| |
| |||||||
Log-Analyse und Auswertung: Es öffnen sich einach Fenster Win 7 FirefoxWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
07.10.2014, 12:30
| #1 |
| |  Es öffnen sich einach Fenster Win 7 Firefox ESETSmartInstaller@High as downloader log: all ok ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=72bdc318b442a243b9b11a6e79579ee4 # engine=20478 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-10-07 10:01:58 # local_time=2014-10-07 12:01:58 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Norton 360' # compatibility_mode=3598 16777213 100 100 1026192 163338613 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 110859 164307308 0 0 # scanned=69366 # found=29 # cleaned=0 # scan_time=5617 sh=E32ECB71CAA5BA1F62D7E28F6E7D76D226677B01 ft=1 fh=fc7b40d4e32d8af5 vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\search_protect.exe.vir" sh=9D44B14F10FDE6C9D45715517D1B2E193BE6CD2C ft=1 fh=4aa4805c575beef8 vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\uninstaller.exe.vir" sh=0FADB783C6C38284E5819BCADED2A1C50503F7AF ft=1 fh=fcdd72b19b62f8d2 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bhelper.dll.vir" sh=CCFCD73F208F834C854E46E6F31DB11AADA5CF08 ft=1 fh=6a366370a714a51b vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bservice.exe.vir" sh=58787F33433447F2727A8811B33168C18C28DB32 ft=1 fh=c71c001199b91430 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\NmHost\nmhost.exe.vir" sh=7BB9B28A48C61080F08A506BCE180EC51A3F36A7 ft=1 fh=973e2ab75d54163d vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\cl.exe.vir" sh=9D085ECF4414599A6AE0E0913F41B0C42C0AFE16 ft=1 fh=c71c0011aae3df5f vn="Variante von Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\pwdg.exe.vir" sh=38822F744246B72AEFA8B3AF625CB63C810771EC ft=1 fh=4dc0d31d5b8edc90 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\updater.exe.vir" sh=5D470FF7475A5B13F7BFA2F1C85A9FCD87E99AA7 ft=1 fh=7a4fd9ef27726362 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\1.7.0.0\updater.exe.vir" sh=558B9F18F39F980BB52F023D2AEFE3522591AAE9 ft=1 fh=44b5e41c0a9f2e66 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Wd\wd.exe.vir" sh=7B1C9D79A789A4AC084770222AE48A2E8C9013E2 ft=1 fh=c71c00111a82f81a vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_187\fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\nengine.dll.vir" sh=B018ADBCA951AC0EB0757AFFD7EAB8FC0228CA91 ft=1 fh=fda9a5748d3eb594 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe.vir" sh=6F3A3B433459E6773C9FBE8CFB154DB6534EFA86 ft=1 fh=60bff0ff01dbe663 vn="Variante von Win32/InstallCore.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\VideoConverter.exe.vir" sh=4E0EBFDA05108FA6814D132037C9325E6E92435A ft=1 fh=c71c0011e5bdd8ce vn="Variante von Win32/InstallCore.GZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\Uninstall\__Uninstall_.exe.vir" sh=026727EC7D6B06AA7921A821BC1ADB2D81984D3C ft=1 fh=436f18bcc77206a1 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe.vir" sh=60BF5B7880EB06270FB4BCCCE6B4A02C8E14D0EC ft=1 fh=f8abc1b1f77880d7 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\majfst_gentlede.exe.vir" sh=76C12DAFEEA5FB67CBEDF9504AD6A2E114527120 ft=1 fh=2cb177d2d9247b6c vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\setup_recover_fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\genienext\nengine.dll.vir" sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Roaming\0D0S1L2Z1P1B\Video Converter Packages\uninstaller.exe.vir" sh=24EACADAF8910146B00A3B6146FAD19E11BFF03B ft=1 fh=5e1dc8d93e2d8e01 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" sh=34D77A23AA7C7648948E4BFAB31F33F517A785DC ft=1 fh=11cdaad78b073df2 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" sh=D6AE522FF8806F7589D0FD0CC5D70B65B0B5E390 ft=1 fh=1211e94886f9a591 vn="Variante von Win32/Hao123.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" sh=CB32C6498397F3FF760EACD6D2C47D2F00C327DE ft=0 fh=0000000000000000 vn="Variante von Win32/SoftPulse.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 13.zip" sh=C91745949C1C5CBE5674FA64266369051BB197D3 ft=0 fh=0000000000000000 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 6.zip" sh=AF4F21AA9894D6706351C52333C0A6F89E4E0722 ft=0 fh=0000000000000000 vn="Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 8.zip" sh=6A7517133799578512D41CFEA66CC42EEE570ED4 ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 9.zip" sh=AABDF464C1BDA425FF063012C1F96A997E1758AE ft=0 fh=0000000000000000 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-28 190002\Backup files 1.zip" ESETSmartInstaller@High as downloader log: all ok # product=EOS # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.7623 # api_version=3.0.2 # EOSSerial=72bdc318b442a243b9b11a6e79579ee4 # engine=20478 # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2014-10-07 11:17:12 # local_time=2014-10-07 01:17:12 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1031 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode_1='Norton 360' # compatibility_mode=3598 16777213 100 100 1030707 163343128 0 0 # compatibility_mode_1='' # compatibility_mode=5893 16776573 100 94 8016 164311823 0 0 # scanned=69073 # found=25 # cleaned=0 # scan_time=3970 sh=E32ECB71CAA5BA1F62D7E28F6E7D76D226677B01 ft=1 fh=fc7b40d4e32d8af5 vn="Win32/Distromatic.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\search_protect.exe.vir" sh=9D44B14F10FDE6C9D45715517D1B2E193BE6CD2C ft=1 fh=4aa4805c575beef8 vn="Variante von Win32/Distromatic.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Amazon Browser Bar\uninstaller.exe.vir" sh=0FADB783C6C38284E5819BCADED2A1C50503F7AF ft=1 fh=fcdd72b19b62f8d2 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bhelper.dll.vir" sh=CCFCD73F208F834C854E46E6F31DB11AADA5CF08 ft=1 fh=6a366370a714a51b vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\BService\1.1\bservice.exe.vir" sh=58787F33433447F2727A8811B33168C18C28DB32 ft=1 fh=c71c001199b91430 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\NmHost\nmhost.exe.vir" sh=7BB9B28A48C61080F08A506BCE180EC51A3F36A7 ft=1 fh=973e2ab75d54163d vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\cl.exe.vir" sh=9D085ECF4414599A6AE0E0913F41B0C42C0AFE16 ft=1 fh=c71c0011aae3df5f vn="Variante von Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Proxy\pwdg.exe.vir" sh=38822F744246B72AEFA8B3AF625CB63C810771EC ft=1 fh=4dc0d31d5b8edc90 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\updater.exe.vir" sh=5D470FF7475A5B13F7BFA2F1C85A9FCD87E99AA7 ft=1 fh=7a4fd9ef27726362 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Updater\1.7.0.0\updater.exe.vir" sh=558B9F18F39F980BB52F023D2AEFE3522591AAE9 ft=1 fh=44b5e41c0a9f2e66 vn="Win32/AdWare.SmartApps.E Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Bench\Wd\wd.exe.vir" sh=7B1C9D79A789A4AC084770222AE48A2E8C9013E2 ft=1 fh=c71c00111a82f81a vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_187\fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Mobogenie\nengine.dll.vir" sh=B018ADBCA951AC0EB0757AFFD7EAB8FC0228CA91 ft=1 fh=fda9a5748d3eb594 vn="Variante von Win32/Adware.SpeedingUpMyPC.C Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Probit Software\Easy Speed PC\ESPCSmartScan.exe.vir" sh=6F3A3B433459E6773C9FBE8CFB154DB6534EFA86 ft=1 fh=60bff0ff01dbe663 vn="Variante von Win32/InstallCore.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\VideoConverter.exe.vir" sh=4E0EBFDA05108FA6814D132037C9325E6E92435A ft=1 fh=c71c0011e5bdd8ce vn="Variante von Win32/InstallCore.GZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\VideoConverter\Uninstall\__Uninstall_.exe.vir" sh=026727EC7D6B06AA7921A821BC1ADB2D81984D3C ft=1 fh=436f18bcc77206a1 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\upfst_de_103.exe.vir" sh=60BF5B7880EB06270FB4BCCCE6B4A02C8E14D0EC ft=1 fh=f8abc1b1f77880d7 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\majfst_gentlede.exe.vir" sh=76C12DAFEEA5FB67CBEDF9504AD6A2E114527120 ft=1 fh=2cb177d2d9247b6c vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\fst_de_103\Download\setup_recover_fst_de_187.exe.vir" sh=8E6A6992A3C7FEC4000FA1A4D764DD597109E0B5 ft=1 fh=c71c0011cd00713e vn="Win32/NextLive.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Local\genienext\nengine.dll.vir" sh=9F82BB5DC8D4EC6B8B2BB47CB6C329B8AF1C14CE ft=1 fh=c92ed1f3ca58c043 vn="Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Ralph\AppData\Roaming\0D0S1L2Z1P1B\Video Converter Packages\uninstaller.exe.vir" sh=24EACADAF8910146B00A3B6146FAD19E11BFF03B ft=1 fh=5e1dc8d93e2d8e01 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe" sh=34D77A23AA7C7648948E4BFAB31F33F517A785DC ft=1 fh=11cdaad78b073df2 vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe" sh=D6AE522FF8806F7589D0FD0CC5D70B65B0B5E390 ft=1 fh=1211e94886f9a591 vn="Variante von Win32/Hao123.D evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe" sh=E5A3C100D2D0FD94482783AF2B2FF94CDFC9923F ft=1 fh=a0ddd0619a504a2e vn="Variante von Win32/Hao123.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe" sh=CB32C6498397F3FF760EACD6D2C47D2F00C327DE ft=0 fh=0000000000000000 vn="Variante von Win32/SoftPulse.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Ralph\Documents\RALPH-PC\Backup Set 2014-09-21 190005\Backup Files 2014-09-21 190005\Backup files 13.zip" FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 06-10-2014
Ran by Ralph at 2014-10-07 13:26:40
Running from C:\Users\Ralph\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM\...\7-Zip) (Version: - )
Adobe Digital Editions (HKLM\...\Digital Editions) (Version: - )
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
calibre (HKLM\...\{DD649DA2-BBD9-4247-85DD-E04F7C1E8552}) (Version: 1.48.0 - Kovid Goyal)
Camera RAW Plug-In for EPSON Creativity Suite (HKLM\...\{8DAC1AE4-33D1-4A78-8A42-00E09EDECC3E}) (Version: 2.1.0.0 - )
CCleaner (HKLM\...\CCleaner) (Version: 4.15 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.4852 - CDBurnerXP)
CX4300_5500_DX4400 Handbuch (HKLM\...\CX4300_5500_DX4400 Handbuch) (Version: - )
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
EPSON Attach To Email (HKLM\...\InstallShield_{20C45B32-5AB6-46A4-94EF-58950CAF05E5}) (Version: 1.01.0000 - SEIKO EPSON)
EPSON Attach To Email (Version: 1.01.0000 - SEIKO EPSON) Hidden
EPSON Easy Photo Print (HKLM\...\{B66E665A-DF96-4C38-9422-C7F74BC1B4E5}) (Version: 1.4.2.0 - )
EPSON File Manager (HKLM\...\{2EB81825-E9EE-44F4-8F51-1240C3898DC6}) (Version: 1.3.0.0 - )
EPSON Scan (HKLM\...\EPSON Scanner) (Version: - )
EPSON Scan Assistant (HKLM\...\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}) (Version: 1.10.00 - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - SEIKO EPSON Corporation)
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )
FormatFactory 3.2.1.0 (HKLM\...\FormatFactory) (Version: 3.2.1.0 - Free Time)
Fotogalerie (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
IncrediMail (Version: 6.6.0.5288 - IncrediMail) Hidden
IncrediMail 2.5 (HKLM\...\IncrediMail) (Version: 6.6.0.5288 - IncrediMail Ltd.)
iTunes (HKLM\...\{A9B3F8D5-DF4F-462B-81B7-4B69EBEDBC5B}) (Version: 11.2.0.115 - Apple Inc.)
Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Extended DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Movie Maker (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 32.0.3 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
Norton 360 (HKLM\...\N360) (Version: 21.6.0.32 - Symantec Corporation)
NVIDIA 3D Vision Controller-Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.82 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.11.9713 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (HKLM\...\NVIDIAStereo) (Version: 7.17.11.9713 - NVIDIA Corporation)
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Photo Gallery (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Photo Notifier and Animation Creator (HKLM\...\Photo Notifier and Animation Creator) (Version: 1.0.0.1009 - IncrediMail Ltd.)
Photo Notifier and Animation Creator (Version: 1.0.0.1009 - Ihr Firmenname) Hidden
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Spotify (HKCU\...\Spotify) (Version: 0.9.13.24.g5dbb3103 - Spotify AB)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
TrekStor eReaderSuite (HKLM\...\eReaderSuite) (Version: - TrekStor GmbH)
Ulead PhotoImpact 8 (HKLM\...\InstallShield_{F101C58C-15CC-42B3-83D1-536CFB960634}) (Version: 8.0 - Ulead System)
Ulead PhotoImpact 8 (Version: 8.0 - Ulead System) Hidden
UseNeXT (HKLM\...\UseNeXT_is1) (Version: - Tangysoft Ltd.)
UseNeXT by Tangysoft (HKLM\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.)
Vertus Play With Pictures 1.1.4 (HKLM\...\VertusPlayWithPictures) (Version: 1.1.4 - )
Video Converter Packages (HKCU\...\Video Converter Packages) (Version: - ) <==== ATTENTION
Visual Studio C++ 10.0 Runtime (HKLM\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Communications Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Windows Mobile Device Center Driver Update (HKLM\...\{E7044E25-3038-4A76-9064-344AC038043E}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows Mobile-Gerätecenter (HKLM\...\{904CCF62-818D-4675-BC76-D37EB399F917}) (Version: 6.1.6965.0 - Microsoft Corporation)
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16432 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
03-10-2014 13:46:09 Windows Update
04-10-2014 13:26:43 Installed SpyHunter
04-10-2014 16:42:12 Removed SpyHunter
04-10-2014 17:13:15 Norton_Power_Eraser_20141004191311961
04-10-2014 21:52:31 Installed STOPzilla
04-10-2014 22:35:22 Removed STOPzilla
06-10-2014 03:12:55 Windows-Sicherung
07-10-2014 09:02:25 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2014-10-04 23:54 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {56FAB2BD-B5D2-4E2D-B5AD-3492A197C665} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {865D162F-0B46-49BC-A64E-DD2A707AD03A} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton 360\Engine\21.6.0.32\WSCStub.exe [2014-09-21] (Symantec Corporation)
Task: {997B3A28-F930-4A84-B2A2-6DAEAAC3F66B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-26] (Adobe Systems Incorporated)
Task: {CA9D0366-B0F6-4117-8406-4F39AD22877C} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {D4EC5BF7-3C54-4BB3-96DF-4985FD2CCC4C} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files\Norton 360\Engine\21.6.0.32\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {DB34767B-CD39-4C82-A67C-15F1455EC744} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {E8B5A5DB-1873-4E60-B1FA-0CE05E7AFD2B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-06-24] (Piriform Ltd)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-03 15:58 - 2014-09-24 07:09 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-09-11 22:03 - 2014-09-11 22:03 - 16825520 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Windows:nlsPreferences
AlternateDataStreams: C:\ProgramData\Reprise:yhuwxvwhfkxkcqmbzxjuiqjduvsftifh
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION!
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION!
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: EPSON Stylus DX4400 Series => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATICAE.EXE /FU "C:\Windows\TEMP\E_SCB59.tmp" /EF "HKCU"
MSCONFIG\startupreg: eReader Suite => "C:\Program Files\TrekStor\eReaderSuite\TrekStor eReader Suite.exe" /startminimised
MSCONFIG\startupreg: IncrediMail => C:\Program Files\IncrediMail\bin\IncMail.exe /c
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-3046438628-3470693201-1580729714-500 - Administrator - Disabled)
Eileen (S-1-5-21-3046438628-3470693201-1580729714-1004 - Limited - Enabled) => C:\Users\Eileen
Gast (S-1-5-21-3046438628-3470693201-1580729714-501 - Limited - Enabled)
HomeGroupUser$ (S-1-5-21-3046438628-3470693201-1580729714-1002 - Limited - Enabled)
Ralph (S-1-5-21-3046438628-3470693201-1580729714-1001 - Administrator - Enabled) => C:\Users\Ralph
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (10/07/2014 00:06:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/07/2014 00:04:59 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (10/07/2014 10:16:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/06/2014 09:36:53 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Error: (10/06/2014 04:07:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/06/2014 04:06:53 PM) (Source: Service Control Manager) (EventID: 7016) (User: )
Description: Der Dienst "NVIDIA Stereoscopic 3D Driver Service" hat einen ungültigen aktuellen Status gemeldet: 0
Microsoft Office Sessions:
=========================
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 9609
Error: (10/06/2014 05:15:33 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
==================== Memory info ===========================
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 5600+
Percentage of memory in use: 55%
Total physical RAM: 1919.24 MB
Available physical RAM: 844.82 MB
Total Pagefile: 3838.48 MB
Available Pagefile: 2349.29 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.52 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:297.99 GB) (Free:129.52 GB) NTFS
Drive f: (CnMemory) (Fixed) (Total:1863.01 GB) (Free:1471.67 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 2EE32EE2)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: E0717E8E)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 06-10-2014 Ran by Ralph (administrator) on RALPH-PC on 07-10-2014 13:25:39 Running from C:\Users\Ralph\Downloads Loaded Profile: Ralph (Available profiles: Ralph & Eileen) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Spotify Ltd) C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Symantec Corporation) C:\Program Files\Norton 360\Engine\21.6.0.32\n360.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_152.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation) HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\...\Run: [Spotify Web Helper] => C:\Users\Ralph\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-09-18] (Spotify Ltd) HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2014-01-02] (Microsoft Corporation) ShellIconOverlayIdentifiers: [OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ShellIconOverlayIdentifiers: [OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton 360\Engine\21.6.0.32\buShell.dll (Symantec Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton 360\Engine\21.6.0.32\IPS\IPSBHO.DLL (Symantec Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Toolbar: HKCU - No Name - {41564952-412D-5637-4300-7A786E7484D7} - No File Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\21.6.0.32\coIEPlg.dll (Symantec Corporation) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458 FF NewTab: Google FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.) FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=16.4.3522.0110 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\searchplugins\google-maps.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Cliqz Beta - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\Extensions\cliqz@cliqz.com.xpi [2014-10-06] FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-10-07] FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Ralph\AppData\Roaming\Mozilla\Firefox\Profiles\xqrom0l5.default-1405937921458\extensions\cliqz@cliqz.com Chrome: ======= CHR HomePage: Default -> hxxp://www.google.com/ CHR RestoreOnStartup: Default -> "hxxp://www.google.com/" CHR CustomProfile: C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Docs) - C:\Users\Ralph\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-13] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE [113664 2007-01-11] (SEIKO EPSON CORPORATION) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 N360; C:\Program Files\Norton 360\Engine\21.6.0.32\N360.exe [265040 2014-09-21] (Symantec Corporation) R2 nlsX86cc; C:\Windows\system32\nlssrv32.exe [63488 2010-03-11] (Nalpeiron Ltd.) [File not signed] R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BHDrvx86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20141003.001\BHDrvx86.sys [1138392 2014-10-03] (Symantec Corporation) R1 ccSet_N360; C:\Windows\system32\drivers\N360\1506000.020\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [378672 2014-09-09] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [111408 2014-09-09] (Symantec Corporation) R1 IDSVix86; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20141006.001\IDSvix86.sys [476888 2014-08-30] (Symantec Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-10-07] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () R3 NAVENG; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141006.016\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation) R3 NAVEX15; C:\Program Files\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20141006.016\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation) R3 SRTSP; C:\Windows\System32\Drivers\N360\1506000.020\SRTSP.SYS [664792 2014-08-26] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\N360\1506000.020\SRTSPX.SYS [32984 2014-08-26] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\N360\1506000.020\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\N360\1506000.020\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-12-30] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\N360\1506000.020\Ironx86.SYS [209624 2014-08-06] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\N360\1506000.020\SYMNETS.SYS [447704 2014-02-18] (Symantec Corporation) S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S2 sbapifs; system32\DRIVERS\sbapifs.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 10:22 - 2014-10-07 10:22 - 02347384 _____ (ESET) C:\Users\Ralph\Downloads\esetsmartinstaller_deu.exe 2014-10-07 10:22 - 2014-10-07 10:22 - 00000000 ____D () C:\Program Files\ESET 2014-10-06 16:09 - 2014-10-06 16:09 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys 2014-10-06 15:52 - 2014-10-07 12:39 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-10-06 15:51 - 2014-10-06 15:51 - 00001024 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-10-06 15:51 - 2014-10-06 15:51 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2014-10-06 15:51 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-10-06 15:51 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-10-06 15:50 - 2014-10-06 15:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Ralph\Downloads\mbam-setup-2.0.2.1012.exe 2014-10-06 15:43 - 2014-10-06 15:43 - 00000962 _____ () C:\Users\Ralph\Desktop\JRT.txt 2014-10-06 15:40 - 2014-10-06 15:40 - 01705141 _____ (Thisisu) C:\Users\Ralph\Downloads\JRT.exe 2014-10-06 15:40 - 2014-10-06 15:40 - 00000000 ____D () C:\Windows\ERUNT 2014-10-06 14:29 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll 2014-10-06 14:27 - 2014-10-06 14:34 - 00000000 ____D () C:\AdwCleaner 2014-10-06 14:27 - 2014-10-06 14:27 - 01375089 _____ () C:\Users\Ralph\Downloads\AdwCleaner_3.311.exe 2014-10-06 14:15 - 2014-10-06 14:15 - 00001186 _____ () C:\Users\Ralph\Desktop\Revo Uninstaller.lnk 2014-10-06 14:15 - 2014-10-06 14:15 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-10-06 14:14 - 2014-10-06 14:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Ralph\Downloads\revosetup95.exe 2014-10-06 12:28 - 2014-10-06 12:28 - 00041686 _____ () C:\Users\Ralph\Downloads\Shortcut.txt 2014-10-06 12:27 - 2014-10-06 12:28 - 00027095 _____ () C:\Users\Ralph\Downloads\Addition.txt 2014-10-06 12:26 - 2014-10-07 13:26 - 00013136 _____ () C:\Users\Ralph\Downloads\FRST.txt 2014-10-06 12:25 - 2014-10-07 13:25 - 00000000 ____D () C:\FRST 2014-10-06 12:23 - 2014-10-06 12:23 - 01101312 _____ (Farbar) C:\Users\Ralph\Downloads\FRST.exe 2014-10-06 10:38 - 2014-10-06 10:38 - 00380416 _____ () C:\Users\Ralph\Downloads\Gmer-19357.exe 2014-10-06 10:01 - 2014-10-06 10:01 - 00214576 _____ (Trend Micro Inc.) C:\Windows\RegBootClean.exe 2014-10-06 09:55 - 2014-10-06 09:55 - 00260652 _____ () C:\Users\Ralph\AppData\Local\census.cache 2014-10-06 09:54 - 2014-10-06 09:54 - 00120845 _____ () C:\Users\Ralph\AppData\Local\ars.cache 2014-10-06 09:32 - 2014-10-06 09:32 - 00000036 _____ () C:\Users\Ralph\AppData\Local\housecall.guid.cache 2014-10-06 09:32 - 2011-06-21 06:09 - 00200976 _____ (Trend Micro Inc.) C:\Windows\system32\Drivers\tmcomm.sys 2014-10-06 09:31 - 2014-10-06 09:31 - 02002416 _____ (Trend Micro Inc.) C:\Users\Ralph\Downloads\HousecallLauncher.exe 2014-10-04 23:51 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\system32\dhRichClient3.dll 2014-10-04 23:51 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\system32\sqlite36_engine.dll 2014-10-04 23:49 - 2014-10-04 23:49 - 01101648 _____ () C:\Users\Ralph\Downloads\Stopzilla Antivirus - CHIP-Installer.exe 2014-10-04 18:58 - 2014-10-06 06:59 - 00000000 ____D () C:\NPE 2014-10-04 18:55 - 2014-10-04 18:55 - 03077776 ____N (Symantec Corporation) C:\Users\Ralph\Downloads\NPE.exe 2014-10-04 15:26 - 2014-10-04 18:43 - 00000000 ____D () C:\Windows\AF54923662584AC6A0435B5B89C6EB61.TMP 2014-10-04 15:25 - 2014-10-04 15:25 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Ralph\Downloads\SpyHunter-Installer.exe 2014-10-04 15:11 - 2014-10-06 10:34 - 00000472 _____ () C:\Users\Ralph\Downloads\defogger_disable.log 2014-10-04 15:11 - 2014-10-04 15:11 - 00050477 _____ () C:\Users\Ralph\Downloads\Defogger.exe 2014-10-04 15:01 - 2014-10-04 15:01 - 00000000 _____ () C:\Users\Ralph\defogger_reenable 2014-10-03 15:59 - 2014-10-03 15:59 - 00001069 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:59 - 00001081 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2014-10-03 15:58 - 2014-10-03 15:58 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-09-30 10:22 - 2014-10-07 12:06 - 00005446 _____ () C:\Windows\PFRO.log 2014-09-29 09:07 - 2014-10-07 12:06 - 00003752 _____ () C:\Windows\setupact.log 2014-09-29 09:07 - 2014-09-29 09:07 - 00000000 _____ () C:\Windows\setuperr.log 2014-09-25 11:38 - 2014-10-07 10:42 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-09-21 20:11 - 2014-09-21 20:11 - 00000000 ____D () C:\Users\Ralph\Documents\WindowsImageBackup 2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ___RD () C:\Users\Ralph\Documents\RALPH-PC 2014-09-21 10:56 - 2014-10-07 12:10 - 00718553 _____ () C:\Windows\WindowsUpdate.log 2014-09-18 19:14 - 2014-09-19 06:53 - 00000000 ____D () C:\Users\Ralph\AppData\Local\Spotify 2014-09-18 19:14 - 2014-09-18 19:14 - 00001805 _____ () C:\Users\Ralph\Desktop\Spotify.lnk 2014-09-18 19:14 - 2014-09-18 19:14 - 00001791 _____ () C:\Users\Ralph\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk 2014-09-18 19:13 - 2014-09-19 11:34 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\Spotify 2014-09-18 19:06 - 2014-09-18 19:06 - 00136864 _____ (Spotify Ltd) C:\Users\Ralph\Downloads\SpotifySetup.exe 2014-09-14 19:08 - 2014-09-14 19:08 - 00000528 ____R () C:\Users\Ralph\Documents\MediaID.bin 2014-09-10 22:42 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-09-10 22:42 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-09-10 22:42 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-09-10 22:42 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-09-10 22:42 - 2014-08-18 23:57 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-09-10 22:42 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-09-10 22:42 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-09-10 22:42 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-09-10 22:42 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-09-10 22:42 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-09-10 22:42 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-09-10 22:42 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-09-10 22:42 - 2014-08-18 23:36 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-09-10 22:42 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-09-10 22:42 - 2014-08-18 23:30 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-09-10 22:42 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-09-10 22:42 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-09-10 22:42 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-09-10 22:42 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-09-10 22:42 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-09-10 22:42 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-09-10 22:42 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-09-10 22:42 - 2014-08-18 23:08 - 00673792 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-09-10 22:42 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-09-10 22:42 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-09-10 22:42 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-09-10 22:42 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 01059840 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 07:36 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-07 13:03 - 2013-12-29 22:46 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-07 12:14 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-07 12:14 - 2009-07-14 06:34 - 00014960 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-07 12:06 - 2013-12-29 23:18 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-10-07 12:06 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-06 16:07 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\Performance 2014-10-06 15:41 - 2013-12-30 19:46 - 00000000 ____D () C:\Users\Ralph\AppData\Local\CrashDumps 2014-10-06 07:10 - 2014-01-05 20:05 - 00000180 _____ () C:\Users\Ralph\AppData\Roaming\WB.CFG 2014-10-06 07:05 - 2014-01-02 16:20 - 00000000 ____D () C:\Users\Ralph\AppData\Local\NPE 2014-10-04 15:26 - 2014-01-01 20:18 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-10-04 15:01 - 2013-12-29 22:27 - 00000000 ____D () C:\Users\Ralph 2014-10-02 21:37 - 2013-12-30 17:47 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\UseNeXT 2014-10-02 21:31 - 2014-01-13 11:20 - 00000000 ____D () C:\Users\Ralph\Documents\UseNeXT 2014-10-02 20:48 - 2013-12-29 22:31 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-26 07:34 - 2013-12-29 22:46 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-26 07:34 - 2013-12-29 22:46 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-25 14:58 - 2013-12-30 12:14 - 00002201 _____ () C:\Users\Public\Desktop\Norton 360.lnk 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 2014-09-25 14:58 - 2013-12-30 12:14 - 00000000 ____D () C:\Windows\system32\Drivers\N360 2014-09-23 07:26 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public 2014-09-19 15:21 - 2013-12-29 23:35 - 00000000 ____D () C:\Users\Ralph\AppData\Roaming\vlc 2014-09-19 06:55 - 2014-01-13 18:53 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-09-15 09:06 - 2013-12-30 12:41 - 00231568 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-11 20:00 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache 2014-09-11 11:30 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-09-10 22:37 - 2014-01-02 15:56 - 00000000 ____D () C:\Windows\system32\MRT 2014-09-10 22:32 - 2014-01-02 15:56 - 98758480 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-09-10 07:29 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-09-07 18:05 - 2014-08-11 19:29 - 00000000 ____D () C:\Users\Ralph\Documents\Calibre-Bibliothek 2014-09-07 18:01 - 2014-08-11 19:58 - 00000000 ____D () C:\Users\Ralph\Documents\My Digital Editions Some content of TEMP: ==================== C:\Users\Ralph\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 07:22 ==================== End Of Log ============================ --- --- --- |
|
07.10.2014, 13:50
| #2 |
| /// TB-Ausbilder   | Es öffnen sich einach Fenster Win 7 Firefox Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.
__________________Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter "C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-egypt.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-japan.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst-saudi-forf.exe"
"C:\Program Files\FreeTime\FormatFactory\FFModules\Package\BaiDu\hao123inst.exe"
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\.exe: exefile => <===== ATTENTION!
HKU\S-1-5-21-3046438628-3470693201-1580729714-1001\Software\Classes\exefile: <===== ATTENTION!
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Gibts noch Spuren vom Browser Save oder sonstigem ? Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Ansonsten sind die Logs sauber !  Die Reihenfolge ist hier entscheidend.
Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems. Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti-Viren-Programm und zusätzlicher Schutz
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden. Mozilla Firefox
Performance
Was du vermeiden solltest:
Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ |
|
| Themen zu Es öffnen sich einach Fenster Win 7 Firefox |
| autostart, blockiert, browser, button, downloaden, einfach, entfernt, erkennt, fenster, firefox, gestartet, leute, micro, neue, nichts, problem, recovery, sache, sachen, scan, taskleiste, tool, trend, win, öffnen |
Hybrid-Darstellung
