| |
| |||||||
Log-Analyse und Auswertung: chrome://quick_start/content/index.html in Firefox-TabWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
30.09.2014, 12:55
| #1 |
| |  chrome://quick_start/content/index.html in Firefox-Tab Hallo  Ich habe gesehen, dass es bereits Threads dazu gibt und habe die Checklist und die Tips in den anderen Threads "abgearbeitet". (http://www.trojaner-board.de/153863-...entfernen.html & http://www.trojaner-board.de/156105-...refox-tab.html) Da ich aber ein absoluter Laie bin wäre es richtig lieb, wenn sich jemand meine Logfiles ansehen könnte und mir verraten könnte ob jetzt alles wieder okay ist... Beim Defogger weiß ich nicht so genau, ob alles richtig gelaufen ist :-/ Er war in ca 3 Sekunden fertig und hat nicht (wie beschrieben) um Neustart gebeten und ich habe auch noch nicht "Re-enabled"...... Ich hoffe ich habe alles richtig gemacht. Vielen Dank im Voraus Cuddles mbam Anhang 69856 FRST Anhang 69857 Addition Anhang 69858 AdwCleaner Anhang 69859 JRT Anhang 69860 GMER Anhang 69861 Defogger Anhang 69862 |
|
30.09.2014, 13:57
| #2 |
| /// the machine /// TB-Ausbilder    |  chrome://quick_start/content/index.html in Firefox-Tab Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
30.09.2014, 14:30
| #3 |
| | chrome://quick_start/content/index.html in Firefox-Tab Oooh, okay.
__________________Sorry, ich wusste nicht wie das geht! Danke für den Hinweis Also: Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-09-2014
Ran by Mellie at 2014-09-30 12:42:47
Running from C:\Users\Mellie\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton 360 (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 11.2.202.235 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{65486209-5C54-439C-8383-8AC9BBE25932}) (Version: 1.00.0004 - Atheros Communications)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.2 - Atheros)
Audials (HKLM-x32\...\{DA6EBFC9-8869-4B61-8D38-2668A395C5B0}) (Version: 11.0.54400.0 - Audials AG)
AudibleManager (HKLM-x32\...\AudibleManager) (Version: 2003385582.48.56.32312690 - Audible, Inc.)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.00.11 - TOSHIBA CORPORATION)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Chicken Invaders 3 - Revenge of the Yolk (x32 Version: 2.2.0.95 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Copy (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Destinations (x32 Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.57.62 - Electronic Arts)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
DJ_AIO_06_F4500_SW_MIN (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden
F4500 (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive: Nitro (x32 Version: 2.2.0.95 - WildTangent) Hidden
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden
High-Definition Video Playback (x32 Version: 7.3.10900.8.0 - Nero AG) Hidden
HitmanPro.Alert (HKLM\...\HitmanPro.Alert) (Version: 2.6.5.77 - SurfRight B.V.)
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Deskjet F4500 All-in-One Driver Software 14.0 Rel. 6 (HKLM\...\{0AFFEA39-60AF-4C4F-BB47-4A1F7CB12129}) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.211.000 - Hewlett-Packard) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 3.3.8.2663 - IObit)
iTunes (HKLM\...\{A04DCB25-7040-4935-A30D-8E0A893ABF2D}) (Version: 11.1.2.32 - Apple Inc.)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Kobo (HKLM-x32\...\Kobo) (Version: 3.9.0 - Rakuten Kobo Inc.)
MAGIX Screenshare (HKLM-x32\...\{D3738DAC-A343-4AF1-8222-EBE13B5FD8AA}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (MSI) (HKLM-x32\...\{73357D5A-3C9A-42D2-8252-A2D521A8461D}) (Version: 7.0.2.6 - MAGIX AG)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Messenger Plus! for Skype (HKLM-x32\...\Messenger Plus! for Skype) (Version: 3.0.0.195 - Yuna Software)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.5128.5002 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{2C303EE0-A595-3543-A71A-931C7AC40EDE}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (x32 Version: 11.0.61030 - Microsoft Corporation) Hidden
Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyMicroBalance (HKLM-x32\...\{CAF30EE3-A2E2-47BE-A37B-96524BCB3EF5}) (Version: 2.5.5 - startzentrum GmbH & Co KG)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.4 - F.J. Wechselberger)
Nero 10 Movie ThemePack Basic (x32 Version: 10.6.10000.1.0 - Nero AG) Hidden
Nero BackItUp 10 (HKLM-x32\...\{68AB6930-5BFF-4FF6-923B-516A91984FE6}) (Version: 5.8.10900.8.100 - Nero AG)
Nero BackItUp 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.4.10400.2.100 - Nero AG)
Nero BurnRights 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Control Center 10 (x32 Version: 10.6.12700.0.7 - Nero AG) Hidden
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.6.10800 - Nero AG) Hidden
Nero Core Components 10 (x32 Version: 2.0.20000.9.12 - Nero AG) Hidden
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.6.10700.5.100 - Nero AG)
Nero Express 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero InfoTool 10 (HKLM-x32\...\{F412B4AF-388C-4FF5-9B2F-33DB1C536953}) (Version: 7.4.10300.1.100 - Nero AG)
Nero InfoTool 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Multimedia Suite 10 Essentials (HKLM-x32\...\{2063D199-D79F-471A-9019-9E647296394D}) (Version: 10.6.10300 - Nero AG)
Nero RescueAgent 10 (HKLM-x32\...\{E337E787-CF61-4B7B-B84F-509202A54023}) (Version: 3.6.10500.3.100 - Nero AG)
Nero RescueAgent 10 Help (CHM) (x32 Version: 10.6.10800 - Nero AG) Hidden
Nero StartSmart 10 (HKLM-x32\...\{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}) (Version: 10.6.10500.3.100 - Nero AG)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.6.10700 - Nero AG) Hidden
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.10900.31.0 - Nero AG)
NeroKwikMedia Help (CHM) (x32 Version: 10.6.10900 - Nero AG) Hidden
Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.6.0.32 - Symantec Corporation)
NVIDIA 3D Vision Driver 266.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 266.69 - NVIDIA Corporation)
NVIDIA Control Panel 266.69 (Version: 266.69 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 266.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.69 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.1.9.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.1.9.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6669 - NVIDIA Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 8.4.1.210 - Electronic Arts, Inc.)
PC Connectivity Solution (HKLM-x32\...\{BA77F9D2-CD35-41EB-9BC9-769879DFF8A6}) (Version: 12.0.48.0 - Nokia)
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.38.113.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6289 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden
SecondLifeViewer (remove only) (HKLM-x32\...\SecondLifeViewer) (Version: - )
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
SmartWebPrinting (x32 Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 140.0.213.000 - Hewlett-Packard) Hidden
Spotify (HKCU\...\Spotify) (Version: 0.9.4.185.g7545a404 - Spotify AB)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Status (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.11.1 - Synaptics Incorporated)
Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden
TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.02.02 - TOSHIBA CORPORATION)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{43DBC64B-3DD1-47E2-8788-D3C3B110C574}) (Version: 2.1.10.64 - TOSHIBA Corporation)
TOSHIBA Bulletin Board (Version: 2.1.10.64 - TOSHIBA Corporation) Hidden
TOSHIBA ConfigFree (HKLM-x32\...\{D5AEEAA2-184E-4A2A-BAA3-6225EA4B9516}) (Version: 8.0.37 - TOSHIBA CORPORATION)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.6 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.23.64 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.2.23.64 - TOSHIBA Corporation) Hidden
TOSHIBA eco Utility (x32 Version: 1.2.23.64 - TOSHIBA Corporation) Hidden
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.8.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (Version: 3.1.8.64 - TOSHIBA Corporation) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\{2FD5D2C5-A7A1-4065-89BA-90542BF7CCD3}) (Version: 2.00.0013 - TOSHIBA)
TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.7 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.7 - TOSHIBA Corporation) Hidden
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.7 - TOSHIBA Corporation) Hidden
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.03 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.86.2 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.6.1 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 4.01.0000 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.4.64 - TOSHIBA Corporation)
TOSHIBA Places Icon Utility (HKLM-x32\...\{461F6F0D-7173-4902-9604-AB1A29108AF2}) (Version: 1.1.0.12 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.3.10010 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.1.0.0 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0 - TOSHIBA) Hidden
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{24811C12-F4A9-4D0F-8494-A7B8FE46123C}) (Version: 1.7.17.64 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.7.17.64 - TOSHIBA Corporation) Hidden
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.0 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM-x32\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.2.7 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (HKLM-x32\...\{119826A8-4EF6-4BE5-A88B-D2D81FA7CEE2}) (Version: 2.00.0008 - TOSHIBA)
TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.5.4.64 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.5.4.64 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.5.4.64 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.0.13 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (x32 Version: 2.0.0.13 - TOSHIBA Corporation) Hidden
TOSHIBA Wireless LAN Indicator (HKLM-x32\...\{5BA99779-6E12-49EF-BE49-F35B1EDB4DF9}) (Version: 1.0.4 - TOSHIBA CORPORATION)
TrayApp (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - )
TRORMCLauncher (Version: 1.0.0.10 - TOSHIBA) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.)
VLC media player 2.1.0 (HKLM-x32\...\VLC media player) (Version: 2.1.0 - VideoLAN)
WebReg (x32 Version: 140.0.212.017 - Hewlett-Packard) Hidden
Wedding Dash 2 - Rings Around the World (x32 Version: 2.2.0.95 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.2.5 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.5.5 - WildTangent) Hidden
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
21-09-2014 17:00:17 Windows-Sicherung
29-09-2014 06:41:19 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {09EB8D61-5910-4F18-97DB-60E0E9DE7DBD} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {24E71FAE-6BD1-40BA-A520-0AED88A2E5B1} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {512218B7-177C-4C99-9A1D-BE55141DF7EA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-08-31] (Google Inc.)
Task: {6173A17E-AA64-4E24-9FB6-F52A38183508} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {6D7BA663-452C-41C7-98C5-980E2ACC5896} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-08-31] (Google Inc.)
Task: {825556B0-6C70-4D2C-B91A-EC283AA3234E} - System32\Tasks\Uninstaller_SkipUac_Administrator => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2014-06-16] (IObit)
Task: {9B5EEEF6-DA35-443C-8E91-E0A27A5B84A2} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe
Task: {E61C64F0-D677-4EA4-8640-0E502059A2A4} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
Task: {E9264077-DAB8-4115-9393-930CB243179B} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-12-03] (TOSHIBA CORPORATION)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-08-22 13:51 - 2010-09-09 17:26 - 00162824 _____ () C:\Windows\System32\GFNEXSrv.exe
2010-12-08 15:55 - 2010-12-08 15:55 - 00592312 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2011-03-03 23:21 - 2011-03-03 23:21 - 03420584 _____ () C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll
2010-12-15 15:19 - 2010-12-15 15:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2011-08-31 10:43 - 2011-02-22 11:16 - 00559104 _____ () C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\de\Humphrey.resources.dll
2011-08-31 10:56 - 2011-08-02 15:56 - 00022400 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2011-08-31 10:56 - 2011-08-02 15:56 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll
2010-12-08 15:42 - 2010-12-08 15:42 - 00079264 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-25 11:10 - 2014-09-25 11:10 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2011-01-16 05:25 - 2011-01-16 05:25 - 00235112 _____ () C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-3547617622-2166199306-444984410-500 - Administrator - Disabled)
Gast (S-1-5-21-3547617622-2166199306-444984410-501 - Limited - Disabled)
Mellie (S-1-5-21-3547617622-2166199306-444984410 - Administrator - Enabled)
==================== Faulty Device Manager Devices =============
Name: Deskjet F4500 series
Description: Deskjet F4500 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/30/2014 00:36:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (09/29/2014 03:39:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2168
Error: (09/29/2014 03:39:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2168
Error: (09/29/2014 03:39:35 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/29/2014 03:39:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1170
Error: (09/29/2014 03:39:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1170
Error: (09/29/2014 03:39:34 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (09/29/2014 02:28:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1394165
Error: (09/29/2014 02:28:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1394165
Error: (09/29/2014 02:28:03 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (09/30/2014 00:36:26 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT)
Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147549183.
Error: (09/30/2014 09:04:16 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/30/2014 09:04:16 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 02:28:03 PM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 02:28:03 PM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 11:31:52 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 11:31:52 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 08:40:43 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/29/2014 08:40:43 AM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Error: (09/27/2014 01:28:31 PM) (Source: ACPI) (EventID: 10) (User: )
Description: ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung zu erhalten.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-09-30 12:30:58.185
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-30 12:18:17.908
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-29 10:15:58.544
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-27 16:50:44.462
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-27 13:28:37.760
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-26 18:21:41.639
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-26 18:09:45.143
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-22 16:40:58.483
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-17 16:23:38.715
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-17 16:10:32.010
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU B950 @ 2.10GHz
Percentage of memory in use: 35%
Total physical RAM: 6125.98 MB
Available physical RAM: 3967.47 MB
Total Pagefile: 12250.14 MB
Available Pagefile: 9885.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (WINDOWS) (Fixed) (Total:299.02 GB) (Free:50.2 GB) NTFS
Drive d: (Data) (Fixed) (Total:296.76 GB) (Free:0.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 6710D270)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=299 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=296.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter # AdwCleaner v3.310 - Bericht erstellt am 30/09/2014 um 12:34:49
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Mellie - MELLIE
# Gestartet von : C:\Users\Mellie\Desktop\adwcleaner_3.310.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Mellie\AppData\LocalLow\HPAppData
***** [ Tasks ] *****
Task Gelöscht : globalUpdateUpdateTaskMachineCore
Task Gelöscht : globalUpdateUpdateTaskMachineUA
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{401EA098-5006-38D6-99CE-F46A89FC2D4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{401EA098-5006-38D6-99CE-F46A89FC2D4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\yuna software
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\yuna software
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16428
-\\ Mozilla Firefox v32.0.3 (x86 de)
[ Datei : C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default\prefs.js ]
Zeile gelöscht : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
Zeile gelöscht : user_pref("extensions.quick_start.enable_search1", false);
Zeile gelöscht : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
*************************
AdwCleaner[R0].txt - [7230 octets] - [16/06/2014 04:25:36]
AdwCleaner[R1].txt - [945 octets] - [16/06/2014 13:53:42]
AdwCleaner[R2].txt - [6830 octets] - [30/09/2014 12:32:51]
AdwCleaner[S0].txt - [5922 octets] - [16/06/2014 04:27:01]
AdwCleaner[S1].txt - [6636 octets] - [30/09/2014 12:34:49]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [6696 octets] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-09-2014
Ran by Mellie (administrator) on MELLIE on 30-09-2014 12:41:28
Running from C:\Users\Mellie\Desktop
Loaded Profile: Mellie (Available profiles: Mellie)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Windows\System32\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Yuna Software) C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\mozilla firefox\firefox.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2011-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1519016 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2010-12-20] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2011-08-31] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-19\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-20\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-18\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Toshiba Places Icon Utility.lnk
ShortcutTarget: Toshiba Places Icon Utility.lnk -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Toshiba)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default
FF Homepage: hxxp://google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Mellie\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Geolocater - C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default\Extensions\geolocater@3liz.com [2013-04-25]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-20]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-09-30]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1876816 2014-04-10] (SurfRight B.V.)
R2 HPSLPSVC; C:\Users\Mellie\AppData\Local\Temp\7zS0FB2\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2175264 2014-06-16] (IObit)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsgPlusService; C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe [132096 2014-08-06] (Yuna Software) [File not signed]
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [93144 2014-04-10] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140929.001\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-30] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140929.001\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140929.001\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [24744 2014-06-11] (Audials AG)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 Tosrfcom; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 12:41 - 2014-09-30 12:42 - 00023832 _____ () C:\Users\Mellie\Desktop\FRST.txt
2014-09-30 12:41 - 2014-09-30 12:41 - 00000000 ____D () C:\FRST
2014-09-30 12:39 - 2014-09-30 12:39 - 02108928 _____ (Farbar) C:\Users\Mellie\Desktop\FRST64.exe
2014-09-30 12:31 - 2014-09-30 12:38 - 00000000 ____D () C:\Users\Mellie\Desktop\Reinigung 30.09
2014-09-30 12:22 - 2014-09-30 12:22 - 01699276 _____ (Thisisu) C:\Users\Mellie\Desktop\JRT.exe
2014-09-30 12:11 - 2014-09-30 12:11 - 01373475 _____ () C:\Users\Mellie\Desktop\adwcleaner_3.310.exe
2014-09-27 13:16 - 2014-09-27 13:16 - 00000000 ____D () C:\Windows\System32\Tasks\Norton 360
2014-09-26 18:41 - 2014-09-26 18:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-26 17:28 - 2014-09-26 17:35 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\GrabIt
2014-09-26 17:20 - 2014-09-26 17:20 - 02427820 _____ (Ilan Shemes ) C:\Users\Mellie\Downloads\GrabIt172b6.exe
2014-09-25 11:10 - 2014-09-25 11:10 - 00000000 ____D () C:\Program Files (x86)\mozilla firefox
2014-09-21 14:08 - 2014-09-21 14:08 - 00200021 _____ () C:\Users\Mellie\Desktop\Kündigung Büro Tdf.xlsx
2014-09-19 10:23 - 2014-09-19 10:23 - 00199973 _____ () C:\Users\Mellie\Desktop\Kündigung Klüß.xlsx
2014-09-17 16:19 - 2014-09-17 16:19 - 00199956 _____ () C:\Users\Mellie\Desktop\Kündigung Bachmann.xlsx
2014-09-17 16:14 - 2014-09-17 16:14 - 00200312 _____ () C:\Users\Mellie\Desktop\Kündigung Hartmann.xlsx
2014-09-17 15:41 - 2014-09-17 15:41 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-09-13 13:30 - 2014-09-13 13:30 - 00000000 ____D () C:\Users\Mellie\Desktop\Wohnung
2014-09-09 15:25 - 2014-09-09 15:25 - 00013855 _____ () C:\Users\Mellie\Desktop\Preise Bermuda.xlsx
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-30 12:41 - 2011-02-11 10:21 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-09-30 12:41 - 2011-02-11 10:21 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-09-30 12:41 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-30 12:39 - 2012-08-22 13:43 - 01056841 _____ () C:\Windows\WindowsUpdate.log
2014-09-30 12:37 - 2014-06-16 04:22 - 00000000 ____D () C:\ProgramData\ProductData
2014-09-30 12:36 - 2012-11-18 00:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-30 12:36 - 2012-08-22 13:48 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-30 12:36 - 2011-08-31 11:13 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-30 12:36 - 2010-11-21 05:47 - 00773692 _____ () C:\Windows\PFRO.log
2014-09-30 12:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-30 12:36 - 2009-07-14 06:51 - 00061967 _____ () C:\Windows\setupact.log
2014-09-30 12:34 - 2014-06-16 04:25 - 00000000 ____D () C:\AdwCleaner
2014-09-30 12:21 - 2011-08-31 11:13 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-30 12:12 - 2014-06-16 04:31 - 00000000 ____D () C:\Users\Mellie\Desktop\safety first
2014-09-30 12:11 - 2012-11-25 13:12 - 00000000 ____D () C:\Users\Mellie\Desktop\Baltic Taxi
2014-09-30 12:11 - 2012-11-18 14:21 - 00000000 ____D () C:\Users\Mellie\Desktop\Pics
2014-09-30 12:08 - 2014-08-16 16:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-27 13:29 - 2012-11-18 00:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-27 13:29 - 2012-11-18 00:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-27 13:15 - 2013-11-20 16:34 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-09-27 13:15 - 2013-11-19 14:33 - 00002326 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-09-27 13:15 - 2013-05-11 16:47 - 00000000 ____D () C:\Users\Mellie\AppData\Local\CrashDumps
2014-09-27 13:15 - 2013-02-26 14:11 - 00003206 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-09-27 13:15 - 2013-02-26 14:10 - 00000000 ____D () C:\Windows\system32\Drivers\N360x64
2014-09-27 09:59 - 2012-12-10 09:56 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\Skype
2014-09-26 19:11 - 2014-05-09 13:27 - 00000000 ____D () C:\ProgramData\Messenger Plus! for Skype
2014-09-26 18:41 - 2014-04-26 20:38 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-26 18:41 - 2011-08-31 10:45 - 00000000 ____D () C:\ProgramData\Skype
2014-09-26 18:00 - 2012-12-08 17:08 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\UseNeXT
2014-09-22 16:33 - 2009-07-14 06:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-22 16:33 - 2009-07-14 06:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-22 16:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-13 15:06 - 2013-09-23 12:43 - 00000000 ____D () C:\Users\Mellie\Desktop\Mix
2014-09-13 13:14 - 2012-12-08 17:26 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\vlc
2014-09-13 13:11 - 2014-07-15 12:24 - 00000000 ____D () C:\Users\Mellie\Desktop\wizard
2014-09-12 16:34 - 2012-12-08 17:08 - 00000000 ____D () C:\Program Files (x86)\UseNeXT
Some content of TEMP:
====================
C:\Users\Mellie\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-14 23:45
==================== End Of Log ============================
--- --- --- |
|
30.09.2014, 14:37
| #4 |
| | chrome://quick_start/content/index.html in Firefox-Tab GMER Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-30 13:37:05
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\Mellie\AppData\Local\Temp\pwddypod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003604000 63 bytes [00, 00, AD, 00, 43, 63, 56, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 592 fffff80003604040 6 bytes [13, A0, 02, 00, 00, 00]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1160] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1160] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1160] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e31465 2 bytes [E3, 75]
.text C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe[1160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e314bb 2 bytes [E3, 75]
.text ... * 2
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\nvvsvc.exe[1200] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\nvvsvc.exe[1200] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\nvvsvc.exe[1200] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\nvvsvc.exe[1200] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\svchost.exe[1436] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\svchost.exe[1436] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\svchost.exe[1436] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\svchost.exe[1436] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\WLANExt.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\WLANExt.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\WLANExt.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\WLANExt.exe[1596] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\System32\spoolsv.exe[1764] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\System32\spoolsv.exe[1764] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\System32\spoolsv.exe[1764] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\System32\spoolsv.exe[1764] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\svchost.exe[1800] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\svchost.exe[1800] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\svchost.exe[1800] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\svchost.exe[1800] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1924] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1964] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1964] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1964] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files\Bonjour\mDNSResponder.exe[1988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\Bonjour\mDNSResponder.exe[1988] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\Bonjour\mDNSResponder.exe[1988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\Bonjour\mDNSResponder.exe[1988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe[1116] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe[1116] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe[1116] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe[1644] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe[1644] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe[1644] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Windows\system32\svchost.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\svchost.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\svchost.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\svchost.exe[1536] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\SysWOW64\svchost.exe[2068] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Windows\SysWOW64\svchost.exe[2068] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Windows\SysWOW64\svchost.exe[2068] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe[2232] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe[2232] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe[2232] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Windows\System32\svchost.exe[2256] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\System32\svchost.exe[2256] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\System32\svchost.exe[2256] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\System32\svchost.exe[2256] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\System32\svchost.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\System32\svchost.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\System32\svchost.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\System32\svchost.exe[2292] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2688] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2688] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2688] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[2720] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Windows\system32\svchost.exe[2756] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\svchost.exe[2756] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\svchost.exe[2756] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\svchost.exe[2756] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe[2808] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2900] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2900] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2900] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
? C:\Windows\system32\mssprxy.dll [2900] entry point in ".rdata" section 000000006bce71e6
.text C:\Program Files\TOSHIBA\TECO\TecoService.exe[2980] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TECO\TecoService.exe[2980] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TECO\TecoService.exe[2980] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TECO\TecoService.exe[2980] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3056] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3056] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075e31465 2 bytes [E3, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe[3056] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000075e314bb 2 bytes [E3, 75]
.text ... * 2
.text C:\Windows\system32\wbem\wmiprvse.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\wbem\wmiprvse.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\wbem\wmiprvse.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\wbem\wmiprvse.exe[3112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3620] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3620] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3620] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e31465 2 bytes [E3, 75]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e314bb 2 bytes [E3, 75]
.text ... * 2
.text C:\Windows\system32\svchost.exe[3700] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\svchost.exe[3700] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\svchost.exe[3700] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\svchost.exe[3700] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\SearchIndexer.exe[3736] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\SearchIndexer.exe[3736] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\SearchIndexer.exe[3736] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\SearchIndexer.exe[3736] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\taskhost.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\taskhost.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\taskhost.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\taskhost.exe[4956] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\Dwm.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\Dwm.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\Dwm.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\Dwm.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[4684] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[4684] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[4684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[4684] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4696] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4696] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4696] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4696] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4716] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\TECO\Teco.exe[2568] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TECO\Teco.exe[2568] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TECO\Teco.exe[2568] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TECO\Teco.exe[2568] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2580] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2580] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2580] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe[2580] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\Windows Sidebar\sidebar.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\Windows Sidebar\sidebar.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\Windows Sidebar\sidebar.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\Windows Sidebar\sidebar.exe[5568] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe[5576] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe[5576] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe[5576] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe[5576] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[5584] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[5584] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000075e31465 2 bytes [E3, 75]
.text C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe[5584] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000075e314bb 2 bytes [E3, 75]
.text ... * 2
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[5616] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[5616] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[5616] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5688] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5688] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[5688] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe[5700] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe[5700] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe[5700] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5720] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5720] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5720] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe[5720] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe[5728] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe[5728] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe[5728] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe[5728] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5736] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5736] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[5736] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[5640] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[5640] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[5640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[872] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[872] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[872] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe[3760] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe[3760] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe[3760] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe[3760] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3512] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3512] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3512] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3512] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[784] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[784] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[784] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1732] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1732] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[1732] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text c:\Program Files (x86)\Nero\Update\NASvc.exe[6192] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text c:\Program Files (x86)\Nero\Update\NASvc.exe[6192] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text c:\Program Files (x86)\Nero\Update\NASvc.exe[6192] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Windows\System32\svchost.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\System32\svchost.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\System32\svchost.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\System32\svchost.exe[6292] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6536] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6536] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6536] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[6712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe[6752] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[6784] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[6784] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[6784] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[6784] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe[3208] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\explorer.exe[12872] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\explorer.exe[12872] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\explorer.exe[12872] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\explorer.exe[12872] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Windows\system32\taskeng.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077911430 5 bytes JMP 00000001778b0010
.text C:\Windows\system32\taskeng.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 0000000077911490 5 bytes JMP 00000001778b0028
.text C:\Windows\system32\taskeng.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 00000000779117b0 1 byte JMP 00000001778b0040
.text C:\Windows\system32\taskeng.exe[5836] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2 00000000779117b2 3 bytes {JMP 0xfffffffffff9e890}
.text C:\Users\Mellie\Desktop\Gmer-19357.exe[35088] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 0000000077abfac0 5 bytes JMP 0000000174d68cf0
.text C:\Users\Mellie\Desktop\Gmer-19357.exe[35088] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 0000000077abfb58 5 bytes JMP 0000000174d68ea0
.text C:\Users\Mellie\Desktop\Gmer-19357.exe[35088] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077ac0038 5 bytes JMP 0000000174d68d80
---- Processes - GMER 2.1 ----
Library c:\users\mellie\appdata\local\temp\7zs0fb2\hpslpsvc64.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [3700] (HP Network Devices Support/Hewlett-Packard Co.)(2012-11-19 17:18:09) 0000000180000000
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows Live\Communications Clients\Shared\2526914383\Groups@\xaeGoldMembers\xae 1
---- EOF - GMER 2.1 ----
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.3 (09.27.2014:1)
OS: Windows 7 Home Premium x64
Ran by Mellie on 30.09.2014 at 12:48:10,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
Successfully stopped: [Service] msgplusservice
Successfully deleted: [Service] msgplusservice
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho9097.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB634.tmp
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\messenger plus! for skype"
Successfully deleted: [Folder] "C:\Program Files (x86)\yuna software"
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{09D2A275-89F1-494D-A132-29289B711B96}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{11ADEC4D-05F3-4117-8811-05A3C4882088}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{13659285-46E1-4C21-92E1-F64FCE690E4D}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{1411C5EE-7E3E-4A97-8803-368F16850C67}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{163BDEE5-B519-4FFB-8250-91164ED2A059}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{1C45B7AC-4B26-4CBC-9004-3A7527F81A13}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{2CF4C46E-A6C0-4738-BDDF-B16E2DC13007}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{31DADD32-0718-4623-8B04-C23BABDD9BFD}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{57879A8B-35A3-4F9C-A277-973677063C55}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{59B36E80-B12A-429D-9B14-44B36AD3D1F0}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{5CB480F0-DEFA-47F2-9442-DADADE5FE21D}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{65261EAD-460D-4BC0-8CBB-86F1E232C8C2}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{662FB437-652B-4E49-97BC-5AF51CEEFFB6}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{722B5A1A-E65B-494F-9067-6BD8EFDAEAD0}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{7688B22B-D049-4D6E-8265-C7D49F67B142}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{79A3339E-7FED-43E2-8282-2EFE09D93778}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{8325A43D-B4F9-4D57-B3F5-C43F0AF432E4}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{8AD242C6-2C1F-4F4A-957B-243C05B0F1F0}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{9A67E614-D57D-43E6-A231-79226286F158}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{A6D99096-D630-4294-927B-94F3228DEEB6}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{BEDA2325-A6BA-4132-BBCC-37CB20F0EA28}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{C5008002-05D3-41F2-BBA6-61D0601DD2B8}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{C6D31071-791E-4328-AEB7-223AFF4FF681}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{C6F05C2D-894B-42B5-8424-0C67C49444B6}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{C7A17DF4-D87D-4F07-96B3-20EF68372085}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{D1E9AC68-47C0-4DF8-B81A-02EFC4F56BA3}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{E8C9F9A5-0F88-4E0D-B0BA-AD54F1F80A71}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{F2B6B547-D5B3-4577-90D3-F6F4CC5D272C}
Successfully deleted: [Empty Folder] C:\Users\Mellie\appdata\local\{F9C448B7-5C47-4404-9A34-6BF60CB67D90}
~~~ FireFox
Emptied folder: C:\Users\Mellie\AppData\Roaming\mozilla\firefox\profiles\1eah8kqb.default\minidumps [57 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 30.09.2014 at 12:57:49,46
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 30.09.2014 Suchlauf-Zeit: 12:08:18 Logdatei: mbam30.9..txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.09.30.03 Rootkit Datenbank: v2014.09.19.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Mellie Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 333599 Verstrichene Zeit: 16 Min, 5 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 6 PUP.Optional.CinemaHQ.A, HKLM\SOFTWARE\WOW6432NODE\HQ-V1.3, In Quarantäne, [02c9ed06601bc571b74ed4447c87f010], PUP.Optional.WindowsProtectManger.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsProtectManger, In Quarantäne, [14b749aa82f98aac3a59e23c7a89857b], PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE, In Quarantäne, [8a41668de4971a1c6316c05bad56728e], PUP.Optional.CinemaHQ.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HQ-V1.3, In Quarantäne, [14b710e323583ff79b6c2aeeb25133cd], PUP.Optional.CinemaHQ.A, HKU\S-1-5-21-3547617622-2166199306-444984410-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\HQ-V1.3, In Quarantäne, [c30812e1d0ab6dc967a0ca4eb152916f], PUP.Optional.FastStart.A, HKU\S-1-5-21-3547617622-2166199306-444984410-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS, In Quarantäne, [2f9cad4690eba98dac7f0e029f647f81], Registrierungswerte: 3 PUP.Optional.GlobalUpdate.T, HKLM\SOFTWARE\WOW6432NODE\GLOBALUPDATE\UPDATE|path, C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe, In Quarantäne, [8a41668de4971a1c6316c05bad56728e] PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default\extensions\faststartff@gmail.com, In Quarantäne, [dbf0ba394833ff375c0090e8f50ff010] PUP.Optional.FastStart.A, HKU\S-1-5-21-3547617622-2166199306-444984410-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, faststartff@gmail.com, In Quarantäne, [2f9cad4690eba98dac7f0e029f647f81] Registrierungsdaten: 1 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[fad12ec5b0cb60d65fcea0721ee759a7] Ordner: 0 (No malicious items detected) Dateien: 1 PUP.Optional.QuickStart.A, C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), Ersetzt,[1dae7b789fdcc274cfbbca7a3ec7a15f] Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:04 on 30/09/2014 (Mellie)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
|
01.10.2014, 07:56
| #5 |
| /// the machine /// TB-Ausbilder | chrome://quick_start/content/index.html in Firefox-TabESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.10.2014, 10:06
| #6 |
| | chrome://quick_start/content/index.html in Firefox-Tab Hallo So, das hat ein wenig gedauert - der ESET-Scan lief 20 Stunden. Ist das normal? :-/ Er hat auch einiges gefunden - hier kommen nun die logs... Security Check: Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Spybot - Search & Destroy
Java(TM) 6 Update 20
Java 7 Update 67
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox (32.0.3)
Mozilla Thunderbird (24.6.0)
````````Process Check: objlist.exe by Laurent````````
TOSHIBA TOSHIBA Online Product Information TOPI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=aa035a00c04b1f42b2526b9fbbc4cc00
# engine=20382
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-02 06:15:40
# local_time=2014-10-02 08:15:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Norton 360'
# compatibility_mode=3598 16777213 100 100 413963 162893036 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 72679 163860390 0 0
# scanned=293457
# found=126
# cleaned=0
# scan_time=72342
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface32.dll.vir"
sh=125B1C393F2104CBA08183E495C0907BFF7EDA22 ft=1 fh=ea25908c8365106f vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterface64.dll.vir"
sh=8E85792765D0E0BF52107CFF4A6620995DB19BB0 ft=1 fh=627da500ea2e265f vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\DpInterfacef32.dll.vir"
sh=2FCA2173F2DD16DF8F1F990170FA4479FC5D5BFC ft=1 fh=c528dd1cda99a111 vn="Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\RSHP.exe.vir"
sh=5836A5DF3860241F6B69F2292ABCE592A13689B6 ft=1 fh=a3db04555f559ea8 vn="Variante von Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv32.dll.vir"
sh=E97CBDBD7CFED2C58464C1ABF186520022DE5666 ft=1 fh=7a2ea5ecc33ad0e3 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SpAPPSv64.dll.vir"
sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\SupTab.dll.vir"
sh=06C15CA58DDDA1072F5AB4C820DAC979FAA72A34 ft=1 fh=78c70a54817f7d30 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Downloads\unlocker1.8.8.exe"
sh=8434A124ECDD7C022025CEB9A5FBAC968699B497 ft=1 fh=33abea7437239505 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Downloads\Software\Miro_Installer.exe"
sh=6B49F894DFB14CE74B9DC9CC77A5111AFAA5A83B ft=1 fh=c830d3999c663b65 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Neue Software\Mediacenter1.0Setup.exe"
sh=4338D5944791D0CE359B859397EABEBE203893C8 ft=1 fh=7fc7dafc36e99ed5 vn="Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\Core-Temp-setup.exe"
sh=4370419C790CEEA4DD50ED06F09F8C784E2C9963 ft=1 fh=14fb91621afbe727 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\FreeDVDVideoBurner.exe"
sh=C92A1827E0AC800E3E40148611B16700C3DAD684 ft=1 fh=8a8ff7b64fa716e2 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\FreeVideoToMp3Converter33.exe"
sh=463AD35F4737F0B587FA39485D70D74331B229F0 ft=1 fh=8a8ff7b6cbbc46f4 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter.exe"
sh=07C3A8DE40271B9ECD674AF867A2C7F61D40DFBA ft=1 fh=8a8ff7b630139cd7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter35.exe"
sh=507B6AD46C471804A48A6E7A4D17E1C0B3B7FE74 ft=1 fh=250619b7b5b96cd4 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\Setup19_FreeConverter.exe"
sh=FAF209E4C61B1C0E80BBAE5DDF7AF4A44F1894AF ft=1 fh=54559bb40a33fef3 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme Mel\SoftonicDownloader_fuer_scribus.exe"
sh=7A8FC7258DB66CB030FBAF608D0D98C52E8C3E12 ft=1 fh=183f54e3bc01acc9 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\Programme neu\Setup-MsgPlus-511.exe"
sh=898918918DF48A13DF6AE81E2AFD4AD65A0CBB22 ft=1 fh=3aac558825ea54ee vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\sicherung benutzer büro45\Downloads\Miro_Installer.exe"
sh=E115AC80776D091765ED3EA022A001E0D8AA4DC9 ft=1 fh=85ce5afd4a88c17f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\ABRECHNUNG\sicherung benutzer büro45\Downloads\unlocker1.9.0.exe"
sh=06C15CA58DDDA1072F5AB4C820DAC979FAA72A34 ft=1 fh=78c70a54817f7d30 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Downloads\unlocker1.8.8.exe"
sh=8434A124ECDD7C022025CEB9A5FBAC968699B497 ft=1 fh=33abea7437239505 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Downloads\Software\Miro_Installer.exe"
sh=6B49F894DFB14CE74B9DC9CC77A5111AFAA5A83B ft=1 fh=c830d3999c663b65 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Neue Software\Mediacenter1.0Setup.exe"
sh=4338D5944791D0CE359B859397EABEBE203893C8 ft=1 fh=7fc7dafc36e99ed5 vn="Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\Core-Temp-setup.exe"
sh=4370419C790CEEA4DD50ED06F09F8C784E2C9963 ft=1 fh=14fb91621afbe727 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\FreeDVDVideoBurner.exe"
sh=C92A1827E0AC800E3E40148611B16700C3DAD684 ft=1 fh=8a8ff7b64fa716e2 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\FreeVideoToMp3Converter33.exe"
sh=463AD35F4737F0B587FA39485D70D74331B229F0 ft=1 fh=8a8ff7b6cbbc46f4 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter.exe"
sh=07C3A8DE40271B9ECD674AF867A2C7F61D40DFBA ft=1 fh=8a8ff7b630139cd7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter35.exe"
sh=507B6AD46C471804A48A6E7A4D17E1C0B3B7FE74 ft=1 fh=250619b7b5b96cd4 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\Setup19_FreeConverter.exe"
sh=FAF209E4C61B1C0E80BBAE5DDF7AF4A44F1894AF ft=1 fh=54559bb40a33fef3 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme Mel\SoftonicDownloader_fuer_scribus.exe"
sh=7A8FC7258DB66CB030FBAF608D0D98C52E8C3E12 ft=1 fh=183f54e3bc01acc9 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\Programme neu\Setup-MsgPlus-511.exe"
sh=898918918DF48A13DF6AE81E2AFD4AD65A0CBB22 ft=1 fh=3aac558825ea54ee vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\sicherung benutzer büro45\Downloads\Miro_Installer.exe"
sh=E115AC80776D091765ED3EA022A001E0D8AA4DC9 ft=1 fh=85ce5afd4a88c17f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\ABRECHNUNG\sicherung benutzer büro45\Downloads\unlocker1.9.0.exe"
sh=7CF87ED72DAF3272D752E3AB26873A9549F28692 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 14.zip"
sh=D37F436A675775FEF54E85888181EABDCEC626F4 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 16.zip"
sh=C0E07DA6988860EC8A22ABDA4CE31635CD36B0DE ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 17.zip"
sh=505E39A915393968701BDDA0FC86FBA1F63C6A31 ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 18.zip"
sh=0BA18CA31CA0171C0DD8A5ECADBFD8EB7CB4A1AD ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 20.zip"
sh=D9E87F3391C33034E48FDD6C5E3DAE20914D0F8A ft=0 fh=0000000000000000 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\Festplatte\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 21.zip"
sh=8A32CCCF3EA918136CBDD230ED05A937D16531D4 ft=1 fh=80667b73cc26d1d6 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\PC1\MyPhoneExplorer_Setup_1.8.4.exe"
sh=059333B5223F5C47BC7A6976F41CBB7D253CDCF8 ft=1 fh=dab4cefc19d25eae vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Mellie\Desktop\PC1\Setup-PlusForSkype-3.0_FF.exe"
sh=236A931097D1BBC9CC3B9A3ABD6F0E6504CA611B ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 25.zip"
sh=FD1EEBB6DF3DB67F02076EC165A3F8A526253B86 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 27.zip"
sh=ECEDC2B4BAFE6CE9A0B3C03E8CC26A6D23D53575 ft=0 fh=0000000000000000 vn="Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 28.zip"
sh=3B0A6684EF82250C3FE3C22B65DB2EE3D776EA58 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 29.zip"
sh=4C41F28886B9AC133F6C3BAB24DB22E9EC87F0EE ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 30.zip"
sh=32877927ECFB23BF9E76981E1CDE89EEE26575A6 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 31.zip"
sh=81B1643F7287ECC1E38F49602C1404DD70ECE433 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 32.zip"
sh=4D33CDFEE9FA21A45BDC1B2D725FC8B3617C2A22 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 34.zip"
sh=498F1B6160B41A43B73E0081600D88F7006F61EF ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 35.zip"
sh=68499DCF37D433952A2AB158150DEB11B2EB5842 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 37.zip"
sh=2071478F03212BC5AD87629DB2D30584943202FC ft=0 fh=0000000000000000 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 38.zip"
sh=8D510C258728FE1B2CE83AD34215DAB933383043 ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 39.zip"
sh=4AB3057BC462F877CEABE0379254D5EEB342BDC2 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 41.zip"
sh=E10A4C6C9B96F8693BE2D934790FD01AF56BD2A7 ft=0 fh=0000000000000000 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-01-12 190003\Backup files 42.zip"
sh=742A8A9878157972EA496DB0A43247528D2844E1 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 371.zip"
sh=554CCD46684BC8B8D840022662246438C7EA02FD ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 393.zip"
sh=8B5BEF3F792EE9969A7C106B55F055B576CA5277 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 404.zip"
sh=1A8C5F597A8F4D28F9A7A406DF36DE00F7D26260 ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 415.zip"
sh=A4FA0262FE16536DD9BF22D53A22EC4119BE07E9 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 439.zip"
sh=C0E329D92DB404AC061318998F5FBC4AA19308A9 ft=0 fh=0000000000000000 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 450.zip"
sh=1A4E6B9EE3E792252EC585C6996965771BC2C28E ft=0 fh=0000000000000000 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-04-27 190003\Backup files 5.zip"
sh=1D2350880054F53492EE804B80926E5C5EBBB018 ft=0 fh=0000000000000000 vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-09-14 190005\Backup files 1.zip"
sh=AF73675C36F92275C6B6507C897CC91B9F5C7A0B ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="D:\MELLIE\Backup Set 2014-01-12 190003\Backup Files 2014-09-14 190005\Backup files 8.zip"
sh=7CF87ED72DAF3272D752E3AB26873A9549F28692 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 14.zip"
sh=D37F436A675775FEF54E85888181EABDCEC626F4 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 16.zip"
sh=C0E07DA6988860EC8A22ABDA4CE31635CD36B0DE ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 17.zip"
sh=505E39A915393968701BDDA0FC86FBA1F63C6A31 ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 18.zip"
sh=0BA18CA31CA0171C0DD8A5ECADBFD8EB7CB4A1AD ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 20.zip"
sh=D9E87F3391C33034E48FDD6C5E3DAE20914D0F8A ft=0 fh=0000000000000000 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-20 191142\Backup files 21.zip"
sh=FAA68C4113E43FCC618C26D7E60A1DC036A5F8D0 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 3.zip"
sh=495B35971643F222D770E4C0C0110948A3255D53 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 4.zip"
sh=6841BBE8D5E254169496E295DC1E8A5637AECFFD ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 6.zip"
sh=979F9CCBDBE7AA9C42CF7D7D026AF12F07E5A421 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 7.zip"
sh=53AD5AE8106A2D1DCEA04F93966134B8C351E7AC ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 8.zip"
sh=D92FFFB314309B23FFECD75D8D0A6931383076B7 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 10.zip"
sh=67381485797BB230EBAE6785860DE539AC1F33C7 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 280.zip"
sh=4779F87AD0D3EF9984DBB35EEFBE445AE57D3350 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 302.zip"
sh=EE3B52037447F96506F4D798834B3C41EEAF1271 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 313.zip"
sh=6F06FFC71272610CA4D8D98B968BEFF8931877BB ft=0 fh=0000000000000000 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 324.zip"
sh=DC7B0CF9A2A891F33E27C508FF3E5FA5BFF469DD ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 348.zip"
sh=9DFC3FD16CB66C1928138B25AC428B4D17CFA515 ft=0 fh=0000000000000000 vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung" ac=I fn="G:\MELLIE\Backup Set 2013-01-20 191142\Backup Files 2013-01-28 004617\Backup files 359.zip"
sh=8A32CCCF3EA918136CBDD230ED05A937D16531D4 ft=1 fh=80667b73cc26d1d6 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="G:\PC\MyPhoneExplorer_Setup_1.8.4.exe"
sh=8A32CCCF3EA918136CBDD230ED05A937D16531D4 ft=1 fh=80667b73cc26d1d6 vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="G:\PC1\MyPhoneExplorer_Setup_1.8.4.exe"
sh=06C15CA58DDDA1072F5AB4C820DAC979FAA72A34 ft=1 fh=78c70a54817f7d30 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Downloads\unlocker1.8.8.exe"
sh=8434A124ECDD7C022025CEB9A5FBAC968699B497 ft=1 fh=33abea7437239505 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Downloads\Software\Miro_Installer.exe"
sh=6B49F894DFB14CE74B9DC9CC77A5111AFAA5A83B ft=1 fh=c830d3999c663b65 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Neue Software\Mediacenter1.0Setup.exe"
sh=4338D5944791D0CE359B859397EABEBE203893C8 ft=1 fh=7fc7dafc36e99ed5 vn="Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\Core-Temp-setup.exe"
sh=4370419C790CEEA4DD50ED06F09F8C784E2C9963 ft=1 fh=14fb91621afbe727 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\FreeDVDVideoBurner.exe"
sh=C92A1827E0AC800E3E40148611B16700C3DAD684 ft=1 fh=8a8ff7b64fa716e2 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\FreeVideoToMp3Converter33.exe"
sh=463AD35F4737F0B587FA39485D70D74331B229F0 ft=1 fh=8a8ff7b6cbbc46f4 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter.exe"
sh=07C3A8DE40271B9ECD674AF867A2C7F61D40DFBA ft=1 fh=8a8ff7b630139cd7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\FreeYouTubeToMp3Converter35.exe"
sh=507B6AD46C471804A48A6E7A4D17E1C0B3B7FE74 ft=1 fh=250619b7b5b96cd4 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\Setup19_FreeConverter.exe"
sh=FAF209E4C61B1C0E80BBAE5DDF7AF4A44F1894AF ft=1 fh=54559bb40a33fef3 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme Mel\SoftonicDownloader_fuer_scribus.exe"
sh=7A8FC7258DB66CB030FBAF608D0D98C52E8C3E12 ft=1 fh=183f54e3bc01acc9 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\Programme neu\Setup-MsgPlus-511.exe"
sh=898918918DF48A13DF6AE81E2AFD4AD65A0CBB22 ft=1 fh=3aac558825ea54ee vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\sicherung benutzer büro45\Downloads\Miro_Installer.exe"
sh=E115AC80776D091765ED3EA022A001E0D8AA4DC9 ft=1 fh=85ce5afd4a88c17f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="G:\ABRECHNUNG\sicherung benutzer büro45\Downloads\unlocker1.9.0.exe"
sh=4338D5944791D0CE359B859397EABEBE203893C8 ft=1 fh=7fc7dafc36e99ed5 vn="Variante von Win32/Complitly.A evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\Core-Temp-setup.exe"
sh=4370419C790CEEA4DD50ED06F09F8C784E2C9963 ft=1 fh=14fb91621afbe727 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\FreeDVDVideoBurner.exe"
sh=C92A1827E0AC800E3E40148611B16700C3DAD684 ft=1 fh=8a8ff7b64fa716e2 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\FreeVideoToMp3Converter33.exe"
sh=463AD35F4737F0B587FA39485D70D74331B229F0 ft=1 fh=8a8ff7b6cbbc46f4 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\FreeYouTubeToMp3Converter.exe"
sh=07C3A8DE40271B9ECD674AF867A2C7F61D40DFBA ft=1 fh=8a8ff7b630139cd7 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\FreeYouTubeToMp3Converter35.exe"
sh=507B6AD46C471804A48A6E7A4D17E1C0B3B7FE74 ft=1 fh=250619b7b5b96cd4 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\Setup19_FreeConverter.exe"
sh=FAF209E4C61B1C0E80BBAE5DDF7AF4A44F1894AF ft=1 fh=54559bb40a33fef3 vn="Win32/SoftonicDownloader.A evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme Mel\SoftonicDownloader_fuer_scribus.exe"
sh=7A8FC7258DB66CB030FBAF608D0D98C52E8C3E12 ft=1 fh=183f54e3bc01acc9 vn="Variante von Win32/MessengerPlus.A evtl. unerwünschte Anwendung" ac=I fn="H:\Charles-Melli\Mellie\Desktop\Programme neu\Setup-MsgPlus-511.exe"
sh=FEA31740E614BCB56229801D62D3A1ACAB57EB80 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Zugo evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2011-07-06 155953\Backup Files 2011-07-17 020210\Backup files 1.zip"
sh=C8FAC9A65EF82E371DF2AB338C0AF5DE313B1741 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-02-29 201210\Backup Files 2012-02-29 201210\Backup files 1.zip"
sh=78A54382C5F35CA3A45DBC73DECED40F813C5A54 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-02-29 201210\Backup Files 2012-02-29 201210\Backup files 2.zip"
sh=0C96D208FC91DC4D3DABADB8CAB704F35DC5DA23 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-03-11 190000\Backup Files 2012-03-11 190000\Backup files 1.zip"
sh=6520D169114D6D232B9FF65C65A4C30EB5BB0F87 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-03-11 190000\Backup Files 2012-03-11 190000\Backup files 2.zip"
sh=B40F9F6AC0B506CF28368DE52CBF48D0D6EF5E4E ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-01 190000\Backup Files 2012-04-01 190000\Backup files 1.zip"
sh=AF5698FD21FEC5AF7A95052FF9A474A999FA87D5 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-01 190000\Backup Files 2012-04-01 190000\Backup files 2.zip"
sh=B04DCDE78C623A12870BE790A8943C7E8B70EAE1 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-13 164002\Backup Files 2012-04-13 164002\Backup files 1.zip"
sh=9C540F610D36572F926D982DD68D4A2D38CDE72A ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-13 164002\Backup Files 2012-04-13 164002\Backup files 2.zip"
sh=E727069C08505BFA3E734928A44E8D3AA80E1DB7 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-13 164002\Backup Files 2012-04-16 030027\Backup files 1.zip"
sh=BC0CE714C63F783E839B2F2737268A982F1CC585 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-30 205547\Backup Files 2012-04-30 205547\Backup files 1.zip"
sh=A44B7EBF776BD4AAF2A04E1C8A52508F78536A21 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-04-30 205547\Backup Files 2012-04-30 205547\Backup files 2.zip"
sh=B734B562CB2F95726AEB5B9488D591DFAF2C1AB5 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-05-22 174732\Backup Files 2012-05-22 174732\Backup files 1.zip"
sh=71A2E11EBC300B6CC456DD2D9B792AB5D1E8BB90 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-05-22 174732\Backup Files 2012-05-22 174732\Backup files 2.zip"
sh=06008A5A943A7B43E41FE67408FFE3E8B20F2A64 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-05-22 174732\Backup Files 2012-05-30 132457\Backup files 1.zip"
sh=860DAFE7774BB70046B72169B7F0B696D22B4229 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-06-12 095516\Backup Files 2012-06-12 095516\Backup files 1.zip"
sh=30DD90B8E31EB24F10DD36A49A6425FFDCF3C9E0 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-06-12 095516\Backup Files 2012-06-12 095516\Backup files 2.zip"
sh=16AEF245CFA63B66794BB677553CA209E9ECF0C2 ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-07-31 134749\Backup Files 2012-07-31 134749\Backup files 1.zip"
sh=561E60A16B4B9116D150CB4713C5629217817FA3 ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-07-31 134749\Backup Files 2012-07-31 134749\Backup files 4.zip"
sh=08ED9E239FB164DC71E28ABD09D7CF32D596342E ft=0 fh=0000000000000000 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-09-03 100641\Backup Files 2012-09-03 100641\Backup files 1.zip"
sh=1AF47F4E28A28AB580BB719466B4B905145184FD ft=0 fh=0000000000000000 vn="Variante von Win32/Somoto.A evtl. unerwünschte Anwendung" ac=I fn="H:\BÜRO45-PC\Backup Set 2012-09-03 100641\Backup Files 2012-09-03 100641\Backup files 4.zip"
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-09-2014
Ran by Mellie (administrator) on MELLIE on 02-10-2014 10:44:26
Running from C:\Users\Mellie\Desktop\safety first
Loaded Profile: Mellie (Available profiles: Mellie)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Windows\System32\GFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\n360.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2011-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1519016 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2010-12-20] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2011-08-31] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1295736 2011-02-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-19\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-20\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3547617622-2166199306-444984410-1003\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-18\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Toshiba Places Icon Utility.lnk
ShortcutTarget: Toshiba Places Icon Utility.lnk -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Toshiba)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\buShell.dll (Symantec Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll (IObit)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in -> {F3C88694-EFFA-4d78-B409-54B7B2535B14} -> C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.6.0.32\coIEPlg.dll (Symantec Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default
FF Homepage: hxxp://google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 -> C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No File
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Mellie\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Geolocater - C:\Users\Mellie\AppData\Roaming\Mozilla\Firefox\Profiles\1eah8kqb.default\Extensions\geolocater@3liz.com [2013-04-25]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-09-25]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-20]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-01]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1876816 2014-04-10] (SurfRight B.V.)
R2 HPSLPSVC; C:\Users\Mellie\AppData\Local\Temp\7zS0FB2\hpslpsvc64.dll [1039360 2012-08-27] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2175264 2014-06-16] (IObit)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1506000.020\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
R2 hmpalert; C:\Windows\system32\drivers\hmpalert.sys [93144 2014-04-10] ()
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140930.001\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)
S3 InputFilter_Hid_FlexDef2b; C:\Windows\System32\DRIVERS\InputFilter_FlexDef2b.sys [17920 2010-06-19] (Siliten)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-30] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140930.018\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140930.018\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R1 RrNetCapFilterDriver; C:\Windows\System32\DRIVERS\RrNetCapFilterDriver.sys [24744 2014-06-11] (Audials AG)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1506000.020\SRTSP64.SYS [876248 2014-08-26] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1506000.020\SRTSPX64.SYS [37592 2014-08-26] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1506000.020\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1506000.020\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1506000.020\Ironx64.SYS [266968 2014-08-06] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1506000.020\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 Tosrfcom; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 10:42 - 2014-10-02 10:42 - 00017689 _____ () C:\Users\Mellie\Desktop\schädlinge.txt
2014-10-01 12:05 - 2014-10-01 12:05 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-10-01 12:02 - 2014-10-01 12:02 - 02347384 _____ (ESET) C:\Users\Mellie\Desktop\esetsmartinstaller_deu.exe
2014-10-01 10:17 - 2014-10-01 10:17 - 00854417 _____ () C:\Users\Mellie\Desktop\SecurityCheck.exe
2014-09-30 18:23 - 2014-09-30 18:24 - 00000000 ____D () C:\Users\Mellie\Desktop\Rapalje - Alesia
2014-09-30 18:23 - 2014-09-30 18:23 - 00000000 ____D () C:\Users\Mellie\Desktop\Rapalje - Rakish Paddies
2014-09-30 18:23 - 2014-09-30 18:23 - 00000000 ____D () C:\Users\Mellie\Desktop\Rapalje - Into Folk
2014-09-30 18:23 - 2014-09-30 18:23 - 00000000 ____D () C:\Users\Mellie\Desktop\Rapalje - Celtic Fire
2014-09-30 18:23 - 2014-09-30 18:23 - 00000000 ____D () C:\Users\Mellie\Desktop\Rapalje - 2004
2014-09-30 13:14 - 2014-09-30 13:14 - 00000000 ____D () C:\OETemp
2014-09-30 13:13 - 2014-09-30 13:13 - 04714656 _____ (Avira Operations GmbH & Co. KG) C:\Users\Mellie\Desktop\avira_de_av_4329043080__ws.exe
2014-09-30 13:04 - 2014-09-30 13:04 - 00000000 _____ () C:\Users\Mellie\defogger_reenable
2014-09-30 12:48 - 2014-09-30 12:48 - 00000000 ____D () C:\Windows\ERUNT
2014-09-30 12:41 - 2014-10-02 10:44 - 00000000 ____D () C:\FRST
2014-09-30 12:31 - 2014-10-02 10:44 - 00000000 ____D () C:\Users\Mellie\Desktop\Reinigung 30.09
2014-09-27 13:16 - 2014-09-27 13:16 - 00000000 ____D () C:\Windows\System32\Tasks\Norton 360
2014-09-26 18:41 - 2014-09-26 18:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-26 17:28 - 2014-09-26 17:35 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\GrabIt
2014-09-26 17:20 - 2014-09-26 17:20 - 02427820 _____ (Ilan Shemes ) C:\Users\Mellie\Downloads\GrabIt172b6.exe
2014-09-25 11:10 - 2014-09-25 11:10 - 00000000 ____D () C:\Program Files (x86)\mozilla firefox
2014-09-21 14:08 - 2014-09-21 14:08 - 00200021 _____ () C:\Users\Mellie\Desktop\Kündigung Büro Tdf.xlsx
2014-09-17 16:19 - 2014-09-17 16:19 - 00199956 _____ () C:\Users\Mellie\Desktop\Kündigung Bachmann.xlsx
2014-09-17 16:14 - 2014-09-17 16:14 - 00200312 _____ () C:\Users\Mellie\Desktop\Kündigung Hartmann.xlsx
2014-09-17 15:41 - 2014-09-17 15:41 - 00000000 ____D () C:\Program Files (x86)\MSECache
2014-09-13 13:30 - 2014-09-13 13:30 - 00000000 ____D () C:\Users\Mellie\Desktop\Wohnung
2014-09-09 15:25 - 2014-09-09 15:25 - 00013855 _____ () C:\Users\Mellie\Desktop\Preise Bermuda.xlsx
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 10:44 - 2014-06-16 04:31 - 00000000 ____D () C:\Users\Mellie\Desktop\safety first
2014-10-02 10:21 - 2011-08-31 11:13 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-02 09:47 - 2012-08-22 13:43 - 01177817 _____ () C:\Windows\WindowsUpdate.log
2014-10-01 12:21 - 2011-08-31 11:13 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-01 12:03 - 2011-02-11 10:21 - 00654852 _____ () C:\Windows\system32\perfh007.dat
2014-10-01 12:03 - 2011-02-11 10:21 - 00130434 _____ () C:\Windows\system32\perfc007.dat
2014-10-01 12:03 - 2009-07-14 07:13 - 01500294 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-01 11:53 - 2012-11-18 14:21 - 00000000 ____D () C:\Users\Mellie\Desktop\Pics
2014-10-01 10:21 - 2009-07-14 06:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-01 10:21 - 2009-07-14 06:45 - 00024912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-01 10:15 - 2012-11-25 13:12 - 00000000 ____D () C:\Users\Mellie\Desktop\Baltic Taxi
2014-10-01 10:13 - 2012-08-22 13:48 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-01 10:13 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-01 10:13 - 2009-07-14 06:51 - 00062876 _____ () C:\Windows\setupact.log
2014-10-01 10:10 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-30 13:04 - 2012-11-18 11:46 - 00000000 ____D () C:\Users\Mellie
2014-09-30 12:49 - 2013-05-11 16:47 - 00000000 ____D () C:\Users\Mellie\AppData\Local\CrashDumps
2014-09-30 12:37 - 2014-06-16 04:22 - 00000000 ____D () C:\ProgramData\ProductData
2014-09-30 12:36 - 2012-11-18 00:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-30 12:36 - 2010-11-21 05:47 - 00773692 _____ () C:\Windows\PFRO.log
2014-09-30 12:34 - 2014-06-16 04:25 - 00000000 ____D () C:\AdwCleaner
2014-09-30 12:08 - 2014-08-16 16:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-27 13:29 - 2012-11-18 00:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-27 13:29 - 2012-11-18 00:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-27 13:15 - 2013-11-20 16:34 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360
2014-09-27 13:15 - 2013-11-19 14:33 - 00002326 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-09-27 13:15 - 2013-02-26 14:11 - 00003206 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-09-27 13:15 - 2013-02-26 14:10 - 00000000 ____D () C:\Windows\system32\Drivers\N360x64
2014-09-27 09:59 - 2012-12-10 09:56 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\Skype
2014-09-26 18:41 - 2014-04-26 20:38 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-26 18:41 - 2011-08-31 10:45 - 00000000 ____D () C:\ProgramData\Skype
2014-09-26 18:00 - 2012-12-08 17:08 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\UseNeXT
2014-09-13 15:06 - 2013-09-23 12:43 - 00000000 ____D () C:\Users\Mellie\Desktop\Mix
2014-09-13 13:14 - 2012-12-08 17:26 - 00000000 ____D () C:\Users\Mellie\AppData\Roaming\vlc
2014-09-13 13:11 - 2014-07-15 12:24 - 00000000 ____D () C:\Users\Mellie\Desktop\wizard
2014-09-12 16:34 - 2012-12-08 17:08 - 00000000 ____D () C:\Program Files (x86)\UseNeXT
Some content of TEMP:
====================
C:\Users\Mellie\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-14 23:45
==================== End Of Log ============================
--- --- --- --- --- --- Im Moment läuft alles ruhig und sauber, diese lange Liste von ESET hat mich bloß ein wenig nervös gemacht.... Vielen Dank & Grüße Cuddles |
|
02.10.2014, 19:33
| #7 |
| /// the machine /// TB-Ausbilder | chrome://quick_start/content/index.html in Firefox-Tab Das kommt von den ganzen externen Platten. Alle Backups auf D,G und H löschen, Ordner Downloads leeren, Ordner Desktop\Abrechnung\Programme bereinigen. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
Linear-Darstellung
