049550 _____ () C:\Users\*********\Downloads\Addition.txt 2014-08-29 22:20 - 2014-08-29 22:21 - 01364531 _____ () C:\Users\*********\Downloads\adwcleaner_3.308.exe 2014-08-29 22:19 - 2014-08-30 22:45 - 00021501 _____ () C:\Users\*********\Downloads\FRST.txt 2014-08-29 22:18 - 2014-08-30 22:45 - 00000000 ____D () C:\FRST 2014-08-29 22:16 - 2014-08-29 22:17 - 02103808 _____ (Farbar) C:\Users\*********\Downloads\FRST64.exe 2014-08-28 19:40 - 2014-08-28 19:40 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js 2014-08-28 14:34 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-28 14:34 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-28 14:34 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-26 15:09 - 2014-08-26 15:09 - 01058200 _____ (Adobe) C:\Users\*********\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe 2014-08-25 22:07 - 2014-08-28 19:40 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Baidu Security 2014-08-25 22:03 - 2014-08-30 00:59 - 00000000 ____D () C:\Users\*********\AppData\Roaming\vlc 2014-08-25 22:03 - 2014-08-28 19:40 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security 2014-08-25 22:02 - 2014-08-28 19:40 - 00000000 ____D () C:\ProgramData\Baidu Security 2014-08-25 22:02 - 2014-08-28 19:40 - 00000000 ____D () C:\Program Files (x86)\Baidu Security 2014-08-25 22:02 - 2014-08-25 22:02 - 00001026 _____ () C:\Users\Public\Desktop\VLC media player.lnk 2014-08-25 22:02 - 2014-08-25 22:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-08-25 22:02 - 2014-08-25 22:02 - 00000000 ____D () C:\Program Files (x86)\VideoLAN 2014-08-25 21:57 - 2014-08-25 22:01 - 24743106 _____ () C:\Users\*********\Desktop\vlc-2-1-5-win32.exe 2014-08-25 21:50 - 2014-08-09 18:13 - 678816937 _____ () C:\Users\*********\Desktop\S.F.M.1080p.HD.ArabSeed.CoM.mkv 2014-08-22 23:02 - 2014-08-22 23:02 - 17220346 _____ () C:\Users\*********\Desktop\****** III.zip 2014-08-20 20:31 - 2014-08-20 20:31 - 00000000 ____D () C:\Users\*********\AppData\Roaming\FLEXnet 2014-08-20 20:22 - 2014-08-20 20:22 - 00002156 _____ () C:\Users\Public\Desktop\Vodafone Mobile Broadband.lnk 2014-08-20 20:22 - 2014-08-20 20:22 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Vodafone 2014-08-20 20:22 - 2014-08-20 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vodafone 2014-08-20 20:21 - 2014-08-20 20:22 - 00000000 ____D () C:\ProgramData\Vodafone 2014-08-20 20:21 - 2014-08-20 20:21 - 00000000 ____D () C:\ProgramData\FLEXnet 2014-08-20 20:21 - 2014-08-20 20:21 - 00000000 ____D () C:\Program Files (x86)\Vodafone 2014-08-20 20:20 - 2014-08-20 20:20 - 00000000 ____D () C:\Users\*********\AppData\Local\Downloaded Installations 2014-08-18 18:54 - 2014-08-18 18:54 - 11486487 _____ () C:\Users\*********\Desktop\******-Fotos II.zip 2014-08-15 12:02 - 2014-08-15 12:02 - 17296919 _____ () C:\Users\*********\Desktop\******.zip 2014-08-13 17:09 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll 2014-08-13 17:09 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll 2014-08-13 17:09 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe 2014-08-13 17:09 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe 2014-08-13 17:09 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe 2014-08-13 17:09 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll 2014-08-13 17:09 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe 2014-08-13 17:09 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll 2014-08-13 14:38 - 2014-07-24 21:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-08-13 14:38 - 2014-07-24 21:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-08-13 14:38 - 2014-07-24 21:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-08-13 14:38 - 2014-07-24 21:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-08-13 14:38 - 2014-07-24 21:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-08-13 14:38 - 2014-07-24 21:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-08-13 14:38 - 2014-07-24 21:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-08-13 14:38 - 2014-07-24 21:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-08-13 14:38 - 2014-07-24 21:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-08-13 14:38 - 2014-07-24 21:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-08-13 14:38 - 2014-07-24 21:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-08-13 14:38 - 2014-07-24 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-08-13 14:38 - 2014-07-24 21:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-08-13 14:38 - 2014-07-24 21:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-08-13 14:38 - 2014-07-24 21:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-08-13 14:38 - 2014-07-24 21:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-08-13 14:38 - 2014-07-24 20:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-08-13 14:38 - 2014-07-24 19:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-08-13 14:38 - 2014-07-24 19:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-08-13 14:38 - 2014-07-24 19:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-08-13 14:38 - 2014-07-24 19:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-08-13 14:38 - 2014-07-24 19:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-08-13 14:38 - 2014-07-24 19:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-08-13 14:38 - 2014-07-24 19:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-08-13 14:38 - 2014-07-24 19:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-08-13 14:38 - 2014-07-24 19:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-08-13 14:38 - 2014-07-24 19:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-08-13 14:38 - 2014-07-24 19:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-08-13 14:38 - 2014-07-24 19:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-08-13 14:38 - 2014-07-24 19:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-08-13 14:38 - 2014-07-24 19:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-08-13 14:38 - 2014-07-24 19:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-08-13 14:38 - 2014-07-24 19:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-08-13 14:38 - 2014-07-24 19:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-08-13 14:38 - 2014-07-24 19:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-08-13 14:38 - 2014-07-24 19:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-08-13 14:38 - 2014-07-24 19:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-08-13 14:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL 2014-08-13 14:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL 2014-08-13 14:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL 2014-08-13 14:36 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL 2014-08-13 14:36 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL 2014-08-13 14:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL 2014-08-13 14:36 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL 2014-08-13 14:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL 2014-08-13 14:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL 2014-08-13 14:36 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL 2014-08-13 14:36 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls 2014-08-13 14:36 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls 2014-08-13 14:26 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-13 14:26 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-13 14:26 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-08-13 14:26 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-08-13 14:26 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-08-13 14:26 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-08-13 14:26 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-08-13 14:26 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-08-13 14:26 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-08-13 14:26 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-08-13 14:26 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-08-13 14:26 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll 2014-08-13 14:26 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-08-13 14:26 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-08-13 14:26 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-08-13 14:26 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll 2014-08-08 18:14 - 2014-08-08 18:14 - 00003088 _____ () C:\Windows\System32\Tasks\{63532596-9136-4C0E-AC41-F4557A4305F9} 2014-08-02 17:08 - 2014-08-02 17:08 - 00000000 ____D () C:\Users\*********\AppData\Local\Adobe 2014-08-01 19:32 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-08-01 19:32 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-08-01 19:32 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-08-01 19:32 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-08-01 19:32 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-08-01 19:32 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-08-01 19:32 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll 2014-08-01 19:32 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-08-01 19:32 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-08-01 19:32 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-08-01 19:32 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-08-01 19:32 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-08-01 19:32 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-08-01 19:32 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-30 22:46 - 2014-08-29 22:19 - 00021501 _____ () C:\Users\*********\Downloads\FRST.txt 2014-08-30 22:45 - 2014-08-29 22:18 - 00000000 ____D () C:\FRST 2014-08-30 22:43 - 2014-08-30 22:43 - 00000474 _____ () C:\Users\*********\Desktop\defogger_disable.log 2014-08-30 22:43 - 2014-08-30 22:43 - 00000000 _____ () C:\Users\*********\defogger_reenable 2014-08-30 22:43 - 2010-04-10 16:31 - 00000000 ____D () C:\Users\********* 2014-08-30 22:39 - 2014-08-30 22:39 - 00050477 _____ () C:\Users\*********\Downloads\Defogger.exe 2014-08-30 22:34 - 2014-04-11 19:51 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-30 22:33 - 2014-08-30 22:33 - 00000000 ____D () C:\Windows\ERUNT 2014-08-30 22:31 - 2014-08-30 22:31 - 01016261 _____ (Thisisu) C:\Users\*********\Downloads\JRT.exe 2014-08-30 22:31 - 2009-07-14 06:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-30 22:31 - 2009-07-14 06:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-30 22:29 - 2010-03-08 02:22 - 01210010 _____ () C:\Windows\WindowsUpdate.log 2014-08-30 22:24 - 2013-05-05 13:07 - 00000000 ___RD () C:\Users\*********\Dropbox 2014-08-30 22:24 - 2013-05-05 13:03 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Dropbox 2014-08-30 22:22 - 2010-03-08 02:27 - 00597466 _____ () C:\Windows\PFRO.log 2014-08-30 22:22 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-30 22:22 - 2009-07-14 06:51 - 00307296 _____ () C:\Windows\setupact.log 2014-08-30 22:21 - 2014-08-29 22:21 - 00000000 ____D () C:\AdwCleaner 2014-08-30 22:19 - 2014-08-30 22:19 - 01364531 _____ () C:\Users\*********\Downloads\adwcleaner_3.308(1).exe 2014-08-30 22:18 - 2011-08-06 15:24 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Skype 2014-08-30 22:08 - 2013-01-03 23:36 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-30 21:55 - 2010-01-09 22:20 - 00714316 _____ () C:\Windows\system32\perfh007.dat 2014-08-30 21:55 - 2010-01-09 22:20 - 00154368 _____ () C:\Windows\system32\perfc007.dat 2014-08-30 21:55 - 2009-07-14 07:13 - 01649032 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-08-30 21:27 - 2014-08-30 21:27 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte 2014-08-30 00:59 - 2014-08-25 22:03 - 00000000 ____D () C:\Users\*********\AppData\Roaming\vlc 2014-08-29 22:26 - 2014-08-29 22:26 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-08-29 22:26 - 2014-08-29 22:25 - 02347384 _____ (ESET) C:\Users\*********\Downloads\esetsmartinstaller_deu.exe 2014-08-29 22:22 - 2014-08-29 22:21 - 00049550 _____ () C:\Users\*********\Downloads\Addition.txt 2014-08-29 22:21 - 2014-08-29 22:20 - 01364531 _____ () C:\Users\*********\Downloads\adwcleaner_3.308.exe 2014-08-29 22:17 - 2014-08-29 22:16 - 02103808 _____ (Farbar) C:\Users\*********\Downloads\FRST64.exe 2014-08-29 21:53 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup 2014-08-28 19:40 - 2014-08-28 19:40 - 00014304 _____ () C:\ProgramData\Duplicaterecord.js 2014-08-28 19:40 - 2014-08-25 22:07 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Baidu Security 2014-08-28 19:40 - 2014-08-25 22:03 - 00000000 ____D () C:\Users\Public\Documents\Baidu Security 2014-08-28 19:40 - 2014-08-25 22:02 - 00000000 ____D () C:\ProgramData\Baidu Security 2014-08-28 19:40 - 2014-08-25 22:02 - 00000000 ____D () C:\Program Files (x86)\Baidu Security 2014-08-28 19:38 - 2010-03-08 02:20 - 00219288 _____ () C:\Windows\DPINST.LOG 2014-08-28 19:08 - 2009-07-14 06:45 - 00462824 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-08-28 15:33 - 2010-04-18 19:55 - 00000000 ____D () C:\Users\*********\Documents\Diverses 2014-08-26 15:09 - 2014-08-26 15:09 - 01058200 _____ (Adobe) C:\Users\*********\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe 2014-08-25 22:18 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-08-25 22:02 - 2014-08-25 22:02 - 00001026 _____ () C:\Users\Public\Desktop\VLC media player.lnk 2014-08-25 22:02 - 2014-08-25 22:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN 2014-08-25 22:02 - 2014-08-25 22:02 - 00000000 ____D () C:\Program Files (x86)\VideoLAN 2014-08-25 22:01 - 2014-08-25 21:57 - 24743106 _____ () C:\Users\*********\Desktop\vlc-2-1-5-win32.exe 2014-08-25 15:05 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-08-23 04:07 - 2014-08-28 14:34 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-08-23 03:45 - 2014-08-28 14:34 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-08-23 02:59 - 2014-08-28 14:34 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-08-22 23:02 - 2014-08-22 23:02 - 17220346 _____ () C:\Users\*********\Desktop\****** III.zip 2014-08-22 20:48 - 2011-01-06 18:59 - 00000000 ____D () C:\Users\*********\Desktop\Studium 2014-08-20 20:31 - 2014-08-20 20:31 - 00000000 ____D () C:\Users\*********\AppData\Roaming\FLEXnet 2014-08-20 20:23 - 2010-04-10 16:36 - 00135784 _____ () C:\Users\*********\AppData\Local\GDIPFONTCACHEV1.DAT 2014-08-20 20:22 - 2014-08-20 20:22 - 00002156 _____ () C:\Users\Public\Desktop\Vodafone Mobile Broadband.lnk 2014-08-20 20:22 - 2014-08-20 20:22 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Vodafone 2014-08-20 20:22 - 2014-08-20 20:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vodafone 2014-08-20 20:22 - 2014-08-20 20:21 - 00000000 ____D () C:\ProgramData\Vodafone 2014-08-20 20:21 - 2014-08-20 20:21 - 00000000 ____D () C:\ProgramData\FLEXnet 2014-08-20 20:21 - 2014-08-20 20:21 - 00000000 ____D () C:\Program Files (x86)\Vodafone 2014-08-20 20:20 - 2014-08-20 20:20 - 00000000 ____D () C:\Users\*********\AppData\Local\Downloaded Installations 2014-08-20 17:11 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-08-18 18:54 - 2014-08-18 18:54 - 11486487 _____ () C:\Users\*********\Desktop\******-Fotos II.zip 2014-08-15 12:02 - 2014-08-15 12:02 - 17296919 _____ () C:\Users\*********\Desktop\******.zip 2014-08-15 09:43 - 2014-03-19 07:23 - 00001021 _____ () C:\Users\*********\Desktop\Dropbox.lnk 2014-08-15 09:43 - 2014-03-19 07:19 - 00000000 ____D () C:\Users\*********\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-08-13 17:15 - 2013-07-27 14:12 - 00000000 ____D () C:\Windows\system32\MRT 2014-08-13 17:13 - 2011-02-15 11:33 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-08-13 17:08 - 2014-04-30 18:37 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-08-12 21:13 - 2011-08-06 15:24 - 00000000 ____D () C:\ProgramData\Skype 2014-08-09 18:13 - 2014-08-25 21:50 - 678816937 _____ () C:\Users\*********\Desktop\S.F.M.1080p.HD.ArabSeed.CoM.mkv 2014-08-08 18:14 - 2014-08-08 18:14 - 00003088 _____ () C:\Windows\System32\Tasks\{63532596-9136-4C0E-AC41-F4557A4305F9} 2014-08-07 23:01 - 2014-03-20 20:40 - 00000000 ____D () C:\Users\*********\Documents\PrintScreen Files 2014-08-07 04:06 - 2014-08-13 14:26 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-08-07 04:01 - 2014-08-13 14:26 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-08-02 17:08 - 2014-08-02 17:08 - 00000000 ____D () C:\Users\*********\AppData\Local\Adobe 2014-08-02 17:01 - 2013-01-03 23:36 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-08-02 17:01 - 2013-01-03 23:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-08-02 17:01 - 2013-01-03 23:36 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater Files to move or delete: ==================== C:\ProgramData\308d82.dat C:\ProgramData\Duplicaterecord.js Some content of TEMP: ==================== C:\Users\*********\AppData\Local\Temp\Baidu_Secure_SystemUp_4.0.11.78178.exe C:\Users\*********\AppData\Local\Temp\contentDATs.exe C:\Users\*********\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphjd_o5.dll C:\Users\*********\AppData\Local\Temp\eblinstaller.exe C:\Users\*********\AppData\Local\Temp\EBUDBF2.EXE C:\Users\*********\AppData\Local\Temp\EBUE3DE.DLL C:\Users\*********\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\*********\AppData\Local\Temp\FP_PL_MSI_INSTALLER.exe C:\Users\*********\AppData\Local\Temp\fsclm.dll C:\Users\*********\AppData\Local\Temp\fsols_launcher.exe C:\Users\*********\AppData\Local\Temp\fsonlinescanner.exe C:\Users\*********\AppData\Local\Temp\GoogleChromeInstaller.exe C:\Users\*********\AppData\Local\Temp\HPQSi.exe C:\Users\*********\AppData\Local\Temp\i4jdel0.exe C:\Users\*********\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe C:\Users\*********\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\*********\AppData\Local\Temp\PC_Faster_Setup_Mini_E16_S.exe C:\Users\*********\AppData\Local\Temp\pdf24-creator-update.exe C:\Users\*********\AppData\Local\Temp\PRS-650_Updater_1.0.00.14080.exe C:\Users\*********\AppData\Local\Temp\Quarantine.exe C:\Users\*********\AppData\Local\Temp\SecurityScan_Release.exe C:\Users\*********\AppData\Local\Temp\setup.exe C:\Users\*********\AppData\Local\Temp\SimBundD.exe C:\Users\*********\AppData\Local\Temp\SkypeSetup.exe C:\Users\*********\AppData\Local\Temp\xmllite.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-27 20:01 ==================== End Of Log ============================ GMER GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2014-08-30 23:26:41 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.LH00 465,76GB Running: Gmer-19357.exe; Driver: C:\Users\*********\AppData\Local\Temp\pxdiypog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\DigitalPersona\Bin\DpHostW.exe[1236] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2352] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe[3464] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe[3464] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 .text C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe[3416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771d1465 2 bytes [1D, 77] .text C:\Program Files (x86)\Vodafone\Vodafone Mobile Broadband\Bin\VmbNotifier.exe[3416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771d14bb 2 bytes [1D, 77] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\Users\*********\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe [3464](2014-07-30 00:20:20) 0000000004070000 Library c:\users\*********\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpv6yvnz.dll (*** suspicious ***) @ C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe [3464](2014-08-30 21:04:20) 00000000044b0000 Library C:\Users\*********\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe [3464](2013-08-23 19:01:44) 0000000064640000 Library C:\Users\*********\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\*********\AppData\Roaming\Dropbox\bin\Dropbox.exe [3464] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000066d30000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713a0bc74 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713a0bc74@103b59e7704b 0x9B 0x2D 0xB2 0x5D ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713a0bc74 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713a0bc74@103b59e7704b 0x9B 0x2D 0xB2 0x5D ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- Adw 1 AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 29/08/2014 um 22:37:04
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ******** - ********-PC
# Gestartet von : C:\Users\********\Downloads\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\StarApp
Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB_DE
Ordner Gelöscht : C:\Program Files (x86)\SiteLookup
Ordner Gelöscht : C:\Users\********\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\********\AppData\Local\Temp\AskSearch
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\********\AppData\LocalLow\DVDVideoSoftTB_DE
Ordner Gelöscht : C:\Users\Public\Documents\baidu
Datei Gelöscht : C:\END
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\LatestDLMgr_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2625848
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader12933_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader12933_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader30110_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader30110_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_vlc-media-player_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{761F6A83-F007-49E4-8EAC-CDB6808EF06F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{76C45B18-A29E-43EA-AAF8-AF55C2E1AE17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7CD74AFF-3433-4E34-92E2-D98DFDB30754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{96EF404C-24C7-43D0-9096-4CCC8BB7CCAC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97720195-206A-42AE-8E65-260B9BA5589F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{986F7A5A-9676-47E1-8642-F41F8C3FCF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B18788A4-92BD-440E-A4D1-380C36531119}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47B19AA8-709C-4EB5-AD0B-08FBA8FB40C2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F08EAE2A-8169-42C6-AAD9-056623065667}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB_DE
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\DVDVideoSoftTB_DE
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB_DE Toolbar
***** [ Browser ] *****
-\\ Internet Explorer v0.0.0.0
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\b09e2727.default\prefs.js ]
[ Datei : C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\zzygvqq5.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [6471 octets] - [29/08/2014 22:22:04]
AdwCleaner[S0].txt - [6027 octets] - [29/08/2014 22:37:04]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [6087 octets] ##########
Adw 2 AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 29/08/2014 um 22:43:05
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : ******** - ********-PC
# Gestartet von : C:\Users\********\Downloads\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Browser ] *****
-\\ Internet Explorer v0.0.0.0
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\b09e2727.default\prefs.js ]
[ Datei : C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\zzygvqq5.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [6471 octets] - [29/08/2014 22:22:04]
AdwCleaner[R1].txt - [1056 octets] - [29/08/2014 22:40:36]
AdwCleaner[S0].txt - [6167 octets] - [29/08/2014 22:37:04]
AdwCleaner[S1].txt - [979 octets] - [29/08/2014 22:43:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1038 octets] ##########
Noch einmal vielen Dank im Voraus...! Ich hoffe sehr, das stimmt so und nützt was. Man fühlt sich etwas verloren in diesem Buchstabensalat. Beste Grüsse |
| Themen zu Blaue doppelt unterstrichene Wörter, Werbung (Firefox) |
| administrator, adw-cleaner, baidu, conduitsearch, conduitsearch entfernen, desktop, flash player, homepage, launch, problem, registrierungsdatenbank, services.exe, software, werbung, win32/bundled.toolbar.ask, win32/theola.f, win32/toolbar.conduit.b, win32/toolbar.conduit.o, win32/toolbar.conduit.p, win32/toolbar.conduit.q, windows, winlogon.exe |
Baum-Darstellung