| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Fremde Seiten im BrowserverlaufWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
09.10.2014, 15:31
| #1 |
| |  Fremde Seiten im Browserverlauf Hallo, ich habe gerade festgestellt, dass ich fremde Seiten in meinem Browserverlauf habe, die ich nie besucht habe. Ist das ein virus oder ist da ein Hacker unterwegs? Danke im Voraus |
|
09.10.2014, 16:20
| #2 |
| /// the machine /// TB-Ausbilder    | Fremde Seiten im Browserverlauf hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
10.10.2014, 08:34
| #3 |
| | Fremde Seiten im Browserverlauf Entschuldige bitte aber ich habe keine Ahnung wie ich die FRST.txt hier rein bekomme
__________________ Hab jetz auch Malwarebytes gedownloaded und einen Bedrohungssuchlauf gemacht. FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-10-2014 01 Ran by Jule (administrator) on JULE-PC on 09-10-2014 17:23:55 Running from C:\Users\Jule\Desktop Loaded Profile: Jule (Available profiles: Jule) Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Spotify Ltd) C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Dropbox, Inc.) C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] () HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-09-22] (APN) HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify Web Helper] => C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-01] (Spotify Ltd) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify] => C:\Users\Jule\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-01] (Spotify Ltd) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.) ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE428 BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - No File Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer] 131.188.24.131 FireFox: ======== FF ProfilePath: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Ask.com FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @nitropdf.com/NitroPDF.PrevVerNPR -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-maps.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-10-30] FF Extension: Garmin Communicator - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-25] FF Extension: Cliqz Beta - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\cliqz@cliqz.com.xpi [2014-09-28] FF Extension: Personas Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\personas@christopher.beard.xpi [2011-09-02] FF Extension: Adblock Lite - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{1e9a63ef-84ec-49a4-8d6f-2dd9524e90d0}.xpi [2012-03-17] FF Extension: Adblock Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-04] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-22] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\extensions\cliqz@cliqz.com Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-22] (APN LLC.) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-10-07] (Nitro PDF Software) R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-02-13] (Nitro PDF Software) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-10-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-10-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-10-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-10-02] (G Data Software AG) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-10-02] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-10-09] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-09 17:23 - 2014-10-09 17:24 - 00024451 _____ () C:\Users\Jule\Desktop\FRST.txt 2014-10-09 17:21 - 2014-10-09 17:21 - 02109952 _____ (Farbar) C:\Users\Jule\Desktop\FRST64.exe 2014-10-02 10:28 - 2014-10-02 10:28 - 00001228 _____ () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\I.R.I.S. Resource Center.lnk 2014-10-02 10:11 - 2014-10-02 10:11 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard 2014-10-02 10:10 - 2014-10-02 10:10 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk 2014-10-02 10:09 - 2014-10-09 14:20 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\HpUpdate 2014-10-02 10:09 - 2014-10-02 10:09 - 00003606 _____ () C:\Windows\System32\Tasks\HPCustParticipation HP Officejet Pro 8610 2014-10-02 10:09 - 2014-10-02 10:09 - 00002204 _____ () C:\Users\Public\Desktop\HP Officejet Pro 8610.lnk 2014-10-02 10:09 - 2014-10-02 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP 2014-10-02 10:09 - 2014-03-06 12:51 - 00763912 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM7112.dll 2014-10-02 10:08 - 2014-10-02 10:10 - 00000000 ____D () C:\Program Files (x86)\HP 2014-10-02 10:08 - 2014-10-02 10:08 - 00000000 ____D () C:\ProgramData\HP 2014-10-02 10:07 - 2014-10-02 10:07 - 00000057 _____ () C:\ProgramData\Ament.ini 2014-10-02 10:06 - 2014-10-02 10:11 - 00000000 ____D () C:\Users\Jule\AppData\Local\HP 2014-10-02 08:20 - 2014-10-02 08:20 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-10-02 08:20 - 2014-10-02 08:20 - 00002050 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk 2014-10-02 08:20 - 2014-10-02 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE 2014-10-02 08:19 - 2014-10-02 08:19 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00000779 _____ () C:\Users\Jule\AppData\Roaming\gdscan.log 2014-10-02 08:19 - 2014-10-02 08:19 - 00000000 _____ () C:\Users\Jule\AppData\Roaming\gdfw.log 2014-10-02 08:17 - 2014-10-09 16:20 - 00000000 ____D () C:\ProgramData\G Data 2014-10-02 08:17 - 2014-10-02 08:17 - 00000000 ____D () C:\Program Files (x86)\G Data 2014-10-02 07:46 - 2014-10-02 07:47 - 00227096 _____ () C:\Users\Jule\Downloads\avira_registry_cleaner_de.exe 2014-10-02 07:37 - 2014-10-02 07:37 - 00003100 _____ () C:\Windows\System32\Tasks\{661E46F1-5255-4D41-8063-D32A9DF64FDF} 2014-09-29 21:32 - 2014-09-29 21:33 - 00000000 ____D () C:\a990cb17e3e348b6d837 2014-09-29 14:30 - 2014-09-29 14:30 - 00000000 ____D () C:\ProgramData\APN 2014-09-29 12:43 - 2014-09-29 12:43 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-09-29 12:17 - 2014-09-29 12:17 - 00000000 ____D () C:\Windows\ERUNT 2014-09-29 12:01 - 2014-09-29 12:03 - 00000000 ____D () C:\AdwCleaner 2014-09-28 19:35 - 2014-09-28 19:35 - 00019522 _____ () C:\ComboFix.txt 2014-09-28 18:59 - 2014-09-28 19:35 - 00000000 ____D () C:\Qoobox 2014-09-28 18:59 - 2014-09-28 19:12 - 00000000 ____D () C:\Windows\erdnt 2014-09-28 18:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-09-28 18:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-09-28 18:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-09-28 18:49 - 2014-10-09 17:24 - 00000000 ____D () C:\FRST 2014-09-27 21:33 - 2014-09-27 21:33 - 00791193 _____ () C:\Users\Jule\Downloads\Bootice_1.3.2.1.zip 2014-09-27 21:33 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-09-27 21:33 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-09-27 21:30 - 2014-09-27 21:30 - 01101648 _____ () C:\Users\Jule\Downloads\Bootice - CHIP-Installer.exe 2014-09-27 20:36 - 2014-09-27 20:36 - 00291208 _____ () C:\Windows\Minidump\092714-88218-01.dmp 2014-09-27 16:34 - 2014-09-27 16:44 - 00050688 _____ () C:\Users\Jule\Desktop\6646_LAA_Nowak_Julia.xls 2014-09-26 13:29 - 2014-09-26 13:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-09-26 11:01 - 2014-10-09 15:10 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-26 11:01 - 2014-09-29 12:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-26 11:01 - 2014-09-29 12:29 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-26 11:01 - 2014-09-26 11:01 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-26 11:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-26 11:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-26 11:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-26 11:00 - 2014-09-26 11:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-24 13:32 - 2014-09-24 13:32 - 00000000 ____D () C:\8749dcf7cdf5e92b477860fd4122b5de 2014-09-23 18:57 - 2014-10-06 19:32 - 00000000 ____D () C:\Users\Jule\Desktop\Seminar 2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ____D () C:\ProgramData\Samsung 2014-09-20 22:22 - 2014-09-20 22:22 - 00000000 ____D () C:\f6e802fad9a09378400a1e560959fe 2014-09-20 15:06 - 2014-09-20 15:06 - 15796788 _____ () C:\Users\Jule\Downloads\9.1_ 17. Januar Philosophieren mit Kindern.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 05416455 _____ () C:\Users\Jule\Downloads\9._ 10. Januar 2012 Medienerziehung.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 04668869 _____ () C:\Users\Jule\Downloads\9.2_ 24. Januar Gesundheitsforderung_ Sexualerziehung.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 00000244 _____ () C:\Users\Jule\Downloads\8._ 20. Dezember Reflexion, Ruckblick (Puffer).zip 2014-09-20 15:05 - 2014-09-20 15:06 - 04202529 _____ () C:\Users\Jule\Downloads\9.3._ 31. Januar Interkulturelles Lernen.zip 2014-09-20 15:04 - 2014-09-20 15:04 - 00000218 _____ () C:\Users\Jule\Downloads\9.4._ 07. Februar Zusammenfassung.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 08505786 _____ () C:\Users\Jule\Downloads\4._ 22. November Politisches_ Demokratisches Lernen.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 03251653 _____ () C:\Users\Jule\Downloads\6._ 06. Dezember Bildung zur Nachhaltigkeit.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 01346867 _____ () C:\Users\Jule\Downloads\5._ 29. November Soziales Lernen.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 01073266 _____ () C:\Users\Jule\Downloads\7._ 13. Dezember Ethisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 15:00 - 10783159 _____ () C:\Users\Jule\Downloads\3._ 15. November Geographisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 14:59 - 03052689 _____ () C:\Users\Jule\Downloads\2._ 08. November Historisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 14:59 - 00000234 _____ () C:\Users\Jule\Downloads\1._ 25. Oktober - Theoretische Einfuhrung.zip 2014-09-20 14:57 - 2014-09-20 14:57 - 01344625 _____ () C:\Users\Jule\Downloads\Formalia (Plan, Literatur usw.).zip 2014-09-20 14:53 - 2014-09-20 14:54 - 44488710 _____ () C:\Users\Jule\Downloads\Sitzungen, Zusammenfassung, Handouts.zip 2014-09-20 14:53 - 2014-09-20 14:53 - 00362659 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen)(1).zip 2014-09-20 14:52 - 2014-09-20 14:52 - 00276979 _____ () C:\Users\Jule\Downloads\Filme im BU II.zip 2014-09-20 14:49 - 2014-09-20 14:50 - 15324822 _____ () C:\Users\Jule\Downloads\Arbeitsblatter und Prasentationen_Kurs Reimann.zip 2014-09-20 14:49 - 2014-09-20 14:50 - 13572401 _____ () C:\Users\Jule\Downloads\Alle Arbeitsblatter Kurs Reitschert - Kopie.zip 2014-09-20 14:49 - 2014-09-20 14:49 - 00523078 _____ () C:\Users\Jule\Downloads\Beispielhafte Arbeitsblatter - Kopie.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 16603060 _____ () C:\Users\Jule\Downloads\Sitzung _Mach-Bar-Tour_.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 04309533 _____ () C:\Users\Jule\Downloads\Sitzung _Klimawandel vor Gericht_.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 00393124 _____ () C:\Users\Jule\Downloads\Sitzung _Zukunftswerkstatt_.zip 2014-09-20 14:43 - 2014-09-20 14:44 - 21095987 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__Olli Ohrwurm.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 06806183 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__BzGA.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 01881604 _____ () C:\Users\Jule\Downloads\Sitzung _BNE in der Grundschule_.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 00446229 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 02238293 _____ () C:\Users\Jule\Downloads\Sitzung _Bewertungskompetenz-Planspiele_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 01100550 _____ () C:\Users\Jule\Downloads\Sitzung _Bioethik und Bewertungskompetenz_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 00456876 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 03124946 _____ () C:\Users\Jule\Downloads\Lehrversuche(8).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 02135274 _____ () C:\Users\Jule\Downloads\Lehrversuche(9).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 01311036 _____ () C:\Users\Jule\Downloads\Lehrversuche(12).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 00798977 _____ () C:\Users\Jule\Downloads\Lehrversuche(10).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 00598698 _____ () C:\Users\Jule\Downloads\Lehrversuche(11).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 04798931 _____ () C:\Users\Jule\Downloads\Lehrversuche(4).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 03076604 _____ () C:\Users\Jule\Downloads\Lehrversuche(6).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 01114637 _____ () C:\Users\Jule\Downloads\Lehrversuche(5).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 00638437 _____ () C:\Users\Jule\Downloads\Lehrversuche(7).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 00399719 _____ () C:\Users\Jule\Downloads\Lehrversuche(3).zip 2014-09-20 14:25 - 2014-09-20 14:25 - 00524065 _____ () C:\Users\Jule\Downloads\Lehrversuche(2).zip 2014-09-20 14:19 - 2014-09-20 14:19 - 04053469 _____ () C:\Users\Jule\Downloads\Lehrversuche(1).zip 2014-09-20 14:14 - 2014-09-20 14:15 - 02722777 _____ () C:\Users\Jule\Downloads\Lehrversuche.zip 2014-09-17 19:13 - 2014-09-21 17:58 - 00000000 ____D () C:\Users\Jule\Desktop\Eigene UV´s 2014-09-16 22:34 - 2014-09-20 15:09 - 00000000 ____D () C:\Users\Jule\Desktop\Unterrichtsmaterialien 2014-09-13 21:25 - 2014-09-13 22:01 - 2151001324 _____ () C:\Users\Jule\Downloads\HSU.zip 2014-09-13 18:35 - 2014-09-05 04:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-13 18:35 - 2014-09-05 03:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-13 18:15 - 2014-09-20 13:47 - 00000000 ___RD () C:\Users\Jule\Desktop\Referendariat GS OPF 2014-2016 ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-09 17:23 - 2011-09-02 17:02 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Skype 2014-10-09 16:44 - 2011-04-19 18:25 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-09 16:25 - 2010-09-20 02:07 - 01740192 _____ () C:\Windows\WindowsUpdate.log 2014-10-09 14:24 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-09 14:24 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-09 14:18 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Spotify 2014-10-09 14:16 - 2013-05-07 11:21 - 00000000 ___RD () C:\Users\Jule\Dropbox 2014-10-09 14:16 - 2013-05-07 11:18 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Dropbox 2014-10-09 14:15 - 2011-04-19 18:25 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-09 14:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-09 14:14 - 2009-07-14 06:51 - 00183571 _____ () C:\Windows\setupact.log 2014-10-02 14:33 - 2010-09-20 02:04 - 00170204 _____ () C:\Windows\PFRO.log 2014-10-02 10:26 - 2013-05-31 20:30 - 00052224 _____ () C:\Users\Jule\Documents\Write1.aww 2014-10-02 10:26 - 2011-05-22 08:37 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\CorelHomeOffice 2014-10-02 10:07 - 2013-12-25 14:40 - 00000000 ____D () C:\Program Files\HP 2014-10-02 08:18 - 2010-09-20 02:24 - 00006804 _____ () C:\Windows\DPINST.LOG 2014-10-02 08:08 - 2013-11-25 10:20 - 00000000 ____D () C:\ProgramData\Avira 2014-10-01 12:05 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Local\Spotify 2014-09-29 12:44 - 2010-09-20 11:59 - 02982088 _____ () C:\Windows\system32\perfh007.dat 2014-09-29 12:44 - 2010-09-20 11:59 - 00876576 _____ () C:\Windows\system32\perfc007.dat 2014-09-29 12:44 - 2009-07-14 07:13 - 00005438 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-28 19:32 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-09-28 19:14 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-09-28 19:10 - 2011-04-17 11:00 - 00000000 ____D () C:\Users\Jule 2014-09-27 20:36 - 2011-08-16 23:16 - 00000000 ____D () C:\Windows\Minidump 2014-09-27 20:35 - 2011-08-16 23:16 - 471519071 _____ () C:\Windows\MEMORY.DMP 2014-09-27 20:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins 2014-09-25 20:23 - 2012-05-21 00:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-09-25 18:25 - 2014-05-14 16:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-09-21 21:55 - 2011-04-17 11:01 - 00116584 _____ () C:\Users\Jule\AppData\Local\GDIPFONTCACHEV1.DAT 2014-09-21 21:55 - 2009-07-14 06:45 - 00437784 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-21 19:31 - 2012-10-28 22:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\SoftGrid Client 2014-09-20 14:07 - 2011-11-28 17:28 - 00000000 ____D () C:\Users\Jule\Documents\Uni 2014-09-20 14:05 - 2014-04-07 15:13 - 00000000 ____D () C:\Users\Jule\Desktop\Mama Geb 2014-09-20 13:03 - 2013-05-07 11:21 - 00001017 _____ () C:\Users\Jule\Desktop\Dropbox.lnk 2014-09-20 13:03 - 2013-05-07 11:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-09-15 09:06 - 2011-05-02 20:54 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 22:11 - 2014-07-10 18:39 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-13 22:11 - 2013-02-27 11:01 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-13 18:08 - 2011-09-02 17:02 - 00000000 ____D () C:\ProgramData\Skype 2014-09-10 18:56 - 2013-03-13 13:53 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-10 18:56 - 2013-03-13 13:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-09-09 11:45 - 2013-03-13 13:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight Some content of TEMP: ==================== C:\Users\Jule\AppData\Local\Temp\avgnt.exe C:\Users\Jule\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcahqbw.dll C:\Users\Jule\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 20:09 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-10-2014 01 Ran by Jule (administrator) on JULE-PC on 09-10-2014 17:23:55 Running from C:\Users\Jule\Desktop Loaded Profile: Jule (Available profiles: Jule) Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe (Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe (Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Spotify Ltd) C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Dropbox, Inc.) C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated) HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation) HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.) HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] () HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-09-22] (APN) HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify Web Helper] => C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-01] (Spotify Ltd) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify] => C:\Users\Jule\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-01] (Spotify Ltd) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.) HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.) ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE428 BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - No File Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer] 131.188.24.131 FireFox: ======== FF ProfilePath: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default FF DefaultSearchEngine: Google FF SearchEngineOrder.1: Ask.com FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll () FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @nitropdf.com/NitroPDF.PrevVerNPR -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-images.xml FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-maps.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-10-30] FF Extension: Garmin Communicator - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-25] FF Extension: Cliqz Beta - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\cliqz@cliqz.com.xpi [2014-09-28] FF Extension: Personas Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\personas@christopher.beard.xpi [2011-09-02] FF Extension: Adblock Lite - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{1e9a63ef-84ec-49a4-8d6f-2dd9524e90d0}.xpi [2012-03-17] FF Extension: Adblock Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-04] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-22] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\extensions\cliqz@cliqz.com Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-22] (APN LLC.) R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG) R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG) R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG) R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG) R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.) R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-10-07] (Nitro PDF Software) R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-02-13] (Nitro PDF Software) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-10-02] (G Data Software AG) R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-10-02] (G Data Software AG) R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-10-02] (G Data Software AG) R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-10-02] (G Data Software AG) R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-10-02] (G Data Software AG) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-10-09] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-09 17:23 - 2014-10-09 17:24 - 00024451 _____ () C:\Users\Jule\Desktop\FRST.txt 2014-10-09 17:21 - 2014-10-09 17:21 - 02109952 _____ (Farbar) C:\Users\Jule\Desktop\FRST64.exe 2014-10-02 10:28 - 2014-10-02 10:28 - 00001228 _____ () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\I.R.I.S. Resource Center.lnk 2014-10-02 10:11 - 2014-10-02 10:11 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard 2014-10-02 10:10 - 2014-10-02 10:10 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk 2014-10-02 10:09 - 2014-10-09 14:20 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\HpUpdate 2014-10-02 10:09 - 2014-10-02 10:09 - 00003606 _____ () C:\Windows\System32\Tasks\HPCustParticipation HP Officejet Pro 8610 2014-10-02 10:09 - 2014-10-02 10:09 - 00002204 _____ () C:\Users\Public\Desktop\HP Officejet Pro 8610.lnk 2014-10-02 10:09 - 2014-10-02 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP 2014-10-02 10:09 - 2014-03-06 12:51 - 00763912 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM7112.dll 2014-10-02 10:08 - 2014-10-02 10:10 - 00000000 ____D () C:\Program Files (x86)\HP 2014-10-02 10:08 - 2014-10-02 10:08 - 00000000 ____D () C:\ProgramData\HP 2014-10-02 10:07 - 2014-10-02 10:07 - 00000057 _____ () C:\ProgramData\Ament.ini 2014-10-02 10:06 - 2014-10-02 10:11 - 00000000 ____D () C:\Users\Jule\AppData\Local\HP 2014-10-02 08:20 - 2014-10-02 08:20 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys 2014-10-02 08:20 - 2014-10-02 08:20 - 00002050 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk 2014-10-02 08:20 - 2014-10-02 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE 2014-10-02 08:19 - 2014-10-02 08:19 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys 2014-10-02 08:19 - 2014-10-02 08:19 - 00000779 _____ () C:\Users\Jule\AppData\Roaming\gdscan.log 2014-10-02 08:19 - 2014-10-02 08:19 - 00000000 _____ () C:\Users\Jule\AppData\Roaming\gdfw.log 2014-10-02 08:17 - 2014-10-09 16:20 - 00000000 ____D () C:\ProgramData\G Data 2014-10-02 08:17 - 2014-10-02 08:17 - 00000000 ____D () C:\Program Files (x86)\G Data 2014-10-02 07:46 - 2014-10-02 07:47 - 00227096 _____ () C:\Users\Jule\Downloads\avira_registry_cleaner_de.exe 2014-10-02 07:37 - 2014-10-02 07:37 - 00003100 _____ () C:\Windows\System32\Tasks\{661E46F1-5255-4D41-8063-D32A9DF64FDF} 2014-09-29 21:32 - 2014-09-29 21:33 - 00000000 ____D () C:\a990cb17e3e348b6d837 2014-09-29 14:30 - 2014-09-29 14:30 - 00000000 ____D () C:\ProgramData\APN 2014-09-29 12:43 - 2014-09-29 12:43 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-09-29 12:17 - 2014-09-29 12:17 - 00000000 ____D () C:\Windows\ERUNT 2014-09-29 12:01 - 2014-09-29 12:03 - 00000000 ____D () C:\AdwCleaner 2014-09-28 19:35 - 2014-09-28 19:35 - 00019522 _____ () C:\ComboFix.txt 2014-09-28 18:59 - 2014-09-28 19:35 - 00000000 ____D () C:\Qoobox 2014-09-28 18:59 - 2014-09-28 19:12 - 00000000 ____D () C:\Windows\erdnt 2014-09-28 18:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-09-28 18:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-09-28 18:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe 2014-09-28 18:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe 2014-09-28 18:49 - 2014-10-09 17:24 - 00000000 ____D () C:\FRST 2014-09-27 21:33 - 2014-09-27 21:33 - 00791193 _____ () C:\Users\Jule\Downloads\Bootice_1.3.2.1.zip 2014-09-27 21:33 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-09-27 21:33 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-09-27 21:30 - 2014-09-27 21:30 - 01101648 _____ () C:\Users\Jule\Downloads\Bootice - CHIP-Installer.exe 2014-09-27 20:36 - 2014-09-27 20:36 - 00291208 _____ () C:\Windows\Minidump\092714-88218-01.dmp 2014-09-27 16:34 - 2014-09-27 16:44 - 00050688 _____ () C:\Users\Jule\Desktop\6646_LAA_Nowak_Julia.xls 2014-09-26 13:29 - 2014-09-26 13:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(1).exe 2014-09-26 11:01 - 2014-10-09 15:10 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-09-26 11:01 - 2014-09-29 12:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-09-26 11:01 - 2014-09-29 12:29 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-09-26 11:01 - 2014-09-26 11:01 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-09-26 11:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-09-26 11:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-09-26 11:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-09-26 11:00 - 2014-09-26 11:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012.exe 2014-09-24 13:32 - 2014-09-24 13:32 - 00000000 ____D () C:\8749dcf7cdf5e92b477860fd4122b5de 2014-09-23 18:57 - 2014-10-06 19:32 - 00000000 ____D () C:\Users\Jule\Desktop\Seminar 2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ____D () C:\ProgramData\Samsung 2014-09-20 22:22 - 2014-09-20 22:22 - 00000000 ____D () C:\f6e802fad9a09378400a1e560959fe 2014-09-20 15:06 - 2014-09-20 15:06 - 15796788 _____ () C:\Users\Jule\Downloads\9.1_ 17. Januar Philosophieren mit Kindern.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 05416455 _____ () C:\Users\Jule\Downloads\9._ 10. Januar 2012 Medienerziehung.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 04668869 _____ () C:\Users\Jule\Downloads\9.2_ 24. Januar Gesundheitsforderung_ Sexualerziehung.zip 2014-09-20 15:06 - 2014-09-20 15:06 - 00000244 _____ () C:\Users\Jule\Downloads\8._ 20. Dezember Reflexion, Ruckblick (Puffer).zip 2014-09-20 15:05 - 2014-09-20 15:06 - 04202529 _____ () C:\Users\Jule\Downloads\9.3._ 31. Januar Interkulturelles Lernen.zip 2014-09-20 15:04 - 2014-09-20 15:04 - 00000218 _____ () C:\Users\Jule\Downloads\9.4._ 07. Februar Zusammenfassung.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 08505786 _____ () C:\Users\Jule\Downloads\4._ 22. November Politisches_ Demokratisches Lernen.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 03251653 _____ () C:\Users\Jule\Downloads\6._ 06. Dezember Bildung zur Nachhaltigkeit.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 01346867 _____ () C:\Users\Jule\Downloads\5._ 29. November Soziales Lernen.zip 2014-09-20 15:00 - 2014-09-20 15:00 - 01073266 _____ () C:\Users\Jule\Downloads\7._ 13. Dezember Ethisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 15:00 - 10783159 _____ () C:\Users\Jule\Downloads\3._ 15. November Geographisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 14:59 - 03052689 _____ () C:\Users\Jule\Downloads\2._ 08. November Historisches Lernen.zip 2014-09-20 14:59 - 2014-09-20 14:59 - 00000234 _____ () C:\Users\Jule\Downloads\1._ 25. Oktober - Theoretische Einfuhrung.zip 2014-09-20 14:57 - 2014-09-20 14:57 - 01344625 _____ () C:\Users\Jule\Downloads\Formalia (Plan, Literatur usw.).zip 2014-09-20 14:53 - 2014-09-20 14:54 - 44488710 _____ () C:\Users\Jule\Downloads\Sitzungen, Zusammenfassung, Handouts.zip 2014-09-20 14:53 - 2014-09-20 14:53 - 00362659 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen)(1).zip 2014-09-20 14:52 - 2014-09-20 14:52 - 00276979 _____ () C:\Users\Jule\Downloads\Filme im BU II.zip 2014-09-20 14:49 - 2014-09-20 14:50 - 15324822 _____ () C:\Users\Jule\Downloads\Arbeitsblatter und Prasentationen_Kurs Reimann.zip 2014-09-20 14:49 - 2014-09-20 14:50 - 13572401 _____ () C:\Users\Jule\Downloads\Alle Arbeitsblatter Kurs Reitschert - Kopie.zip 2014-09-20 14:49 - 2014-09-20 14:49 - 00523078 _____ () C:\Users\Jule\Downloads\Beispielhafte Arbeitsblatter - Kopie.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 16603060 _____ () C:\Users\Jule\Downloads\Sitzung _Mach-Bar-Tour_.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 04309533 _____ () C:\Users\Jule\Downloads\Sitzung _Klimawandel vor Gericht_.zip 2014-09-20 14:44 - 2014-09-20 14:44 - 00393124 _____ () C:\Users\Jule\Downloads\Sitzung _Zukunftswerkstatt_.zip 2014-09-20 14:43 - 2014-09-20 14:44 - 21095987 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__Olli Ohrwurm.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 06806183 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__BzGA.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 01881604 _____ () C:\Users\Jule\Downloads\Sitzung _BNE in der Grundschule_.zip 2014-09-20 14:43 - 2014-09-20 14:43 - 00446229 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 02238293 _____ () C:\Users\Jule\Downloads\Sitzung _Bewertungskompetenz-Planspiele_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 01100550 _____ () C:\Users\Jule\Downloads\Sitzung _Bioethik und Bewertungskompetenz_.zip 2014-09-20 14:41 - 2014-09-20 14:41 - 00456876 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 03124946 _____ () C:\Users\Jule\Downloads\Lehrversuche(8).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 02135274 _____ () C:\Users\Jule\Downloads\Lehrversuche(9).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 01311036 _____ () C:\Users\Jule\Downloads\Lehrversuche(12).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 00798977 _____ () C:\Users\Jule\Downloads\Lehrversuche(10).zip 2014-09-20 14:32 - 2014-09-20 14:32 - 00598698 _____ () C:\Users\Jule\Downloads\Lehrversuche(11).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 04798931 _____ () C:\Users\Jule\Downloads\Lehrversuche(4).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 03076604 _____ () C:\Users\Jule\Downloads\Lehrversuche(6).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 01114637 _____ () C:\Users\Jule\Downloads\Lehrversuche(5).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 00638437 _____ () C:\Users\Jule\Downloads\Lehrversuche(7).zip 2014-09-20 14:26 - 2014-09-20 14:26 - 00399719 _____ () C:\Users\Jule\Downloads\Lehrversuche(3).zip 2014-09-20 14:25 - 2014-09-20 14:25 - 00524065 _____ () C:\Users\Jule\Downloads\Lehrversuche(2).zip 2014-09-20 14:19 - 2014-09-20 14:19 - 04053469 _____ () C:\Users\Jule\Downloads\Lehrversuche(1).zip 2014-09-20 14:14 - 2014-09-20 14:15 - 02722777 _____ () C:\Users\Jule\Downloads\Lehrversuche.zip 2014-09-17 19:13 - 2014-09-21 17:58 - 00000000 ____D () C:\Users\Jule\Desktop\Eigene UV´s 2014-09-16 22:34 - 2014-09-20 15:09 - 00000000 ____D () C:\Users\Jule\Desktop\Unterrichtsmaterialien 2014-09-13 21:25 - 2014-09-13 22:01 - 2151001324 _____ () C:\Users\Jule\Downloads\HSU.zip 2014-09-13 18:35 - 2014-09-05 04:01 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-13 18:35 - 2014-09-05 03:55 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-13 18:15 - 2014-09-20 13:47 - 00000000 ___RD () C:\Users\Jule\Desktop\Referendariat GS OPF 2014-2016 ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-09 17:23 - 2011-09-02 17:02 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Skype 2014-10-09 16:44 - 2011-04-19 18:25 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-09 16:25 - 2010-09-20 02:07 - 01740192 _____ () C:\Windows\WindowsUpdate.log 2014-10-09 14:24 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-09 14:24 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-09 14:18 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Spotify 2014-10-09 14:16 - 2013-05-07 11:21 - 00000000 ___RD () C:\Users\Jule\Dropbox 2014-10-09 14:16 - 2013-05-07 11:18 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Dropbox 2014-10-09 14:15 - 2011-04-19 18:25 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-09 14:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-09 14:14 - 2009-07-14 06:51 - 00183571 _____ () C:\Windows\setupact.log 2014-10-02 14:33 - 2010-09-20 02:04 - 00170204 _____ () C:\Windows\PFRO.log 2014-10-02 10:26 - 2013-05-31 20:30 - 00052224 _____ () C:\Users\Jule\Documents\Write1.aww 2014-10-02 10:26 - 2011-05-22 08:37 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\CorelHomeOffice 2014-10-02 10:07 - 2013-12-25 14:40 - 00000000 ____D () C:\Program Files\HP 2014-10-02 08:18 - 2010-09-20 02:24 - 00006804 _____ () C:\Windows\DPINST.LOG 2014-10-02 08:08 - 2013-11-25 10:20 - 00000000 ____D () C:\ProgramData\Avira 2014-10-01 12:05 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Local\Spotify 2014-09-29 12:44 - 2010-09-20 11:59 - 02982088 _____ () C:\Windows\system32\perfh007.dat 2014-09-29 12:44 - 2010-09-20 11:59 - 00876576 _____ () C:\Windows\system32\perfc007.dat 2014-09-29 12:44 - 2009-07-14 07:13 - 00005438 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-28 19:32 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini 2014-09-28 19:14 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default 2014-09-28 19:10 - 2011-04-17 11:00 - 00000000 ____D () C:\Users\Jule 2014-09-27 20:36 - 2011-08-16 23:16 - 00000000 ____D () C:\Windows\Minidump 2014-09-27 20:35 - 2011-08-16 23:16 - 471519071 _____ () C:\Windows\MEMORY.DMP 2014-09-27 20:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins 2014-09-25 20:23 - 2012-05-21 00:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-09-25 18:25 - 2014-05-14 16:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-09-21 21:55 - 2011-04-17 11:01 - 00116584 _____ () C:\Users\Jule\AppData\Local\GDIPFONTCACHEV1.DAT 2014-09-21 21:55 - 2009-07-14 06:45 - 00437784 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-09-21 19:31 - 2012-10-28 22:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\SoftGrid Client 2014-09-20 14:07 - 2011-11-28 17:28 - 00000000 ____D () C:\Users\Jule\Documents\Uni 2014-09-20 14:05 - 2014-04-07 15:13 - 00000000 ____D () C:\Users\Jule\Desktop\Mama Geb 2014-09-20 13:03 - 2013-05-07 11:21 - 00001017 _____ () C:\Users\Jule\Desktop\Dropbox.lnk 2014-09-20 13:03 - 2013-05-07 11:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox 2014-09-15 09:06 - 2011-05-02 20:54 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-09-13 22:11 - 2014-07-10 18:39 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-13 22:11 - 2013-02-27 11:01 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-09-13 18:08 - 2011-09-02 17:02 - 00000000 ____D () C:\ProgramData\Skype 2014-09-10 18:56 - 2013-03-13 13:53 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-09-10 18:56 - 2013-03-13 13:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-09-09 11:45 - 2013-03-13 13:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight Some content of TEMP: ==================== C:\Users\Jule\AppData\Local\Temp\avgnt.exe C:\Users\Jule\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcahqbw.dll C:\Users\Jule\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-06 20:09 ==================== End Of Log ============================ --- --- --- --- --- --- Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 09.10.2014 Suchlauf-Zeit: 21:08:08 Logdatei: malware.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.10.09.09 Rootkit Datenbank: v2014.10.08.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 CPU: x64 Dateisystem: NTFS Benutzer: Jule Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 333426 Verstrichene Zeit: 15 Min, 55 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) |
|
10.10.2014, 19:27
| #4 |
| /// the machine /// TB-Ausbilder | Fremde Seiten im Browserverlauf Addition.txt fehlt noch
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.10.2014, 15:41
| #5 |
| | Fremde Seiten im BrowserverlaufCode:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-10-2014 01
Ran by Jule at 2014-10-09 17:25:42
Running from C:\Users\Jule\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G Data InternetSecurity CBE (Enabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G Data InternetSecurity CBE (Enabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G Data Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.68 - NewTech Infosystems)
Acer Crystal Eye webcam (HKLM-x32\...\{51F026FA-5146-4232-A8BA-1364740BD053}) (Version: 1.0.4.0 - Liteon)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 5.00.3005 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3013 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1) (Version: 6.1.0.9 - Oberon Media, Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.03.3003 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0707.2010 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3001 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.1.53.64 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.146 - Adobe Systems Incorporated)
Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Airport Mania First Flight (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}) (Version: - Oberon Media)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version: - Oberon Media)
Ask Shopping Toolbar (HKLM-x32\...\{4F524A00-6A76-A76A-76A7-A758B70C1101}) (Version: 12.17.1.73 - APN, LLC) <==== ATTENTION
Backup Manager Basic (x32 Version: 2.0.0.68 - NewTech Infosystems) Hidden
Broadcom Gigabit NetLink Controller (HKLM\...\{A84DB02B-9C2B-4272-9D2D-A80E00A56513}) (Version: 14.0.2.3 - Broadcom Corporation)
Cake Mania (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}) (Version: - Oberon Media)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.22 - Cliqz.com)
Corel Home Office 5.0.36 (HKLM-x32\...\{080FE95E-5A89-4A54-BAAA-D769971B7C2D}) (Version: 5 - Corel)
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.2829.50 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.2829.50 - CyberLink Corp.) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version: - Oberon Media)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
eBay Worldwide (HKLM-x32\...\{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}) (Version: 2.1.0901 - OEM)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version: - Oberon Media)
G Data InternetSecurity CBE (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.1.2 - G Data Software AG)
Galapago (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}) (Version: - Oberon Media)
GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version: - Oberon Media)
HP Officejet Pro 8610 - Grundlegende Software für das Gerät (HKLM\...\{F6EC89A8-5C2B-4C87-B296-A4AAB473DA1A}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
HP Officejet Pro 8610 Hilfe (HKLM-x32\...\{2466D8D5-4856-4492-BDEF-48A640F58866}) (Version: 32.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3003 - Acer Incorporated)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022F0}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216029FF}) (Version: 6.0.290 - Oracle)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 4.0.12 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version: - Oberon Media)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MyWinLocker (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}) (Version: 3.1.212.0 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 3.1.212.0 - Egis Technology Inc.) Hidden
Nitro Pro 9 (HKLM-x32\...\{fd7da6ee-c5c8-407b-8705-aea045971c9c}) (Version: 9.0.2.37 - Nitro)
Nitro Pro 9 (Version: 9.0.2.37 - Nitro) Hidden
Nitro Reader 3 (HKLM\...\{0BE7C451-4741-4154-9633-830019ACFD39}) (Version: 3.5.0.25 - Nitro)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.8928 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.8928 - NTI Corporation) Hidden
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5903 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Poker Pop (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111355427}) (Version: - Oberon Media)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6141 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30122 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Shredder (Version: 2.0.8.3 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.3 - Egis Technology Inc.) Hidden
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Spin & Win (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110300453}) (Version: - Oberon Media)
Spotify (HKCU\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
Studie zur Verbesserung von HP Officejet Pro 8610 (HKLM\...\{63DE3105-A22B-426E-9565-63D1DFBE5A8A}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.19.0 - Synaptics Incorporated)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 1.0.3 (HKLM-x32\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3002 - Acer Incorporated)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinHTTrack Website Copier 3.46-1 (HKLM-x32\...\WinHTTrack Website Copier_is1) (Version: 3.46.1 - HTTrack)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-908798351-3549208136-64478539-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
29-09-2014 16:50:59 Windows Update
29-09-2014 19:30:39 Windows Update
30-09-2014 21:02:46 Windows Update
02-10-2014 05:33:48 Windows Update
02-10-2014 10:58:28 Windows Update
04-10-2014 07:55:57 Windows Update
05-10-2014 13:51:00 Windows Update
05-10-2014 20:41:06 Windows Update
06-10-2014 20:53:58 Windows Update
07-10-2014 21:26:22 Windows Update
08-10-2014 16:35:46 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-09-28 19:32 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {00A77AEB-EFB7-42D2-97AF-86BF0C9BCB06} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-19] (Google Inc.)
Task: {0F7D7ECA-7001-4451-9E80-BD832308D46C} - System32\Tasks\HPCustParticipation HP Officejet Pro 8610 => C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPCustPartic.exe [2014-03-06] (Hewlett-Packard Co.)
Task: {CDFA79D6-2503-48DD-BED1-E8B11D73E97F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-04-19] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2013-12-25 14:40 - 2013-04-15 12:50 - 00198144 _____ () C:\Windows\System32\HP1006LM.DLL
2011-06-21 07:42 - 2011-06-21 07:42 - 00034304 _____ () C:\Windows\System32\sst3cl6.dll
2013-12-25 14:41 - 2013-04-15 12:50 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1006PP.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2011-07-29 01:08 - 2011-07-29 01:08 - 01259376 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2013-12-19 04:42 - 2013-12-19 04:42 - 00350840 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2010-06-28 15:20 - 2010-06-28 15:20 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2010-06-28 15:12 - 2010-06-28 15:12 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-10-09 14:16 - 2014-10-09 14:16 - 00043008 _____ () c:\users\jule\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpcahqbw.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Jule\AppData\Roaming\Dropbox\bin\libcef.dll
2010-07-25 08:10 - 2009-05-20 08:02 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll
2011-07-29 01:09 - 2011-07-29 01:09 - 00096112 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2013-01-09 17:33 - 2013-01-09 17:33 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9e5dc5d1c75de12100f8c1d8c65de002\IsdiInterop.ni.dll
2010-07-13 13:32 - 2010-04-13 18:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-05-14 16:51 - 2014-09-25 18:25 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-908798351-3549208136-64478539-500 - Administrator - Disabled)
Gast (S-1-5-21-908798351-3549208136-64478539-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-908798351-3549208136-64478539-1002 - Limited - Enabled)
Jule (S-1-5-21-908798351-3549208136-64478539-1000 - Administrator - Enabled) => C:\Users\Jule
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (10/09/2014 02:21:03 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/08/2014 05:57:34 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/07/2014 05:53:41 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/06/2014 08:13:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.
Error: (10/06/2014 08:13:54 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error: (10/06/2014 06:07:35 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 09:00:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 08:00:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 03:49:55 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/04/2014 09:54:55 AM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
System errors:
=============
Error: (10/09/2014 02:18:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Office Software Protection Platform" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (10/09/2014 02:18:47 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Office Software Protection Platform erreicht.
Error: (10/09/2014 02:17:37 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {4991D34B-80A1-4291-83B6-3328366B9097}
Error: (10/09/2014 02:14:46 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst MBAMService erreicht.
Error: (10/08/2014 06:37:10 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932)
Error: (10/08/2014 06:37:08 PM) (Source: Microsoft-Windows-Service Pack Installer) (EventID: 8) (User: NT-AUTORITÄT)
Description: Fehler bei der Service Pack-Installation. Fehlercode: 0x800b0100.
Error: (10/07/2014 11:27:43 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932)
Error: (10/07/2014 11:27:40 PM) (Source: Microsoft-Windows-Service Pack Installer) (EventID: 8) (User: NT-AUTORITÄT)
Description: Fehler bei der Service Pack-Installation. Fehlercode: 0x800b0100.
Error: (10/06/2014 10:55:24 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Windows 7 Service Pack 1 für x64-basierte Systeme (KB976932)
Error: (10/06/2014 10:55:21 PM) (Source: Microsoft-Windows-Service Pack Installer) (EventID: 8) (User: NT-AUTORITÄT)
Description: Fehler bei der Service Pack-Installation. Fehlercode: 0x800b0100.
Microsoft Office Sessions:
=========================
Error: (10/09/2014 02:21:03 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/08/2014 05:57:34 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/07/2014 05:53:41 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/06/2014 08:13:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
Error: (10/06/2014 08:13:54 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3
Error: (10/06/2014 06:07:35 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 09:00:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 08:00:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/05/2014 03:49:55 PM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
Error: (10/04/2014 09:54:55 AM) (Source: Customer Experience Improvement Program) (EventID: 1006) (User: )
Description: 80004005
CodeIntegrity Errors:
===================================
Date: 2014-09-28 19:31:36.857
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-28 19:31:36.747
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-28 19:31:36.654
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-28 19:31:36.560
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-28 19:10:04.138
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-09-28 19:10:04.045
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Percentage of memory in use: 55%
Total physical RAM: 3958.71 MB
Available physical RAM: 1762.24 MB
Total Pagefile: 7915.56 MB
Available Pagefile: 4958.43 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:452.66 GB) (Free:331.87 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 10C4A9E9)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=452.7 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
12.10.2014, 10:26
| #6 |
| /// the machine /// TB-Ausbilder | Fremde Seiten im Browserverlauf Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ --> Fremde Seiten im Browserverlauf |
|
13.10.2014, 13:04
| #7 |
| | Fremde Seiten im BrowserverlaufCode:
ATTFilter ComboFix 14-10-13.01 - Jule 13.10.2014 13:50:01.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3959.2289 [GMT 2:00]
ausgeführt von:: c:\users\Jule\Desktop\ComboFix.exe
AV: G Data InternetSecurity CBE *Disabled/Updated* {545C8713-0744-B079-87F8-349A6D5C8CF0}
FW: G Data Personal Firewall *Enabled* {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
SP: G Data InternetSecurity CBE *Disabled/Updated* {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-09-13 bis 2014-10-13 ))))))))))))))))))))))))))))))
.
.
2014-10-13 11:58 . 2014-10-13 11:58 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-13 11:38 . 2014-10-13 11:38 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-10-13 11:38 . 2014-10-13 11:38 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29FE4B84-F455-4073-9368-CDDD509A1FEA}\offreg.dll
2014-10-10 09:00 . 2014-09-09 02:05 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29FE4B84-F455-4073-9368-CDDD509A1FEA}\mpengine.dll
2014-10-09 18:59 . 2014-10-09 18:59 -------- d-----w- c:\users\Jule\AppData\Local\G DATA
2014-10-02 08:11 . 2014-10-02 08:11 -------- d-----w- c:\program files (x86)\Hewlett-Packard
2014-10-02 08:09 . 2014-10-09 12:20 -------- d-----w- c:\users\Jule\AppData\Roaming\HpUpdate
2014-10-02 08:09 . 2014-03-06 10:51 763912 ------w- c:\windows\system32\HPDiscoPM7112.dll
2014-10-02 08:08 . 2014-10-02 08:08 -------- d-----w- c:\programdata\HP
2014-10-02 08:08 . 2014-10-02 08:10 -------- d-----w- c:\program files (x86)\HP
2014-10-02 08:06 . 2014-10-02 08:11 -------- d-----w- c:\users\Jule\AppData\Local\HP
2014-10-02 06:20 . 2014-10-02 06:20 68608 ----a-w- c:\windows\system32\drivers\PktIcpt.sys
2014-10-02 06:19 . 2014-10-02 06:19 64000 ----a-w- c:\windows\system32\drivers\gdwfpcd64.sys
2014-10-02 06:19 . 2014-10-02 06:19 65024 ----a-w- c:\windows\system32\drivers\HookCentre.sys
2014-10-02 06:19 . 2014-10-02 06:19 135168 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2014-10-02 06:19 . 2014-10-02 06:19 57344 ----a-w- c:\windows\system32\drivers\GDBehave.sys
2014-10-02 06:17 . 2014-10-02 06:17 -------- d-----w- c:\program files (x86)\G Data
2014-10-02 06:17 . 2014-10-02 06:17 -------- d-----w- c:\program files (x86)\Common Files\G Data
2014-10-02 06:17 . 2014-10-09 14:20 -------- d-----w- c:\programdata\G Data
2014-09-29 19:32 . 2014-09-29 19:33 -------- d-----w- C:\a990cb17e3e348b6d837
2014-09-29 12:30 . 2014-09-29 12:30 -------- d-----w- c:\programdata\APN
2014-09-29 10:43 . 2014-09-29 10:43 -------- d-----w- c:\program files (x86)\ESET
2014-09-29 10:17 . 2014-09-29 10:17 -------- d-----w- c:\windows\ERUNT
2014-09-29 10:01 . 2014-09-29 10:03 -------- d-----w- C:\AdwCleaner
2014-09-28 16:49 . 2014-10-09 15:26 -------- d-----w- C:\FRST
2014-09-27 19:33 . 2011-05-13 10:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2014-09-27 19:33 . 2011-03-25 18:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2014-09-26 09:01 . 2014-10-13 11:46 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-26 09:01 . 2014-05-12 05:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-09-26 09:01 . 2014-05-12 05:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-26 09:01 . 2014-05-12 05:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-09-26 09:01 . 2014-10-09 19:05 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2014-09-26 09:01 . 2014-09-26 09:01 -------- d-----w- c:\programdata\Malwarebytes
2014-09-26 09:00 . 2014-09-26 09:00 -------- d-----w- c:\users\Jule\AppData\Local\Programs
2014-09-24 11:32 . 2014-09-24 11:32 -------- d-----w- C:\8749dcf7cdf5e92b477860fd4122b5de
2014-09-21 17:06 . 2014-09-21 17:06 -------- d-----w- c:\programdata\Samsung
2014-09-21 17:06 . 2011-06-21 00:24 36864 ----a-w- c:\windows\system32\Spool\prtprocs\x64\sst3cpc.dll
2014-09-20 20:22 . 2014-09-20 20:22 -------- d-----w- C:\f6e802fad9a09378400a1e560959fe
2014-09-13 19:09 . 2014-09-13 19:09 3231696 ----a-w- c:\program files (x86)\Mozilla Firefox\d3dcompiler_46.dll
2014-09-13 16:35 . 2014-09-05 02:01 574976 ----a-w- c:\windows\system32\aepdu.dll
2014-09-13 16:35 . 2014-09-05 01:55 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-09-13 16:08 . 2014-09-13 16:08 -------- d-----w- c:\program files (x86)\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-09-15 07:06 . 2011-05-02 18:54 278152 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:40 120176 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-01 1514040]
"Spotify"="c:\users\Jule\AppData\Roaming\Spotify\Spotify.exe" [2014-10-01 6553144]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-07-24 21650016]
"HP Officejet Pro 8610 (NET)"="c:\program files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe" [2014-03-06 3487240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-04-13 284696]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"Norton Online Backup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 1155928]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-06-28 265984]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-06-22 968272]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2013-12-19 1724728]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
.
c:\users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-13 36414624]
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 332016]
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]
S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys;c:\windows\SYSNATIVE\drivers\gdwfpcd64.sys [x]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [x]
S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [x]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 NitroDriverReadSpool9;NitroPDFDriverCreatorReadSpool9;c:\program files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe;c:\program files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [x]
S2 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [x]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys;c:\windows\SYSNATIVE\drivers\PktIcpt.sys [x]
S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-19 16:25]
.
2014-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-04-19 16:25]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:42 137584 ----a-w- c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-06-22 10920552]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 861216]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: NameServer = 131.188.24.131
FF - ProfilePath - c:\users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1 - c:\users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\extensions\cliqz@cliqz.com\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10h.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-10-13 14:03:12
ComboFix-quarantined-files.txt 2014-10-13 12:03
ComboFix2.txt 2014-09-28 17:35
ComboFix3.txt 2014-09-28 17:14
.
Vor Suchlauf: 31 Verzeichnis(se), 358.230.958.080 Bytes frei
Nach Suchlauf: 33 Verzeichnis(se), 359.275.732.992 Bytes frei
.
- - End Of File - - C5152A9DDA23256ED8585D490FD3E035
|
|
14.10.2014, 08:25
| #8 |
| /// the machine /// TB-Ausbilder | Fremde Seiten im Browserverlauf Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.10.2014, 11:57
| #9 |
| | Fremde Seiten im BrowserverlaufCode:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.10.2014 Suchlauf-Zeit: 11:44:07 Logdatei: 2.txt Administrator: Ja Version: 2.00.2.1012 Malware Datenbank: v2014.10.14.07 Rootkit Datenbank: v2014.10.11.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Self-protection: Deaktiviert Betriebssystem: Windows 7 CPU: x64 Dateisystem: NTFS Benutzer: Jule Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 333542 Verstrichene Zeit: 11 Min, 41 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristics: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registrierungsschlüssel: 0 (No malicious items detected) Registrierungswerte: 0 (No malicious items detected) Registrierungsdaten: 0 (No malicious items detected) Ordner: 0 (No malicious items detected) Dateien: 0 (No malicious items detected) Physische Sektoren: 0 (No malicious items detected) (end) Code:
ATTFilter # AdwCleaner v4.000 - Bericht erstellt am 14/10/2014 um 12:28:44
# DB v2014-10-13.5
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium (64 bits)
# Benutzername : Jule - JULE-PC
# Gestartet von : C:\Users\Jule\Downloads\AdwCleaner_4.000.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16421
-\\ Mozilla Firefox v32.0.3 (x86 de)
[x7ilo26k.default] - Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com");
[x7ilo26k.default] - Zeile gelöscht : user_pref("extensions.ORJ.DataStore.toolbar", "{\"BLACKLIST_SUBDOMAINS_OF\":[\"join.me\",\"Bing.com\",\"Hotmail.com\",\"Live.com\",\"ebay.com\",\"bing.com\",\"yahoo.com\",\"cnn.com\",\"live.com\",\"gm[...]
[x7ilo26k.default] - Zeile gelöscht : user_pref("extensions.ORJ.InstallDir", "\"C:\\\\Program Files (x86)\\\\Ask.com\\\\\"");
[x7ilo26k.default] - Zeile gelöscht : user_pref("extensions.ORJ.domain", "\"www.search.ask.com\"");
*************************
AdwCleaner[R0].txt - [2485 octets] - [29/09/2014 12:01:26]
AdwCleaner[R1].txt - [1621 octets] - [14/10/2014 12:12:44]
AdwCleaner[S0].txt - [2500 octets] - [29/09/2014 12:03:15]
AdwCleaner[S1].txt - [1534 octets] - [14/10/2014 12:28:44]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1594 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.2 (10.09.2014:1)
OS: Windows 7 Home Premium x64
Ran by Jule on 14.10.2014 at 12:42:47,02
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.10.2014 at 12:49:18,55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014 02
Ran by Jule (administrator) on JULE-PC on 14-10-2014 12:53:10
Running from C:\Users\Jule\Desktop
Loaded Profile: Jule (Available profiles: Jule)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Spotify Ltd) C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify Web Helper] => C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify] => C:\Users\Jule\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE428
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer] 131.188.24.131
FireFox:
========
FF ProfilePath: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nitropdf.com/NitroPDF.PrevVerNPR -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-10-30]
FF Extension: Garmin Communicator - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-25]
FF Extension: Cliqz Beta - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\cliqz@cliqz.com.xpi [2014-09-28]
FF Extension: Personas Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\personas@christopher.beard.xpi [2011-09-02]
FF Extension: Adblock Lite - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{1e9a63ef-84ec-49a4-8d6f-2dd9524e90d0}.xpi [2012-03-17]
FF Extension: Adblock Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-04]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-22]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-10-07] (Nitro PDF Software)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-02-13] (Nitro PDF Software)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-10-02] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-10-02] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-10-02] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-10-02] (G Data Software AG)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-10-02] (G Data Software AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-14 12:53 - 2014-10-14 12:53 - 00000000 ____D () C:\Users\Jule\Desktop\FRST-OlderVersion
2014-10-14 12:49 - 2014-10-14 12:49 - 00001216 _____ () C:\Users\Jule\Desktop\JRT.txt
2014-10-14 12:41 - 2014-10-14 12:41 - 01705755 _____ (Thisisu) C:\Users\Jule\Downloads\JRT.exe
2014-10-14 12:11 - 2014-10-14 12:11 - 01976320 _____ () C:\Users\Jule\Downloads\AdwCleaner_4.000.exe
2014-10-14 12:09 - 2014-10-14 12:09 - 00001140 _____ () C:\Users\Jule\Desktop\2.txt
2014-10-14 11:42 - 2014-10-14 11:42 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(4).exe
2014-10-13 14:03 - 2014-10-13 14:03 - 00021215 _____ () C:\Users\Jule\Desktop\ComboFix.txt
2014-10-13 13:46 - 2014-10-13 13:44 - 05582915 ____R (Swearware) C:\Users\Jule\Desktop\ComboFix.exe
2014-10-13 13:44 - 2014-10-13 13:44 - 05582915 _____ (Swearware) C:\Users\Jule\Downloads\ComboFix.exe
2014-10-13 13:38 - 2014-10-13 13:38 - 00001264 _____ () C:\Users\Jule\Desktop\Revo Uninstaller.lnk
2014-10-13 13:38 - 2014-10-13 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-13 13:37 - 2014-10-13 13:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jule\Downloads\revosetup95.exe
2014-10-10 09:33 - 2014-10-10 09:33 - 00001144 _____ () C:\Users\Jule\Desktop\malware.txt
2014-10-09 21:05 - 2014-10-14 11:43 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-09 21:03 - 2014-10-09 21:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-10-09 21:03 - 2014-10-09 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-10-09 20:59 - 2014-10-09 20:59 - 00000000 ____D () C:\Users\Jule\AppData\Local\G DATA
2014-10-09 17:25 - 2014-10-09 17:26 - 00041194 _____ () C:\Users\Jule\Desktop\Addition.txt
2014-10-09 17:23 - 2014-10-14 12:53 - 00022513 _____ () C:\Users\Jule\Desktop\FRST.txt
2014-10-09 17:21 - 2014-10-14 12:53 - 02110464 _____ (Farbar) C:\Users\Jule\Desktop\FRST64.exe
2014-10-02 10:28 - 2014-10-02 10:28 - 00001228 _____ () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\I.R.I.S. Resource Center.lnk
2014-10-02 10:11 - 2014-10-02 10:11 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-10-02 10:10 - 2014-10-02 10:10 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
2014-10-02 10:09 - 2014-10-09 14:20 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\HpUpdate
2014-10-02 10:09 - 2014-10-02 10:09 - 00003606 _____ () C:\Windows\System32\Tasks\HPCustParticipation HP Officejet Pro 8610
2014-10-02 10:09 - 2014-10-02 10:09 - 00002204 _____ () C:\Users\Public\Desktop\HP Officejet Pro 8610.lnk
2014-10-02 10:09 - 2014-10-02 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-10-02 10:09 - 2014-03-06 12:51 - 00763912 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM7112.dll
2014-10-02 10:08 - 2014-10-02 10:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-10-02 10:08 - 2014-10-02 10:08 - 00000000 ____D () C:\ProgramData\HP
2014-10-02 10:07 - 2014-10-02 10:07 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-10-02 10:06 - 2014-10-02 10:11 - 00000000 ____D () C:\Users\Jule\AppData\Local\HP
2014-10-02 08:20 - 2014-10-02 08:20 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-10-02 08:20 - 2014-10-02 08:20 - 00002050 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk
2014-10-02 08:20 - 2014-10-02 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-10-02 08:19 - 2014-10-02 08:19 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00000779 _____ () C:\Users\Jule\AppData\Roaming\gdscan.log
2014-10-02 08:19 - 2014-10-02 08:19 - 00000000 _____ () C:\Users\Jule\AppData\Roaming\gdfw.log
2014-10-02 08:17 - 2014-10-09 16:20 - 00000000 ____D () C:\ProgramData\G Data
2014-10-02 08:17 - 2014-10-02 08:17 - 00000000 ____D () C:\Program Files (x86)\G Data
2014-10-02 07:46 - 2014-10-02 07:47 - 00227096 _____ () C:\Users\Jule\Downloads\avira_registry_cleaner_de.exe
2014-10-02 07:37 - 2014-10-02 07:37 - 00003100 _____ () C:\Windows\System32\Tasks\{661E46F1-5255-4D41-8063-D32A9DF64FDF}
2014-09-29 21:32 - 2014-09-29 21:33 - 00000000 ____D () C:\a990cb17e3e348b6d837
2014-09-29 12:43 - 2014-09-29 12:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-29 12:17 - 2014-09-29 12:17 - 00000000 ____D () C:\Windows\ERUNT
2014-09-29 12:01 - 2014-10-14 12:28 - 00000000 ____D () C:\AdwCleaner
2014-09-28 18:59 - 2014-10-13 14:03 - 00000000 ____D () C:\Qoobox
2014-09-28 18:59 - 2014-09-28 19:12 - 00000000 ____D () C:\Windows\erdnt
2014-09-28 18:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-28 18:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-28 18:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-28 18:49 - 2014-10-14 12:53 - 00000000 ____D () C:\FRST
2014-09-27 21:33 - 2014-09-27 21:33 - 00791193 _____ () C:\Users\Jule\Downloads\Bootice_1.3.2.1.zip
2014-09-27 21:33 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-27 21:33 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-27 21:30 - 2014-09-27 21:30 - 01101648 _____ () C:\Users\Jule\Downloads\Bootice - CHIP-Installer.exe
2014-09-27 20:36 - 2014-09-27 20:36 - 00291208 _____ () C:\Windows\Minidump\092714-88218-01.dmp
2014-09-27 16:34 - 2014-09-27 16:44 - 00050688 _____ () C:\Users\Jule\Desktop\6646_LAA_Nowak_Julia.xls
2014-09-26 13:29 - 2014-09-26 13:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-09-26 11:01 - 2014-10-14 12:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 11:01 - 2014-10-14 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-26 11:01 - 2014-10-14 11:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-26 11:01 - 2014-09-26 11:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 11:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-26 11:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-26 11:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-26 11:00 - 2014-09-26 11:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-24 13:32 - 2014-09-24 13:32 - 00000000 ____D () C:\8749dcf7cdf5e92b477860fd4122b5de
2014-09-23 18:57 - 2014-10-06 19:32 - 00000000 ____D () C:\Users\Jule\Desktop\Seminar
2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ____D () C:\ProgramData\Samsung
2014-09-20 22:22 - 2014-09-20 22:22 - 00000000 ____D () C:\f6e802fad9a09378400a1e560959fe
2014-09-20 15:06 - 2014-09-20 15:06 - 15796788 _____ () C:\Users\Jule\Downloads\9.1_ 17. Januar Philosophieren mit Kindern.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 05416455 _____ () C:\Users\Jule\Downloads\9._ 10. Januar 2012 Medienerziehung.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 04668869 _____ () C:\Users\Jule\Downloads\9.2_ 24. Januar Gesundheitsforderung_ Sexualerziehung.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 00000244 _____ () C:\Users\Jule\Downloads\8._ 20. Dezember Reflexion, Ruckblick (Puffer).zip
2014-09-20 15:05 - 2014-09-20 15:06 - 04202529 _____ () C:\Users\Jule\Downloads\9.3._ 31. Januar Interkulturelles Lernen.zip
2014-09-20 15:04 - 2014-09-20 15:04 - 00000218 _____ () C:\Users\Jule\Downloads\9.4._ 07. Februar Zusammenfassung.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 08505786 _____ () C:\Users\Jule\Downloads\4._ 22. November Politisches_ Demokratisches Lernen.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 03251653 _____ () C:\Users\Jule\Downloads\6._ 06. Dezember Bildung zur Nachhaltigkeit.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 01346867 _____ () C:\Users\Jule\Downloads\5._ 29. November Soziales Lernen.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 01073266 _____ () C:\Users\Jule\Downloads\7._ 13. Dezember Ethisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 15:00 - 10783159 _____ () C:\Users\Jule\Downloads\3._ 15. November Geographisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 14:59 - 03052689 _____ () C:\Users\Jule\Downloads\2._ 08. November Historisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 14:59 - 00000234 _____ () C:\Users\Jule\Downloads\1._ 25. Oktober - Theoretische Einfuhrung.zip
2014-09-20 14:57 - 2014-09-20 14:57 - 01344625 _____ () C:\Users\Jule\Downloads\Formalia (Plan, Literatur usw.).zip
2014-09-20 14:53 - 2014-09-20 14:54 - 44488710 _____ () C:\Users\Jule\Downloads\Sitzungen, Zusammenfassung, Handouts.zip
2014-09-20 14:53 - 2014-09-20 14:53 - 00362659 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen)(1).zip
2014-09-20 14:52 - 2014-09-20 14:52 - 00276979 _____ () C:\Users\Jule\Downloads\Filme im BU II.zip
2014-09-20 14:49 - 2014-09-20 14:50 - 15324822 _____ () C:\Users\Jule\Downloads\Arbeitsblatter und Prasentationen_Kurs Reimann.zip
2014-09-20 14:49 - 2014-09-20 14:50 - 13572401 _____ () C:\Users\Jule\Downloads\Alle Arbeitsblatter Kurs Reitschert - Kopie.zip
2014-09-20 14:49 - 2014-09-20 14:49 - 00523078 _____ () C:\Users\Jule\Downloads\Beispielhafte Arbeitsblatter - Kopie.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 16603060 _____ () C:\Users\Jule\Downloads\Sitzung _Mach-Bar-Tour_.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 04309533 _____ () C:\Users\Jule\Downloads\Sitzung _Klimawandel vor Gericht_.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 00393124 _____ () C:\Users\Jule\Downloads\Sitzung _Zukunftswerkstatt_.zip
2014-09-20 14:43 - 2014-09-20 14:44 - 21095987 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__Olli Ohrwurm.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 06806183 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__BzGA.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 01881604 _____ () C:\Users\Jule\Downloads\Sitzung _BNE in der Grundschule_.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 00446229 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 02238293 _____ () C:\Users\Jule\Downloads\Sitzung _Bewertungskompetenz-Planspiele_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 01100550 _____ () C:\Users\Jule\Downloads\Sitzung _Bioethik und Bewertungskompetenz_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 00456876 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 03124946 _____ () C:\Users\Jule\Downloads\Lehrversuche(8).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 02135274 _____ () C:\Users\Jule\Downloads\Lehrversuche(9).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 01311036 _____ () C:\Users\Jule\Downloads\Lehrversuche(12).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 00798977 _____ () C:\Users\Jule\Downloads\Lehrversuche(10).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 00598698 _____ () C:\Users\Jule\Downloads\Lehrversuche(11).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 04798931 _____ () C:\Users\Jule\Downloads\Lehrversuche(4).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 03076604 _____ () C:\Users\Jule\Downloads\Lehrversuche(6).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 01114637 _____ () C:\Users\Jule\Downloads\Lehrversuche(5).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 00638437 _____ () C:\Users\Jule\Downloads\Lehrversuche(7).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 00399719 _____ () C:\Users\Jule\Downloads\Lehrversuche(3).zip
2014-09-20 14:25 - 2014-09-20 14:25 - 00524065 _____ () C:\Users\Jule\Downloads\Lehrversuche(2).zip
2014-09-20 14:19 - 2014-09-20 14:19 - 04053469 _____ () C:\Users\Jule\Downloads\Lehrversuche(1).zip
2014-09-20 14:14 - 2014-09-20 14:15 - 02722777 _____ () C:\Users\Jule\Downloads\Lehrversuche.zip
2014-09-17 19:13 - 2014-10-13 22:29 - 00000000 ____D () C:\Users\Jule\Desktop\Eigene UV´s
2014-09-16 22:34 - 2014-09-20 15:09 - 00000000 ____D () C:\Users\Jule\Desktop\Unterrichtsmaterialien
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-14 12:44 - 2011-04-19 18:25 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-14 12:42 - 2011-09-02 17:02 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Skype
2014-10-14 12:40 - 2013-05-07 11:21 - 00000000 ___RD () C:\Users\Jule\Dropbox
2014-10-14 12:40 - 2013-05-07 11:18 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Dropbox
2014-10-14 12:40 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Spotify
2014-10-14 12:39 - 2011-04-19 18:25 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-14 12:37 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-14 12:37 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-14 12:29 - 2010-09-20 02:04 - 00171080 _____ () C:\Windows\PFRO.log
2014-10-14 12:29 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-14 12:29 - 2009-07-14 06:51 - 00184760 _____ () C:\Windows\setupact.log
2014-10-14 12:28 - 2010-09-20 02:07 - 01968471 _____ () C:\Windows\WindowsUpdate.log
2014-10-13 13:59 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-11 16:42 - 2010-09-20 11:59 - 02996880 _____ () C:\Windows\system32\perfh007.dat
2014-10-11 16:42 - 2010-09-20 11:59 - 00881312 _____ () C:\Windows\system32\perfc007.dat
2014-10-11 16:42 - 2009-07-14 07:13 - 00005438 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-09 21:33 - 2012-10-28 22:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\SoftGrid Client
2014-10-09 19:33 - 2012-01-02 21:59 - 00588800 ___SH () C:\Users\Jule\Desktop\Thumbs.db
2014-10-02 10:26 - 2013-05-31 20:30 - 00052224 _____ () C:\Users\Jule\Documents\Write1.aww
2014-10-02 10:26 - 2011-05-22 08:37 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\CorelHomeOffice
2014-10-02 10:07 - 2013-12-25 14:40 - 00000000 ____D () C:\Program Files\HP
2014-10-02 08:18 - 2010-09-20 02:24 - 00006804 _____ () C:\Windows\DPINST.LOG
2014-10-02 08:08 - 2013-11-25 10:20 - 00000000 ____D () C:\ProgramData\Avira
2014-10-01 12:05 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Local\Spotify
2014-09-28 19:14 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-28 19:10 - 2011-04-17 11:00 - 00000000 ____D () C:\Users\Jule
2014-09-27 20:36 - 2011-08-16 23:16 - 00000000 ____D () C:\Windows\Minidump
2014-09-27 20:35 - 2011-08-16 23:16 - 471519071 _____ () C:\Windows\MEMORY.DMP
2014-09-27 20:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-09-25 20:23 - 2012-05-21 00:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-25 18:25 - 2014-05-14 16:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-21 21:55 - 2011-04-17 11:01 - 00116584 _____ () C:\Users\Jule\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 21:55 - 2009-07-14 06:45 - 00437784 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-20 14:07 - 2011-11-28 17:28 - 00000000 ____D () C:\Users\Jule\Documents\Uni
2014-09-20 14:05 - 2014-04-07 15:13 - 00000000 ____D () C:\Users\Jule\Desktop\Mama Geb
2014-09-20 13:47 - 2014-09-13 18:15 - 00000000 ___RD () C:\Users\Jule\Desktop\Referendariat GS OPF 2014-2016
2014-09-20 13:03 - 2013-05-07 11:21 - 00001017 _____ () C:\Users\Jule\Desktop\Dropbox.lnk
2014-09-20 13:03 - 2013-05-07 11:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-15 09:06 - 2011-05-02 20:54 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Jule\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpo25wrn.dll
C:\Users\Jule\AppData\Local\Temp\Quarantine.exe
C:\Users\Jule\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-06 20:09
==================== End Of Log ============================
--- --- --- --- --- --- Hoffe ich hab alles richtig gemacht. |
|
15.10.2014, 09:43
| #10 |
| /// the machine /// TB-Ausbilder | Fremde Seiten im BrowserverlaufESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.10.2014, 19:22
| #11 |
| | Fremde Seiten im BrowserverlaufCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8be4339b48bce948bcdf1aa1da479336
# engine=20346
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-09-29 12:25:52
# local_time=2014-09-29 02:25:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 9074 137828178 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 86052 163623401 0 0
# scanned=242465
# found=8
# cleaned=0
# scan_time=5928
sh=B506B2465FD10608020D30ED9047B5E11DE63FA0 ft=1 fh=10102a51b62618f2 vn="Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\APNSetup.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files (x86)\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=64A9002AA8191C4EE517F9BC63845CFFA37AB488 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcohhccfpq..vbs.vir"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Users\Jule\AppData\Local\Temp\lcohhccfpq..vbs"
sh=64A9002AA8191C4EE517F9BC63845CFFA37AB488 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcohhccfpq..vbs"
sh=D146AF98EB5CE7A3ECBFF8163EEF002458A1F442 ft=1 fh=129807a7e8f58340 vn="Win32/HackKMS.A potenziell unsichere Anwendung" ac=I fn="C:\Users\Jule\Desktop\Neuer Ordner\WLX\mini-KMS Activator v1.1 FiNAL.exe"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\ApnIC[1].0"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8be4339b48bce948bcdf1aa1da479336
# engine=20610
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-15 03:51:03
# local_time=2014-10-15 05:51:03 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 109053 165018113 0 0
# scanned=248545
# found=1
# cleaned=0
# scan_time=10077
sh=64A9002AA8191C4EE517F9BC63845CFFA37AB488 ft=0 fh=0000000000000000 vn="VBS/Kryptik.BO Trojaner" ac=I fn="C:\Qoobox\Quarantine\C\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcohhccfpq..vbs.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 x64
Out of date service pack!!
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
G Data InternetSecurity CBE
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java(TM) 6 Update 22
Java(TM) 6 Update 29
Java 7 Update 9
Java version out of Date!
Adobe Flash Player 10 Flash Player out of Date!
Adobe Flash Player 11.5.502.146 Flash Player out of Date!
Adobe Reader 9 Adobe Reader out of Date!
Mozilla Firefox (32.0.3)
````````Process Check: objlist.exe by Laurent````````
G Data InternetSecurity Firewall GDFwSvcx64.exe
G Data InternetSecurity Firewall GDFirewallTray.exe
Symantec Norton Online Backup NOBuAgent.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-10-2014 01
Ran by Jule (administrator) on JULE-PC on 15-10-2014 20:20:49
Running from C:\Users\Jule\Desktop
Loaded Profile: Jule (Available profiles: Jule)
Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Spotify Ltd) C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Dropbox, Inc.) C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet Pro 8610\Bin\HPNetworkCommunicatorCom.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10920552 2010-06-22] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [861216 2010-06-11] (Acer Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] => C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-06-28] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [968272 2010-06-22] (Dritek System Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1724728 2013-12-19] (G Data Software AG)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify Web Helper] => C:\Users\Jule\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Spotify] => C:\Users\Jule\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-01] (Spotify Ltd)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [21650016 2014-07-24] (Skype Technologies S.A.)
HKU\S-1-5-21-908798351-3549208136-64478539-1000\...\Run: [HP Officejet Pro 8610 (NET)] => C:\Program Files\HP\HP Officejet Pro 8610\Bin\ScanToPCActivationApp.exe [3487240 2014-03-06] (Hewlett-Packard Co.)
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)
Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jule\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll (Egis Technology Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273604119905l0424z1k5v47l22906
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_deDE428
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - No File
Handler-x32: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{FBE8EDFF-40B4-4F01-B66D-8CE039DB5E4E}: [NameServer] 131.188.24.131
FireFox:
========
FF ProfilePath: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default
FF DefaultSearchEngine: Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_146.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 9\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nitropdf.com/NitroPDF.PrevVerNPR -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\2020Player_IKEA@2020Technologies.com [2012-10-30]
FF Extension: Garmin Communicator - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-12-25]
FF Extension: Cliqz Beta - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\cliqz@cliqz.com.xpi [2014-09-28]
FF Extension: Personas Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\personas@christopher.beard.xpi [2011-09-02]
FF Extension: Adblock Lite - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{1e9a63ef-84ec-49a4-8d6f-2dd9524e90d0}.xpi [2012-03-17]
FF Extension: Adblock Plus - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-03-04]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-22]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Jule\AppData\Roaming\Mozilla\Firefox\Profiles\x7ilo26k.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2244728 2014-02-12] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2723400 2014-03-25] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2992760 2014-01-30] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700024 2014-02-03] (G Data Software AG)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
R2 NitroDriverReadSpool9; C:\Program Files\Common Files\Nitro\Pro\9.0\NitroPDFDriverService9x64.exe [230920 2013-10-07] (Nitro PDF Software)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-02-13] (Nitro PDF Software)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [57344 2014-10-02] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [135168 2014-10-02] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [68608 2014-10-02] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64000 2014-10-02] (G Data Software AG)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [65024 2014-10-02] (G Data Software AG)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-15 20:06 - 2014-10-15 20:06 - 00854417 _____ () C:\Users\Jule\Desktop\SecurityCheck.exe
2014-10-15 15:01 - 2014-10-15 15:01 - 02347384 _____ (ESET) C:\Users\Jule\Downloads\esetsmartinstaller_deu.exe
2014-10-14 12:53 - 2014-10-15 20:20 - 00000000 ____D () C:\Users\Jule\Desktop\FRST-OlderVersion
2014-10-14 12:49 - 2014-10-14 12:49 - 00001216 _____ () C:\Users\Jule\Desktop\JRT.txt
2014-10-14 12:41 - 2014-10-14 12:41 - 01705755 _____ (Thisisu) C:\Users\Jule\Downloads\JRT.exe
2014-10-14 12:11 - 2014-10-14 12:11 - 01976320 _____ () C:\Users\Jule\Downloads\AdwCleaner_4.000.exe
2014-10-14 12:09 - 2014-10-14 12:09 - 00001140 _____ () C:\Users\Jule\Desktop\2.txt
2014-10-14 11:42 - 2014-10-14 11:42 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(4).exe
2014-10-13 14:03 - 2014-10-13 14:03 - 00021215 _____ () C:\Users\Jule\Desktop\ComboFix.txt
2014-10-13 13:46 - 2014-10-13 13:44 - 05582915 ____R (Swearware) C:\Users\Jule\Desktop\ComboFix.exe
2014-10-13 13:44 - 2014-10-13 13:44 - 05582915 _____ (Swearware) C:\Users\Jule\Downloads\ComboFix.exe
2014-10-13 13:38 - 2014-10-13 13:38 - 00001264 _____ () C:\Users\Jule\Desktop\Revo Uninstaller.lnk
2014-10-13 13:38 - 2014-10-13 13:38 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-10-13 13:37 - 2014-10-13 13:37 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jule\Downloads\revosetup95.exe
2014-10-10 09:33 - 2014-10-10 09:33 - 00001144 _____ () C:\Users\Jule\Desktop\malware.txt
2014-10-09 21:05 - 2014-10-14 11:43 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-09 21:03 - 2014-10-09 21:04 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-10-09 21:03 - 2014-10-09 21:03 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-10-09 20:59 - 2014-10-09 20:59 - 00000000 ____D () C:\Users\Jule\AppData\Local\G DATA
2014-10-09 17:25 - 2014-10-09 17:26 - 00041194 _____ () C:\Users\Jule\Desktop\Addition.txt
2014-10-09 17:23 - 2014-10-15 20:20 - 00022581 _____ () C:\Users\Jule\Desktop\FRST.txt
2014-10-09 17:21 - 2014-10-15 20:20 - 02110976 _____ (Farbar) C:\Users\Jule\Desktop\FRST64.exe
2014-10-02 10:28 - 2014-10-02 10:28 - 00001228 _____ () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\I.R.I.S. Resource Center.lnk
2014-10-02 10:11 - 2014-10-02 10:11 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-10-02 10:10 - 2014-10-02 10:10 - 00000964 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\I.R.I.S. OCR-Registrierung.lnk
2014-10-02 10:09 - 2014-10-09 14:20 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\HpUpdate
2014-10-02 10:09 - 2014-10-02 10:09 - 00003606 _____ () C:\Windows\System32\Tasks\HPCustParticipation HP Officejet Pro 8610
2014-10-02 10:09 - 2014-10-02 10:09 - 00002204 _____ () C:\Users\Public\Desktop\HP Officejet Pro 8610.lnk
2014-10-02 10:09 - 2014-10-02 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-10-02 10:09 - 2014-03-06 12:51 - 00763912 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPM7112.dll
2014-10-02 10:08 - 2014-10-02 10:10 - 00000000 ____D () C:\Program Files (x86)\HP
2014-10-02 10:08 - 2014-10-02 10:08 - 00000000 ____D () C:\ProgramData\HP
2014-10-02 10:07 - 2014-10-02 10:07 - 00000057 _____ () C:\ProgramData\Ament.ini
2014-10-02 10:06 - 2014-10-02 10:11 - 00000000 ____D () C:\Users\Jule\AppData\Local\HP
2014-10-02 08:20 - 2014-10-02 08:20 - 00068608 _____ (G Data Software AG) C:\Windows\system32\Drivers\PktIcpt.sys
2014-10-02 08:20 - 2014-10-02 08:20 - 00002050 _____ () C:\Users\Public\Desktop\G Data InternetSecurity CBE.lnk
2014-10-02 08:20 - 2014-10-02 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G Data InternetSecurity CBE
2014-10-02 08:19 - 2014-10-02 08:19 - 00135168 _____ (G Data Software AG) C:\Windows\system32\Drivers\MiniIcpt.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00065024 _____ (G Data Software AG) C:\Windows\system32\Drivers\HookCentre.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00064000 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00057344 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDBehave.sys
2014-10-02 08:19 - 2014-10-02 08:19 - 00000779 _____ () C:\Users\Jule\AppData\Roaming\gdscan.log
2014-10-02 08:19 - 2014-10-02 08:19 - 00000000 _____ () C:\Users\Jule\AppData\Roaming\gdfw.log
2014-10-02 08:17 - 2014-10-09 16:20 - 00000000 ____D () C:\ProgramData\G Data
2014-10-02 08:17 - 2014-10-02 08:17 - 00000000 ____D () C:\Program Files (x86)\G Data
2014-10-02 07:46 - 2014-10-02 07:47 - 00227096 _____ () C:\Users\Jule\Downloads\avira_registry_cleaner_de.exe
2014-10-02 07:37 - 2014-10-02 07:37 - 00003100 _____ () C:\Windows\System32\Tasks\{661E46F1-5255-4D41-8063-D32A9DF64FDF}
2014-09-29 21:32 - 2014-09-29 21:33 - 00000000 ____D () C:\a990cb17e3e348b6d837
2014-09-29 12:43 - 2014-09-29 12:43 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-09-29 12:17 - 2014-09-29 12:17 - 00000000 ____D () C:\Windows\ERUNT
2014-09-29 12:01 - 2014-10-14 12:28 - 00000000 ____D () C:\AdwCleaner
2014-09-28 18:59 - 2014-10-13 14:03 - 00000000 ____D () C:\Qoobox
2014-09-28 18:59 - 2014-09-28 19:12 - 00000000 ____D () C:\Windows\erdnt
2014-09-28 18:59 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-28 18:59 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-28 18:59 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-28 18:59 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-28 18:49 - 2014-10-15 20:20 - 00000000 ____D () C:\FRST
2014-09-27 21:33 - 2014-09-27 21:33 - 00791193 _____ () C:\Users\Jule\Downloads\Bootice_1.3.2.1.zip
2014-09-27 21:33 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-09-27 21:33 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-09-27 21:30 - 2014-09-27 21:30 - 01101648 _____ () C:\Users\Jule\Downloads\Bootice - CHIP-Installer.exe
2014-09-27 20:36 - 2014-09-27 20:36 - 00291208 _____ () C:\Windows\Minidump\092714-88218-01.dmp
2014-09-27 16:34 - 2014-09-27 16:44 - 00050688 _____ () C:\Users\Jule\Desktop\6646_LAA_Nowak_Julia.xls
2014-09-26 13:29 - 2014-09-26 13:29 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-09-26 11:01 - 2014-10-14 12:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-26 11:01 - 2014-10-14 11:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-09-26 11:01 - 2014-10-14 11:43 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-09-26 11:01 - 2014-09-26 11:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-26 11:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-26 11:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-26 11:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-26 11:00 - 2014-09-26 11:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jule\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-24 13:32 - 2014-09-24 13:32 - 00000000 ____D () C:\8749dcf7cdf5e92b477860fd4122b5de
2014-09-23 18:57 - 2014-10-06 19:32 - 00000000 ____D () C:\Users\Jule\Desktop\Seminar
2014-09-21 19:06 - 2014-09-21 19:06 - 00000000 ____D () C:\ProgramData\Samsung
2014-09-20 22:22 - 2014-09-20 22:22 - 00000000 ____D () C:\f6e802fad9a09378400a1e560959fe
2014-09-20 15:06 - 2014-09-20 15:06 - 15796788 _____ () C:\Users\Jule\Downloads\9.1_ 17. Januar Philosophieren mit Kindern.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 05416455 _____ () C:\Users\Jule\Downloads\9._ 10. Januar 2012 Medienerziehung.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 04668869 _____ () C:\Users\Jule\Downloads\9.2_ 24. Januar Gesundheitsforderung_ Sexualerziehung.zip
2014-09-20 15:06 - 2014-09-20 15:06 - 00000244 _____ () C:\Users\Jule\Downloads\8._ 20. Dezember Reflexion, Ruckblick (Puffer).zip
2014-09-20 15:05 - 2014-09-20 15:06 - 04202529 _____ () C:\Users\Jule\Downloads\9.3._ 31. Januar Interkulturelles Lernen.zip
2014-09-20 15:04 - 2014-09-20 15:04 - 00000218 _____ () C:\Users\Jule\Downloads\9.4._ 07. Februar Zusammenfassung.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 08505786 _____ () C:\Users\Jule\Downloads\4._ 22. November Politisches_ Demokratisches Lernen.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 03251653 _____ () C:\Users\Jule\Downloads\6._ 06. Dezember Bildung zur Nachhaltigkeit.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 01346867 _____ () C:\Users\Jule\Downloads\5._ 29. November Soziales Lernen.zip
2014-09-20 15:00 - 2014-09-20 15:00 - 01073266 _____ () C:\Users\Jule\Downloads\7._ 13. Dezember Ethisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 15:00 - 10783159 _____ () C:\Users\Jule\Downloads\3._ 15. November Geographisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 14:59 - 03052689 _____ () C:\Users\Jule\Downloads\2._ 08. November Historisches Lernen.zip
2014-09-20 14:59 - 2014-09-20 14:59 - 00000234 _____ () C:\Users\Jule\Downloads\1._ 25. Oktober - Theoretische Einfuhrung.zip
2014-09-20 14:57 - 2014-09-20 14:57 - 01344625 _____ () C:\Users\Jule\Downloads\Formalia (Plan, Literatur usw.).zip
2014-09-20 14:53 - 2014-09-20 14:54 - 44488710 _____ () C:\Users\Jule\Downloads\Sitzungen, Zusammenfassung, Handouts.zip
2014-09-20 14:53 - 2014-09-20 14:53 - 00362659 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen)(1).zip
2014-09-20 14:52 - 2014-09-20 14:52 - 00276979 _____ () C:\Users\Jule\Downloads\Filme im BU II.zip
2014-09-20 14:49 - 2014-09-20 14:50 - 15324822 _____ () C:\Users\Jule\Downloads\Arbeitsblatter und Prasentationen_Kurs Reimann.zip
2014-09-20 14:49 - 2014-09-20 14:50 - 13572401 _____ () C:\Users\Jule\Downloads\Alle Arbeitsblatter Kurs Reitschert - Kopie.zip
2014-09-20 14:49 - 2014-09-20 14:49 - 00523078 _____ () C:\Users\Jule\Downloads\Beispielhafte Arbeitsblatter - Kopie.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 16603060 _____ () C:\Users\Jule\Downloads\Sitzung _Mach-Bar-Tour_.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 04309533 _____ () C:\Users\Jule\Downloads\Sitzung _Klimawandel vor Gericht_.zip
2014-09-20 14:44 - 2014-09-20 14:44 - 00393124 _____ () C:\Users\Jule\Downloads\Sitzung _Zukunftswerkstatt_.zip
2014-09-20 14:43 - 2014-09-20 14:44 - 21095987 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__Olli Ohrwurm.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 06806183 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung__BzGA.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 01881604 _____ () C:\Users\Jule\Downloads\Sitzung _BNE in der Grundschule_.zip
2014-09-20 14:43 - 2014-09-20 14:43 - 00446229 _____ () C:\Users\Jule\Downloads\Sitzung _Gesundheitsbildung_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 02238293 _____ () C:\Users\Jule\Downloads\Sitzung _Bewertungskompetenz-Planspiele_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 01100550 _____ () C:\Users\Jule\Downloads\Sitzung _Bioethik und Bewertungskompetenz_.zip
2014-09-20 14:41 - 2014-09-20 14:41 - 00456876 _____ () C:\Users\Jule\Downloads\Formalia (Semesterplan, Literatur und Anforderungen).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 03124946 _____ () C:\Users\Jule\Downloads\Lehrversuche(8).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 02135274 _____ () C:\Users\Jule\Downloads\Lehrversuche(9).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 01311036 _____ () C:\Users\Jule\Downloads\Lehrversuche(12).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 00798977 _____ () C:\Users\Jule\Downloads\Lehrversuche(10).zip
2014-09-20 14:32 - 2014-09-20 14:32 - 00598698 _____ () C:\Users\Jule\Downloads\Lehrversuche(11).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 04798931 _____ () C:\Users\Jule\Downloads\Lehrversuche(4).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 03076604 _____ () C:\Users\Jule\Downloads\Lehrversuche(6).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 01114637 _____ () C:\Users\Jule\Downloads\Lehrversuche(5).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 00638437 _____ () C:\Users\Jule\Downloads\Lehrversuche(7).zip
2014-09-20 14:26 - 2014-09-20 14:26 - 00399719 _____ () C:\Users\Jule\Downloads\Lehrversuche(3).zip
2014-09-20 14:25 - 2014-09-20 14:25 - 00524065 _____ () C:\Users\Jule\Downloads\Lehrversuche(2).zip
2014-09-20 14:19 - 2014-09-20 14:19 - 04053469 _____ () C:\Users\Jule\Downloads\Lehrversuche(1).zip
2014-09-20 14:14 - 2014-09-20 14:15 - 02722777 _____ () C:\Users\Jule\Downloads\Lehrversuche.zip
2014-09-17 19:13 - 2014-10-13 22:29 - 00000000 ____D () C:\Users\Jule\Desktop\Eigene UV´s
2014-09-16 22:34 - 2014-09-20 15:09 - 00000000 ____D () C:\Users\Jule\Desktop\Unterrichtsmaterialien
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-15 20:01 - 2011-04-19 18:25 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-15 20:01 - 2011-04-19 18:25 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-15 20:01 - 2010-09-20 02:07 - 01072091 _____ () C:\Windows\WindowsUpdate.log
2014-10-15 14:59 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-15 14:59 - 2009-07-14 06:45 - 00015568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-15 14:57 - 2013-05-07 11:21 - 00000000 ___RD () C:\Users\Jule\Dropbox
2014-10-15 14:57 - 2013-05-07 11:18 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Dropbox
2014-10-15 14:57 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Spotify
2014-10-15 14:57 - 2011-09-02 17:02 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Skype
2014-10-15 14:51 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-15 14:51 - 2009-07-14 06:51 - 00184928 _____ () C:\Windows\setupact.log
2014-10-14 21:49 - 2011-11-28 17:27 - 00463872 ___SH () C:\Users\Jule\Documents\Thumbs.db
2014-10-14 12:29 - 2010-09-20 02:04 - 00171080 _____ () C:\Windows\PFRO.log
2014-10-13 13:59 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-11 16:42 - 2010-09-20 11:59 - 02996880 _____ () C:\Windows\system32\perfh007.dat
2014-10-11 16:42 - 2010-09-20 11:59 - 00881312 _____ () C:\Windows\system32\perfc007.dat
2014-10-11 16:42 - 2009-07-14 07:13 - 00005438 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-09 21:33 - 2012-10-28 22:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\SoftGrid Client
2014-10-09 19:33 - 2012-01-02 21:59 - 00588800 ___SH () C:\Users\Jule\Desktop\Thumbs.db
2014-10-02 10:26 - 2013-05-31 20:30 - 00052224 _____ () C:\Users\Jule\Documents\Write1.aww
2014-10-02 10:26 - 2011-05-22 08:37 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\CorelHomeOffice
2014-10-02 10:07 - 2013-12-25 14:40 - 00000000 ____D () C:\Program Files\HP
2014-10-02 08:18 - 2010-09-20 02:24 - 00006804 _____ () C:\Windows\DPINST.LOG
2014-10-02 08:08 - 2013-11-25 10:20 - 00000000 ____D () C:\ProgramData\Avira
2014-10-01 12:05 - 2012-05-17 17:40 - 00000000 ____D () C:\Users\Jule\AppData\Local\Spotify
2014-09-28 19:14 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-28 19:10 - 2011-04-17 11:00 - 00000000 ____D () C:\Users\Jule
2014-09-27 20:36 - 2011-08-16 23:16 - 00000000 ____D () C:\Windows\Minidump
2014-09-27 20:35 - 2011-08-16 23:16 - 471519071 _____ () C:\Windows\MEMORY.DMP
2014-09-27 20:34 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\addins
2014-09-25 20:23 - 2012-05-21 00:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-25 18:25 - 2014-05-14 16:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-21 21:55 - 2011-04-17 11:01 - 00116584 _____ () C:\Users\Jule\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-21 21:55 - 2009-07-14 06:45 - 00437784 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-20 14:07 - 2011-11-28 17:28 - 00000000 ____D () C:\Users\Jule\Documents\Uni
2014-09-20 14:05 - 2014-04-07 15:13 - 00000000 ____D () C:\Users\Jule\Desktop\Mama Geb
2014-09-20 13:47 - 2014-09-13 18:15 - 00000000 ___RD () C:\Users\Jule\Desktop\Referendariat GS OPF 2014-2016
2014-09-20 13:03 - 2013-05-07 11:21 - 00001017 _____ () C:\Users\Jule\Desktop\Dropbox.lnk
2014-09-20 13:03 - 2013-05-07 11:19 - 00000000 ____D () C:\Users\Jule\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-15 09:06 - 2011-05-02 20:54 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
Some content of TEMP:
====================
C:\Users\Jule\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpx_gn1s.dll
C:\Users\Jule\AppData\Local\Temp\Quarantine.exe
C:\Users\Jule\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-06 20:09
==================== End Of Log ============================
--- --- --- |
|
16.10.2014, 13:06
| #12 |
| /// the machine /// TB-Ausbilder | Fremde Seiten im Browserverlauf Java, Flash und Adobe updaten. Windows updaten, da fehlt ein ganzes Servicepack!!! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2870272 2011-02-26] (Microsoft Corporation) <==== ATTENTION
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Fremde Seiten im Browserverlauf |
| besuch, besucht, fehlercode 0x5, fehlercode 0x800b0100, fehlercode windows, festgestellt, fremde, gestellt, hacker, seite, seiten, unterwegs, vbs/kryptik.bo, virus, win32/bundled.toolbar.ask, win32/bundled.toolbar.ask.d, win32/bundled.toolbar.ask.e, win32/hackkms.a |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
