| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
26.10.2014, 20:10
| #1 |
 |  Win 7 (64): Links im Browser unterstrichen; eDeals, SlamDunk Savings u.v.m. Hallo zusammen, auf dem PC eines Bekannten hat sich wirklich alles eingenistet was Rang und Namen hat ... Seit gestern versuche ich der Sache Herr zu werden - mit mäßigem Erfolg. Bin inzwischen etwas ratlos. Bisher habe ich folgende Programme eingesetzt, zum Teil mehrmals: MBAM, ESET, JRT, FRST, TFC, RKill, SC-Cleaner, ADW Cleaner ... Teilweise habe ich die Funde entfernen lassen, teilweise manuell nachgearbeitet und auch die hosts-Datei habe ich gereinigt. Nachdem der PC anfangs kaum noch lauffähig war und nicht mehr ins Internet kam, ist die Verbesserung jetzt schon deutlich, aber es scheinen immer noch aktive Reste da zu sein (siehe Titel) und auch schon gereinigte Einträge (z.B. Proxy und Browsererweiterungen) verstellen sich wieder/sind plötzlich wieder da. Welche Logs soll ich Euch zur Verfügung stellen: alle bisherigen oder soll ich nochmal ganz neue machen? Anbei schon mal die beiden 1. Logs von FRST (Stand: gestern): Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-10-2014
Ran by Admin (administrator) on ADMIN-PC on 25-10-2014 12:37:42
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: Admin)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2922496 2011-06-16] (Eastman Kodak Company)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [Ocs_SM] => C:\Users\Admin\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2012-11-10] (OCS)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [242192 2008-02-29] (Logicool, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [370176 2010-06-17] (shbox.de)
HKLM-x32\...\Run: [Conime] => %windir%\system32\conime.exe
HKLM-x32\...\Run: [DATAMNGR] => C:\PROGRA~2\SEARCH~2\Datamngr\DATAMN~2.EXE
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Updater] => C:\ProgramData\Updater\Updater.exe [486264 2013-12-18] (Updater)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [fst_de_31] => C:\Program Files (x86)\fst_de_31\fst_de_31.exe [3989968 2014-06-02] ()
HKLM-x32\...\Run: [fst_de_24] => C:\Program Files (x86)\fst_de_24\fst_de_24.exe [3983824 2014-05-26] ()
HKLM-x32\...\Run: [fst_de_37] => C:\Program Files (x86)\fst_de_37\fst_de_37.exe [3984864 2014-06-06] ()
HKLM-x32\...\Run: [BService] => C:\Program Files (x86)\Bench\BService\1.1\bservice.exe [89088 2014-06-17] ()
HKLM-x32\...\Run: [BService64] => C:\Program Files (x86)\Bench\BService\1.1\bservice64.exe [109056 2014-06-17] ()
HKLM-x32\...\Run: [Wd] => C:\Program Files (x86)\Bench\Wd\wd.exe [92672 2014-06-17] ()
HKLM-x32\...\Run: [Bench Communicator Watcher] => C:\Program Files (x86)\Bench\Proxy\pwdg.exe [127488 2014-07-15] ()
HKLM-x32\...\Run: [Bench Settings Cleaner] => C:\Program Files (x86)\Bench\Proxy\cl.exe [55296 2014-07-15] ()
HKLM-x32\...\Run: [fst_de_48] => C:\Program Files (x86)\fst_de_48\fst_de_48.exe [3980280 2014-06-17] ()
HKLM-x32\...\Run: [fst_de_56] => C:\Program Files (x86)\fst_de_56\fst_de_56.exe [3979760 2014-06-20] ()
HKLM-x32\...\Run: [eDealsPop] => C:\Program Files (x86)\eDealsPop\eDealsPop.exe [7168 2014-07-17] ()
HKLM-x32\...\Run: [fst_de_89] => C:\Program Files (x86)\fst_de_89\fst_de_89.exe [3975136 2014-07-04] ()
HKLM-x32\...\Run: [AnyProtect Scanner] => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [6210048 2014-10-18] (AnyProtect.com)
HKLM-x32\...\Run: [ConvertAd] => C:\Users\Admin\AppData\Local\ConvertAd\ConvertAd.exe [2097152 2014-10-18] ()
HKLM-x32\...\Run: [eDealPop] => C:\Program Files (x86)\eDealPop\eDealPop.exe [7168 2014-09-23] ()
HKLM-x32\...\RunOnce: [SlamDunk Savings-repairJob] => wscript.exe "C:\Users\Admin\AppData\Local\SlamDunk Savings\repair.js" "SlamDunk Savings-repairJob"
HKLM-x32\...\RunOnce: [upfst_de_37.exe] => C:\Users\Admin\AppData\Local\fst_de_37\upfst_de_37.exe [3268600 2014-06-06] ()
HKLM-x32\...\RunOnce: [upfst_de_48.exe] => C:\Users\Admin\AppData\Local\fst_de_48\upfst_de_48.exe [3341280 2014-06-17] ()
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware <====== ATTENTION
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Google Update] => C:\Users\Admin\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-06-24] (Google Inc.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [135672 2013-06-07] (PC Utilities Pro)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [NTRedirect] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Driver Pro] => C:\Program Files (x86)\Driver Pro\DPLauncher.exe [340512 2012-10-30] (PC Utilities Pro)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Google+ Auto Backup] => C:\Users\Admin\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe [3619096 2014-01-06] (Google Inc.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Driver Detective] => c:\Program Files (x86)\PC Drivers HeadQuarters\Driver Detective\DriversHQ.DriverDetective.Client.exe /applicationMode:systemTray /showWelcome:false
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [BlockNSurf] => C:\Program Files (x86)\BlockAndSurf-soft\BlockNSurf.exe [131584 2014-05-22] (Revizer)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [InetStat] => C:\Users\Admin\AppData\Roaming\InetStat\inetstat.exe [661984 2014-06-19] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Wallpaper Changer] => C:\Program Files (x86)\Wallpaper Changer\Wallpaper Changer.exe [735744 2013-07-22] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Desk 365] => C:\Program Files (x86)\Desk 365\desk365.exe [979024 2013-08-15] (337 Technology Limited.)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [LookThisUp] => C:\Users\Admin\AppData\Roaming\LookThisUp\LookThisUp.exe [1848976 2014-10-17] (LookThisUp)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [Gameo] => C:\Users\Admin\AppData\Roaming\Gameo\gameo.exe [41402880 2014-09-22] ()
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [6501656 2014-10-23] (Piriform Ltd)
HKU\S-1-5-21-1148584671-988621172-509042803-1000\...\MountPoints2: {5ef23c01-9e5c-11e0-870b-f46d049c6454} - F:\pushinst.exe
HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"
HKU\S-1-5-18\...\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BoostUpdater.lnk
ShortcutTarget: BoostUpdater.lnk -> C:\Program Files (x86)\Boost\BoostUpdater.exe ()
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Internet.lnk
ShortcutTarget: FRITZ!DSL Internet.lnk -> C:\Program Files (x86)\FRITZ!DSL\FritzDsl.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk
ShortcutTarget: FRITZ!DSL Startcenter.lnk -> C:\Program Files (x86)\FRITZ!DSL\StCenter.exe (AVM Berlin)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe (MyPCBackup.com)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:12335
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x20DDE2C42F30CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.doko-search.com/?babsrc=HP_ss&mntrId=B8B800040EFFA4E0&affID=125836&tsp=5036
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.gboxapp.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
URLSearchHook: HKLM-x32 - (No Name) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - No File
URLSearchHook: HKLM-x32 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File
URLSearchHook: HKLM-x32 - (No Name) - {78e516ef-11de-47a1-8364-a99b917ec5ee} - No File
URLSearchHook: HKLM-x32 - MixiDJ V30 Toolbar - {1122b43d-30ee-403f-9bfa-3cc99b0caddd} - C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyDyD0AtDyEtCzztAtG0FyEtCtCtGtByB0FyCtG0DzzyCyCtGyCyE0E0DyD0FzytC0DyE0FtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=253987623&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&apn_dtid=IME001&apn_ptnrs=AG1&o=APN10653&apn_uid=5717501305144874&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=406&v=u8483-63&apn_uid=6428064209614225&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2431} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=109&systemid=431&apn_uid=6428064209614225&apn_dtid=BND431&o=APN10656&apn_ptnrs=AGH&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=0&systemid=406&v=u8483-63&apn_uid=6428064209614225&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = http://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=DE&userid=63171a59-6610-4a66-a522-e88533aa79b4&searchtype=ds&q={searchTerms}&installDate=31/07/2013
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = http://go.1und1.de/suchbox/1und1suche?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.doko-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=B8B800040EFFA4E0&affID=125836&tsp=5036
SearchScopes: HKCU - {0FB3AFB5-96B1-4E17-903E-84DCA71AC24D} URL =
SearchScopes: HKCU - {1CB43718-27AE-4507-B589-041D5B30C2CD} URL = http://go.web.de/suchbox/ebay?query={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1401989824&from=cor&uid=395049983_1052515_B8B8DDED&q={searchTerms}
SearchScopes: HKCU - {4232C44C-4F56-4E94-B0B6-71E7A81800F2} URL = http://go.1und1.de/suchbox/amazon?tag=1und1icon-21&field-keywords={searchTerms}
SearchScopes: HKCU - {45764BD6-439B-4B8B-A7C7-E3BB4F8E6CF7} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=cmi_14_15_ff&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzztAtAtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyD0CyCyEzy0E0EtBtGyB0D0FyBtG0D0CyBtAtGtBtCyEyDtGtDtCzytCzzyEzztDyBzzyCtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=726051576&ir=
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = http://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = http://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = http://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=md_14_19_ch&cd=2XzuyEtN2Y1L1Qzu0FyEyC0DtDyEzy0CyCyEyDyE0D0D0E0DtN0D0Tzu0SzzyDyBtN1L2XzutBtFtBtDtFyCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyDyD0AtDyEtCzztAtG0FyEtCtCtGtByB0FyCtG0DzzyCyCtGyCyE0E0DyD0FzytC0DyE0FtA2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtB0DtAyD0Azy0BtGyB0ByBtCtGzztD0BzztGzzyC0AyDtGtD0CtBzytBtAtBzy0BzzyB0D2Q&cr=253987623&ir=
SearchScopes: HKCU - {81CE708B-5104-4C62-B333-94B417473B29} URL = http://go.mail.com/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2001} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1083&systemid=1&v=a12281-123&apn_uid=6428064209614225&apn_dtid=IME001&o=APN10653&apn_ptnrs=AGE&q={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&q={searchTerms}
SearchScopes: HKCU - {F664C955-1258-469B-A327-0360718ABF9F} URL = http://www.mysearchresults.com/search?c=3802&t=13&q={searchTerms}
BHO: CostMin -> {01662059-3EAA-C9BE-50C8-59962CD3763F} -> C:\Program Files (x86)\CostMin\FVtuTG.x64.dll ()
BHO: SmartSaver+ 8 -> {11111111-1111-1111-1111-110411891126} -> C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho64.dll (smart-saverplus)
BHO: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho64.dll (Freeven)
BHO: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension64.dll ()
BHO: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension64.dll ()
BHO: RegularDEals -> {40BD9927-8E87-34E2-1B15-CB7924F02714} -> C:\ProgramData\RegularDEals\cTvCMr.x64.dll ()
BHO: ShopDrop -> {4F8E06A1-6A0D-563E-4028-8CC35C2EC08C} -> C:\ProgramData\ShopDrop\miZSKu7FZm.x64.dll ()
BHO: JoniCaoupon -> {7CCB7D66-4562-BA7F-2F16-EFCDF2F672DC} -> C:\ProgramData\JoniCaoupon\cZi6M.x64.dll ()
BHO: DeissCounttExxTeNsi -> {85317591-8466-3F4B-B7CC-B81D51E1E3AC} -> C:\ProgramData\DeissCounttExxTeNsi\Z.x64.dll ()
BHO: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\64Boost.dll (Jigsaw)
BHO: HomeTab -> {92aa6038-35c9-4666-893f-84716dec281c} -> C:\Program Files\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
BHO: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
BHO: CheapMMe -> {a320b639-7650-485f-be02-f71b9c428c73} -> C:\ProgramData\CheapMMe\WTgXjayf3v0b2l.x64.dll ()
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: AlLSaveeR -> {E4322AD9-3FC9-7933-6633-43359B847B28} -> C:\ProgramData\AlLSaveeR\tu.x64.dll ()
BHO: SlamDunk Savings BHO -> {F33E90F9-C11A-442C-823D-F382190F93E5} -> C:\Program Files (x86)\SlamDunk Savings\FrameworkBHO64.dll ()
BHO-x32: CostMin -> {01662059-3EAA-C9BE-50C8-59962CD3763F} -> C:\Program Files (x86)\CostMin\FVtuTG.dll ()
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: 2rs3 -> {10AD2C61-0898-4348-8600-14A342F22AC3} -> C:\Program Files (x86)\SupraSavings\2rs3.dll ()
BHO-x32: Plus-HD-2.3 -> {11111111-1111-1111-1111-110311341126} -> C:\Program Files (x86)\Plus-HD-2.3\Plus-HD-2.3-bho.dll (Plus HD)
BHO-x32: SmartSaver+ 8 -> {11111111-1111-1111-1111-110411891126} -> C:\Program Files (x86)\SmartSaver+ 8\SmartSaver+ 8-bho.dll (smart-saverplus)
BHO-x32: MediaPlayerplus -> {11111111-1111-1111-1111-110511421146} -> C:\Program Files (x86)\MediaPlayerplus\MediaPlayerplus-bho.dll (Freeven)
BHO-x32: MixiDJ V30 Toolbar -> {1122b43d-30ee-403f-9bfa-3cc99b0caddd} -> C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
BHO-x32: 1und1 Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: V-bates -> {21EAF666-26B3-4a3c-ABD0-CA2F5A326744} -> C:\Program Files\V-bates\Extension32.dll ()
BHO-x32: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension32.dll ()
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: dokotoolbar Helper Object -> {3B9F6E59-04CA-43FF-92DF-F6E66D3A8D82} -> C:\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\bh\dokotoolbar.dll (Doko-Toolbar)
BHO-x32: RegularDEals -> {40BD9927-8E87-34E2-1B15-CB7924F02714} -> C:\ProgramData\RegularDEals\cTvCMr.dll ()
BHO-x32: Tube Dimmer -> {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} -> C:\ProgramData\TubeDimmer\IE\common.dll (Creative Island Media, LLC)
BHO-x32: Music Box Toolbar (Dist. by iMesh, Inc.) -> {45177936-603b-4261-8d42-df6f7091d5d0} -> C:\PROGRA~2\MUSICT~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
BHO-x32: ShopDrop -> {4F8E06A1-6A0D-563E-4028-8CC35C2EC08C} -> C:\ProgramData\ShopDrop\miZSKu7FZm.dll ()
BHO-x32: TBSB01620 Class -> {58124A0B-DC32-4180-9BFF-E0E21AE34026} -> C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
BHO-x32: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -> C:\Program Files (x86)\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: No Name -> {78e516ef-11de-47a1-8364-a99b917ec5ee} -> No File
BHO-x32: JoniCaoupon -> {7CCB7D66-4562-BA7F-2F16-EFCDF2F672DC} -> C:\ProgramData\JoniCaoupon\cZi6M.dll ()
BHO-x32: DefaultTab Browser Helper -> {7F6AFBF1-E065-4627-A2FD-810366367D01} -> C:\Users\Admin\AppData\Roaming\defaulttab\defaulttab\DefaultTabBHO.dll (Search Results LLC.)
BHO-x32: DeissCounttExxTeNsi -> {85317591-8466-3F4B-B7CC-B81D51E1E3AC} -> C:\ProgramData\DeissCounttExxTeNsi\Z.dll ()
BHO-x32: No Name -> {872b5b88-9db5-4310-bdd0-ac189557e5f5} -> No File
BHO-x32: Boost -> {8DE6FC60-E023-4AD7-A3B7-591E1460E7F7} -> C:\Program Files (x86)\Boost\Boost.dll (Jigsaw)
BHO-x32: BlockAndSurf -> {8E9C1CC8-FCEC-F858-9CEC-A4143CA5EE64} -> C:\Program Files (x86)\BlockAndSurf-soft\170.dll ()
BHO-x32: HomeTab -> {92aa6038-35c9-4666-893f-84716dec281c} -> C:\Program Files (x86)\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
BHO-x32: Searchqu Toolbar -> {99079a25-328f-4bd4-be04-00955acaa0a7} -> C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
BHO-x32: No Name -> {990af1c2-5a27-4460-8149-ecc6bc122af3} -> No File
BHO-x32: DealPly Shopping -> {9cf699ca-2174-4ed8-bec1-ba82095edce0} -> C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly)
BHO-x32: DataMngr -> {9D717F81-9148-4f12-8568-69135F087DB0} -> C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
BHO-x32: CheapMMe -> {a320b639-7650-485f-be02-f71b9c428c73} -> C:\ProgramData\CheapMMe\WTgXjayf3v0b2l.dll ()
BHO-x32: Wajam -> {A7A6995D-6EE1-4FD1-A258-49395D5BF99C} -> C:\Program Files (x86)\Wajam\IE\priam_bho.dll (Wajam)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Search-Results Toolbar -> {bff6b2ca-366c-4a90-b685-d87776deb0d2} -> C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
BHO-x32: delta Helper Object -> {C1AF5FA5-852C-4C90-812E-A7F75E011D87} -> C:\Program Files (x86)\Delta\delta\1.8.22.0\bh\delta.dll (Delta-search.com)
BHO-x32: IEExtension.Extension -> {d40c654d-7c51-4eb3-95b2-1e23905c2a2d} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: 1&&1 Internet AG Browser Configuration by mquadr.at -> {D48FF4B4-E68F-47D1-8E25-81A0F0EEB341} -> C:\Windows\SysWow64\ieconfig_1und1.dll (mquadr.at software engineering und consulting GmbH)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: FlowSurf -> {E3F1CA13-EA0E-4617-8D03-3EAA6A94A7E0} -> C:\Program Files (x86)\Flowsurf\FlowSurf.dll (FlowSurf Inc.)
BHO-x32: AlLSaveeR -> {E4322AD9-3FC9-7933-6633-43359B847B28} -> C:\ProgramData\AlLSaveeR\tu.dll ()
BHO-x32: mysearchdial Helper Object -> {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} -> C:\Program Files (x86)\Mysearchdial\1.8.29.0\bh\mysearchdial.dll (MySearchDial)
BHO-x32: SlamDunk Savings BHO -> {F33E90F9-C11A-442C-823D-F382190F93E5} -> C:\Program Files (x86)\SlamDunk Savings\FrameworkBHO.dll ()
BHO-x32: PricePeep -> {FD6D90C0-E6EE-4BC6-B9F7-9ED319698007} -> C:\Program Files (x86)\PricePeep\pricepeep.dll (PricePeep)
BHO-x32: Yontoo Layers -> {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} -> C:\Program Files (x86)\Yontoo Layers\YontooIEClient.dll (Yontoo Technology, Inc.)
BHO-x32: BonanzaDeals -> {fe063412-bea4-4d76-8ed3-183be6220d17} -> C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - HomeTab - {92aa6038-35c9-4666-893f-84716dec281c} - C:\Program Files\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKLM-x32 - IMinent Toolbar - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
Toolbar: HKLM-x32 - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll No File
Toolbar: HKLM-x32 - Search-Results Toolbar - {bff6b2ca-366c-4a90-b685-d87776deb0d2} - C:\Program Files (x86)\iMesh Applications\Mediabar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.22.0\deltaTlbr.dll (Delta-search.com)
Toolbar: HKLM-x32 - Music Box Toolbar (Dist. by iMesh, Inc.) - {45177936-603b-4261-8d42-df6f7091d5d0} - C:\PROGRA~2\MUSICT~1\Datamngr\SRTOOL~1\IE\searchresultsDx.dll No File
Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - MixiDJ V30 Toolbar - {1122b43d-30ee-403f-9bfa-3cc99b0caddd} - C:\Program Files (x86)\MixiDJ_V30\prxtbMixi.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - dokotoolbar Toolbar - {339E1B37-76D3-4A64-A988-E81425DF831C} - C:\Program Files (x86)\Doko-Toolbar\dokotoolbar\1.8.26.9\dokotoolbarTlbr.dll (Doko-Toolbar)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - mysearchdial Toolbar - {3004627E-F8E9-4E8B-909D-316753CBA923} - C:\Program Files (x86)\Mysearchdial\1.8.29.0\mysearchdialTlbr.dll (MySearchDial)
Toolbar: HKLM-x32 - HomeTab - {92aa6038-35c9-4666-893f-84716dec281c} - C:\Program Files (x86)\HomeTab\IE\HomeTab.dll (Simply Tech LTD.)
Toolbar: HKCU - No Name - {990AF1C2-5A27-4460-8149-ECC6BC122AF3} - No File
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKCU - No Name - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} - No File
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No File
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {1122B43D-30EE-403F-9BFA-3CC99B0CADDD} - No File
DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab
DPF: HKLM-x32 {25C29129-E95F-4564-BFE3-000000007100} http://www.123webseite.de/builder/pages/KvikVideo-7-1-0-0.CAB
DPF: HKLM-x32 {6A060448-60F9-11D5-A6CD-0002B31F7455}
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default
FF SearchEngineOrder.1: Web Search
FF Homepage: about:home
FF Keyword.URL: hxxp://search.certified-toolbar.com?si=80415&tid=23890&ver=7.0&ts=1401919200000.000008&tguid=80415-23890-1401947521251-95342E6BC630F016FA9FF4BDE1CD25F7&st=chrome&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=3 -> C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.bdupdater.com/BonanzaDealsLive Update;version=9 -> C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=3 -> C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=9 -> C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin -> C:\Users\Admin\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\user.js
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Admin\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: SmartSaver+ 8 - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\16eede48-12e9-4c79-bd54-c82622138533@630d8a34-73af-4e03-9664-9082492eb220.com [2014-07-12]
FF Extension: SaveRExtension - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\34jvio_gjv@oeou-chhvgi.com [2014-06-11]
FF Extension: MediaPlayerplus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\a9719e64-232b-4695-ae9c-a89cd7f2aa84@ca1279df-bc0d-44a8-97ef-19301c922b68.com [2014-07-12]
FF Extension: EnjoyCouupon - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\aeiioeu5eu@ckzsyuoua.org [2014-05-22]
FF Extension: Arabic spell-checking dictionary - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\ar@dictionaries.addons.mozilla.org [2014-02-08]
FF Extension: DoNotTrackMe: Online Privacy Protection - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\donottrackplus@abine.com [2014-07-12]
FF Extension: DiScounntExtensi - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\eoi7r@iyu-oo.net [2014-08-09]
FF Extension: CheapMeu - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\G7ueJAIY@k.net [2014-09-28]
FF Extension: WinDealist - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\m4@windealist.com [2014-04-29]
FF Extension: CostMin - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\nb8gd.evi@ujxrstqbev.co.uk [2014-05-04]
FF Extension: Fun2SAvE - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\nsmalxxmp-bmfw@d-mktib.co.uk [2014-05-11]
FF Extension: AllSaVer - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\pnuka_oye@ueqr-joa.edu [2014-07-07]
FF Extension: Quick Start - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\quick_start@gmail.com [2014-06-05]
FF Extension: Tube Dimmer - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\support@tubedimmerapp.com [2014-01-23]
FF Extension: SlamDunk Savings - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{4EE52A10-7106-03E8-5290-170ABA79C05E} [2014-06-19]
FF Extension: HomeTab - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{83d6be19-6d32-4dcc-a6cf-637a5ec1afc5} [2014-10-20]
FF Extension: Ask New Tabs - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{E6F07F01-931E-800B-40D4-0043A11BDE51} [2014-04-09]
FF Extension: Boost - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\boost@boost.net.xpi [2014-05-16]
FF Extension: Boo.ly Shopping - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\getbooly@boo.ly.xpi [2014-06-19]
FF Extension: Foxtab Speed Dial - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab}.xpi [2014-06-22]
FF Extension: MySearchDial - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}.xpi [2014-05-07]
FF Extension: DownThemAll! - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-03-22]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-06-01]
FF HKLM\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Web Assistant\Firefox
FF HKLM\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF Extension: V-bates - C:\Program Files\V-bates\Firefox [2014-04-12]
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{8E9E3331-D360-4f87-8803-52DE43566502}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ucsimvlj.default\extensions\quick_start@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [{20d1f7b3-7721-4da0-b6f3-78bb4d7248f4}] - C:\Program Files (x86)\Browser Guard\browserguard.xpi
FF Extension: Browser Guard - C:\Program Files (x86)\Browser Guard\browserguard.xpi [2014-02-24]
FF HKLM-x32\...\Firefox\Extensions: [{21EAF666-26B3-4a3c-ABD0-CA2F5A326744}] - C:\Program Files\V-bates\Firefox
FF HKLM-x32\...\Firefox\Extensions: [jid1-tofUlNEIFlkUIA@jetpack] - C:\Program Files (x86)\Flowsurf\jid1-tofUlNEIFlkUIA@jetpack
FF Extension: FlowSurf - C:\Program Files (x86)\Flowsurf\jid1-tofUlNEIFlkUIA@jetpack [2014-07-10]
FF HKCU\...\Firefox\Extensions: [{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}] - C:\Program Files (x86)\PriceGong\2.5.0\FF
FF Extension: PriceGong - C:\Program Files (x86)\PriceGong\2.5.0\FF [2011-07-04]
FF HKCU\...\Firefox\Extensions: [{b5ad6039-a173-4149-9dcf-d04371526253}] - C:\Program Files (x86)\Lyrics_Monkey\131.xpi
FF HKCU\...\Firefox\Extensions: [{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}] - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba}
FF Extension: Show Mask ON - C:\ProgramData\SExtension\SExtension\{354dbb0a-71d5-4e9f-9c02-6c88b9d387ba} [2014-01-29]
FF HKCU\...\Firefox\Extensions: [{FF76B0FA-B825-A4AB-2FCC-2B2CAD781266}] - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi
FF Extension: No Name - C:\Program Files (x86)\BlockAndSurf-soft\170.xpi [2014-05-22]
FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Shockwave Flash) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - F:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Wajam) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24_0\plugins/PriamNPAPI.dll No File
CHR Plugin: (Adobe Acrobat) - F:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.170.4) - F:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll No File
CHR Plugin: (2007 Microsoft Office system) - F:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.1) - F:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (Winamp Application Detector) - F:\Program Files\Mozilla Firefox\plugins\npwachk.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npdrmv2.dll No File
CHR Plugin: (Microsoft® DRM) - F:\Program Files\Windows Media Player\npwmsdrm.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - F:\Program Files\Windows Media Player\npdsplay.dll No File
CHR Plugin: (Google Update) - F:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - F:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - F:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll No File
CHR Plugin: (iTunes Application Detector) - F:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Ma-Config.com plugin) - F:\Program Files\ma-config.com\nphardwaredetection.dll No File
CHR Plugin: (Silverlight Plug-In) - f:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Music Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaihhnfnbnpbhpagnmoplpcjbediml [2013-08-19]
CHR Extension: (FoxyDeal) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiennapmieppnpfhhogglccgepbdajan [2014-04-09]
CHR Extension: (Search-Gol Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aipfmkinhleccnodemkoofnnofpbbpac [2013-10-03]
CHR Extension: (MixiDJ Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\boipimhfjpakfgckhbljjengakjhkcbp [2013-08-19]
CHR Extension: (Doko Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\edcikfknpchdehdlmjpbofgkoaonaijg [2014-04-09]
CHR Extension: (DealPly French) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi [2014-04-09]
CHR Extension: (Renren Album Downloader) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\enmkdplopmpkfnlefdldpkbcmihgcdec [2014-08-09]
CHR Extension: (SlamDunk Savings) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eoofckbahbagadoifcjabhaklkhjmafo [2014-06-21]
CHR Extension: (Delta Toolbar) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde [2013-08-19]
CHR Extension: (MixiDJ V30) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdkednngfjmpnljkolbapdednncafhen [2013-08-19]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iagcajndpnfncplednpbnkahadegklfa [2014-04-16]
CHR Extension: (YouTurn) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\icphmmimmfdlgaaglejeokffekamhplg [2014-09-28]
CHR Extension: (Lightning Newtab) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2014-07-10]
CHR Extension: (Tube Dimmer) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb [2014-09-04]
CHR Extension: (DefaultTab) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc [2014-07-10]
CHR Extension: (Torch Share) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof [2014-04-09]
CHR Extension: (SmartSaver+ 8) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\klhlfdbffplhpkpalkmacjejfbdeefaj [2014-04-12]
CHR Extension: (MediaPlayerplus) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd [2014-04-12]
CHR Extension: (Giant Savings) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndkhncnongaclekkbelchmeafffimifj [2014-04-09]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]
CHR Extension: (FlowSurf) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oglkiljdmflopemijdadoiepkhcaodjn [2014-07-10]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2013-07-26]
CHR HKCU\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Admin\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-08-07]
CHR HKLM-x32\...\Chrome\Extension: [aaaaihhnfnbnpbhpagnmoplpcjbediml] - C:\Users\Admin\AppData\Local\imeshmusicboxtoolbar\GC\toolbar.crx [2013-06-19]
CHR HKLM-x32\...\Chrome\Extension: [aiennapmieppnpfhhogglccgepbdajan] - C:\Program Files (x86)\FoxyDeal\foxydeal.crx [2013-06-14]
CHR HKLM-x32\...\Chrome\Extension: [aipfmkinhleccnodemkoofnnofpbbpac] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\searchgol.crx [2013-10-03]
CHR HKLM-x32\...\Chrome\Extension: [boipimhfjpakfgckhbljjengakjhkcbp] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\mixiDj.crx [2013-08-18]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2013-07-26]
CHR HKLM-x32\...\Chrome\Extension: [edcikfknpchdehdlmjpbofgkoaonaijg] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Doko.crx [2013-10-15]
CHR HKLM-x32\...\Chrome\Extension: [ejnmnhkgiphcaeefbaooconkceehicfi] - C:\Program Files (x86)\DealPly\DealPly.crx [2013-05-08]
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Admin\AppData\Roaming\BabSolution\CR\Delta.crx [2013-06-14]
CHR HKLM-x32\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Admin\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-08-07]
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-09-05]
CHR HKLM-x32\...\Chrome\Extension: [jpmbfleldcgkldadpdinhjjopdfpjfjp] - C:\Users\Admin\AppData\Local\Wajam\Chrome\wajam.crx [2013-05-02]
CHR HKLM-x32\...\Chrome\Extension: [kdidombaedgpfiiedeimiebkmbilgmlc] - C:\Program Files (x86)\DefaultTab\DefaultTab.crx [2013-10-07]
CHR HKLM-x32\...\Chrome\Extension: [kiplfnciaokpcennlkldkdaeaaomamof] - C:\Users\Admin\AppData\Local\Torch\Plugins\TorchPlugin.crx [2013-08-01]
CHR HKLM-x32\...\Chrome\Extension: [kmmjjcoppdcpcdlonfflbdabbkhnnogm] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\chromeExtension.crx [2013-08-01]
CHR HKLM-x32\...\Chrome\Extension: [ndkhncnongaclekkbelchmeafffimifj] - C:\Users\Admin\AppData\Local\Giant Savings\Chrome\Giant Savings.crx [2012-08-08]
CHR HKLM-x32\...\Chrome\Extension: [ofnnlhbgdcabppjmlijllkhekcglbjlg] - C:\Program Files (x86)\Lyrics_Monkey\131.crx [2012-08-08]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AVM IGD CTRL Service; C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE [81920 2005-11-21] (AVM Berlin) [File not signed]
S2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed]
S2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [36936 2014-09-28] (Just Develop It) <==== ATTENTION
S2 be0fb33b; c:\Program Files (x86)\Supporter\SupporterSvc.dll [179536 2014-05-04] () [File not signed]
S2 BlockAndSurf; C:\Program Files (x86)\BlockAndSurf-soft\BlockAndSurfgd170.exe [179200 2014-05-22] () [File not signed]
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-03] (BonanzaDeals)
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [148976 2013-10-03] (BonanzaDeals)
S2 ControlDefaultMotion.exe; C:\Users\Admin\AppData\Local\ControlDefaultMotion\ControlDefaultMotion.exe [158720 2014-10-13] () [File not signed]
S2 CouponDownloaderService64; C:\Program Files (x86)\A6ADCE5D-859A-4E7E-B0B2-D07F8AB9237E\CouponDownloaderService64.exe [172544 2014-06-06] () [File not signed]
S4 DefaultTabSearch; C:\Program Files (x86)\DefaultTab\DefaultTabSearch.exe [574464 2013-12-20] () [File not signed]
S4 DefaultTabUpdate; C:\Users\Admin\AppData\Roaming\defaulttab\defaulttab\dtupdate.exe [107520 2013-12-11] () [File not signed]
S4 desksvc; C:\Program Files (x86)\Desk 365\deskSvc.exe [424016 2013-08-15] (337 Technology Limited.) <==== ATTENTION
S3 de_serv; C:\Program Files (x86)\Common Files\AVM\de_serv.exe [315392 2005-11-21] (AVM Berlin) [File not signed]
S4 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
S2 InteractiveOfficeWord; C:\Windows\SysWOW64\InteractiveOfficeWord\InteractiveOfficeWord.exe [68096 2014-10-13] () [File not signed]
S2 InternetUpdater; C:\ProgramData\InternetUpdater\InternetUpdaterService.exe [45568 2014-01-15] (Parallel Lines Development, LLC) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
S2 MovieMode; C:\ProgramData\MovieMode\MovieMode.exe [152208 2014-03-21] (GenTechnologies Apps, LLC)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
S2 PirritUpdater; C:\Program Files (x86)\Pirrit\AutoUpdater.exe [59904 2014-02-20] () [File not signed]
S2 Registry Helper Service; C:\Program Files (x86)\Registry Helper\RegistryHelperService.exe [84328 2014-01-26] (SafeApp Software, LLC)
S2 rqpbhevlkc64; C:\Program Files\004\rqpbhevlkc64.exe [709120 2014-05-22] () [File not signed]
S2 SearchAnonymizer; C:\Users\Admin\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2012-11-10] () [File not signed]
S2 serviceIEConfig; C:\Windows\SysWOW64\ieconfig_1und1_svc.exe [1053848 2014-06-05] ()
S4 TorchCrashHandler; C:\Users\Admin\AppData\Local\Torch\Update\TorchCrashHandler.exe [1206624 2013-07-20] (TorchMedia Inc.) [File not signed] <==== ATTENTION
S2 V-bates Updater; C:\Program Files\V-bates\ExtensionUpdaterService.exe [209408 2014-02-26] () [File not signed]
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
S2 vosr; C:\Users\Admin\AppData\Roaming\VOPackage\VOsrv.exe [355328 2014-04-12] () [File not signed] <==== ATTENTION
S4 WajamUpdater; C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe [109064 2013-05-02] (Wajam) [File not signed] <==== ATTENTION
S4 Web Assistant Updater; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-07-03] () [File not signed]
S2 WinRST; C:\Program Files (x86)\WinRST\WinRST.exe [59904 2014-02-26] () [File not signed]
S4 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [566272 2014-04-12] (Cherished Technololgy LIMITED) [File not signed]
S2 0bd9c8e28672d00.exe; C:\Users\Admin\AppData\Local\910a8b731f707898fd7e649e0ad73604\0bd9c8e28672d00.exe [X]
S2 ArchiveBackupDebug.exe; C:\Users\Admin\AppData\Local\ArchiveBackupDebug\ArchiveBackupDebug.exe [X]
S2 dealplylive; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /svc [X]
S3 dealplylivem; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /medsvc [X]
S2 DebuggerFreewareNet.exe; C:\Users\Admin\AppData\Local\DebuggerFreewareNet\DebuggerFreewareNet.exe [X]
S2 DebugLogTrash.exe; C:\Users\Admin\AppData\Local\DebugLogTrash\DebugLogTrash.exe [X]
S2 FunctionLogPath.exe; C:\Users\Admin\AppData\Local\FunctionLogPath\FunctionLogPath.exe [X]
S2 Kodak AiO Status Monitor Service; "C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2010-10-22] (AVM Berlin)
S4 F06DEFF2-5B9C-490D-910F-35D3A9119622; C:\Program Files (x86)\Music Toolbar\Datamngr\x64\setmgrc1.cfg [36248 2014-04-06] (iMesh Inc)
S3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2010-10-22] (AVM GmbH)
S3 LHidFilt; C:\Windows\System32\DRIVERS\LHidFilt.Sys [54800 2008-02-29] (Logicool, Inc.)
S3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [57360 2008-02-29] (Logicool, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [41488 2008-02-29] (Logicool, Inc.)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-07-08] (NetFilterSDK.com)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
U5 TubeDimmer; C:\ProgramData\TubeDimmer\up\2.6.80\TubeDimmer.exe [42872 2014-05-02] (Creative Island Media, LLC)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S1 avbdsgdp; \??\C:\Windows\system32\drivers\avbdsgdp.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 kbavjhwt; \??\C:\Windows\system32\drivers\kbavjhwt.sys [X]
S3 RgFltX64; \??\C:\Users\Admin\AppData\Local\DebuggerFreewareNet\RgFltX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-25 12:37 - 2014-10-25 12:38 - 00057850 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-25 12:37 - 2014-10-25 12:37 - 00000000 ____D () C:\FRST
2014-10-25 12:07 - 2014-10-25 12:08 - 02112512 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-25 12:06 - 2014-10-25 12:07 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Admin\Downloads\mbam-setup-2.0.3.1025.exe
2014-10-25 12:05 - 2014-10-25 12:05 - 00709564 _____ () C:\Users\Admin\Desktop\delfix_10.8.exe
2014-10-25 12:04 - 2014-10-25 12:04 - 07864386 _____ () C:\Users\Admin\Downloads\tweaking.com_windows_repair_aio.zip
2014-10-25 12:03 - 2014-10-25 12:03 - 01962496 _____ () C:\Users\Admin\Desktop\AdwCleaner_4.001.exe
2014-10-25 12:03 - 2014-10-25 12:03 - 00448512 _____ (OldTimer Tools) C:\Users\Admin\Desktop\TFC.exe
2014-10-25 12:02 - 2014-10-25 12:02 - 01706144 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-25 11:49 - 2014-10-25 11:55 - 00000000 ____D () C:\Users\Admin\Desktop\Wartung
2014-10-25 11:46 - 2014-10-25 11:46 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-25 11:46 - 2014-10-25 11:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-25 11:46 - 2014-10-25 11:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-25 11:45 - 2014-10-25 11:46 - 04974864 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup419.exe
2014-10-22 00:03 - 2014-10-25 12:10 - 00001426 _____ () C:\Users\Admin\Desktop\Registry kostenlos entrümpeln!.lnk
2014-10-20 19:45 - 2014-10-20 19:45 - 00001015 _____ () C:\Users\Admin\Desktop\FRITZ!Box 7330 SL (UI) - Verknüpfung (2).lnk
2014-10-18 23:21 - 2014-10-18 23:21 - 00000000 ____D () C:\Windows\SysWOW64\InteractiveOfficeWord
2014-10-18 23:21 - 2014-10-18 23:21 - 00000000 ____D () C:\Program Files (x86)\eDealPop
2014-10-18 23:18 - 2014-10-22 00:42 - 00000000 ____D () C:\Users\Admin\AppData\Local\ControlDefaultMotion
2014-10-18 18:53 - 2014-10-18 18:53 - 00000146 _____ () C:\Users\Admin\Desktop\Internetoptionen - Verknüpfung.lnk
2014-10-18 18:15 - 2014-10-18 23:10 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-10-18 18:15 - 2014-10-18 23:10 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-10-18 18:15 - 2014-10-18 18:15 - 00002826 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-10-18 18:05 - 2014-10-18 18:05 - 00612065 _____ (CMI Limited) C:\Users\Admin\AppData\Local\nsv26A5.tmp
2014-10-18 17:45 - 2014-10-25 12:11 - 00000272 _____ () C:\Windows\Tasks\SpeedUpMyPC Startup.job
2014-10-18 17:45 - 2014-10-25 10:47 - 00000278 _____ () C:\Windows\Tasks\SpeedUpMyPC Maintenance.job
2014-10-18 17:45 - 2014-10-18 17:45 - 00003216 _____ () C:\Windows\System32\Tasks\SpeedUpMyPC Maintenance
2014-10-18 17:45 - 2014-10-18 17:45 - 00002504 _____ () C:\Windows\System32\Tasks\SpeedUpMyPC Startup
2014-10-18 17:09 - 2014-10-18 17:09 - 00000000 __SHD () C:\found.000
2014-10-17 23:21 - 2014-10-17 23:21 - 00000000 ___HD () C:\Users\Admin\AppData\Roaming\GoldenGate
2014-10-17 23:19 - 2014-10-17 23:19 - 00000000 __SHD () C:\Users\Admin\AppData\Roaming\AnyProtectEx
2014-10-17 23:19 - 2014-10-17 23:18 - 00612065 _____ (CMI Limited) C:\Users\Admin\AppData\Local\nsxA575.tmp
2014-10-17 23:18 - 2014-10-17 23:18 - 00000171 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
2014-10-17 23:17 - 2014-10-25 12:19 - 00000000 ____D () C:\Users\Admin\AppData\Local\Gameo
2014-10-17 23:17 - 2014-10-25 12:15 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\LookThisUp
2014-10-17 23:17 - 2014-10-17 23:17 - 00001785 _____ () C:\Users\Admin\Desktop\Gameo.lnk
2014-10-17 23:17 - 2014-10-17 23:17 - 00001771 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo.lnk
2014-10-17 23:17 - 2014-10-17 23:17 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gameo
2014-10-17 23:10 - 2014-10-22 00:42 - 00000000 ____D () C:\Users\Admin\AppData\Local\ConvertAd
2014-10-17 23:09 - 2014-10-17 23:20 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Gameo
2014-10-17 18:06 - 2014-10-17 18:06 - 00000000 ____D () C:\Users\Admin\{01662059-3E
2014-09-28 22:25 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-28 22:25 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-28 22:25 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-28 22:25 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-28 22:25 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-28 22:25 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-28 22:25 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-28 22:25 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-28 22:25 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-28 22:25 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-28 22:25 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-28 22:25 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-28 22:25 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-28 22:25 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-28 22:25 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-28 22:25 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-28 22:25 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-28 22:25 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-28 22:25 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-28 22:25 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-28 22:25 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-28 22:25 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-28 22:25 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-28 22:25 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-28 22:25 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-28 22:25 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-28 22:25 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-28 22:25 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-28 22:25 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-28 22:25 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-28 22:25 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-28 22:25 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-28 22:25 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-28 22:25 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-28 22:25 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-28 22:25 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-28 22:25 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-28 22:25 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-28 22:25 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-28 22:25 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-28 22:25 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-28 22:25 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-28 22:25 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-28 22:25 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-28 22:25 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-28 22:25 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-28 22:25 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-28 22:25 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-28 22:25 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-28 22:25 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-28 22:25 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-28 22:25 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-28 20:35 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-28 20:35 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-28 09:27 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-28 09:27 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-28 09:27 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-28 09:27 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-28 09:26 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-28 09:26 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-28 09:25 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-28 09:25 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-28 09:25 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-28 09:25 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-28 09:25 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-28 09:24 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-28 09:24 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-28 08:56 - 2014-09-28 08:58 - 00000000 ____D () C:\ProgramData\CheapMMe
2014-09-28 08:38 - 2014-10-03 16:40 - 17903792 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-25 12:32 - 2014-06-29 13:40 - 00000000 ____D () C:\Program Files\CouponDownloader
2014-10-25 12:19 - 2013-10-03 15:14 - 00000924 _____ () C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
2014-10-25 12:15 - 2014-06-19 06:51 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_48
2014-10-25 12:15 - 2014-06-12 07:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_37
2014-10-25 12:15 - 2014-05-02 12:54 - 01161080 _____ () C:\Windows\SysWOW64\TubeDimmer.EA96BC9739D9.2.6.80.dll
2014-10-25 12:14 - 2014-06-19 06:50 - 00000003 _____ () C:\Users\Admin\AppData\Local\proxy.log
2014-10-25 12:10 - 2014-06-19 06:46 - 00000344 _____ () C:\Windows\Tasks\bench-sys.job
2014-10-25 12:10 - 2014-06-19 06:46 - 00000344 _____ () C:\Windows\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000.job
2014-10-25 12:10 - 2014-05-22 12:42 - 00000424 _____ () C:\Windows\Tasks\BlockAndSurf Update.job
2014-10-25 12:10 - 2014-05-22 12:42 - 00000404 _____ () C:\Windows\Tasks\BlockAndSurf_wd.job
2014-10-25 12:10 - 2014-04-12 16:02 - 00001426 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-5.job
2014-10-25 12:10 - 2014-04-12 16:00 - 00001326 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-2.job
2014-10-25 12:10 - 2014-04-12 15:59 - 00001338 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-1.job
2014-10-25 12:10 - 2014-04-12 15:58 - 00002190 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-4.job
2014-10-25 12:10 - 2014-04-12 15:57 - 00002776 _____ () C:\Windows\Tasks\365c2923-b81b-461a-ba4b-1eba770fbbb7-3.job
2014-10-25 12:10 - 2013-10-03 15:14 - 00000920 _____ () C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
2014-10-25 12:10 - 2013-08-18 12:30 - 00001270 _____ () C:\Windows\Tasks\Feven 1.5-updater.job
2014-10-25 12:10 - 2013-08-18 12:30 - 00001082 _____ () C:\Windows\Tasks\Feven 1.5-enabler.job
2014-10-25 12:10 - 2013-08-18 12:29 - 00001184 _____ () C:\Windows\Tasks\Feven 1.5-codedownloader.job
2014-10-25 12:10 - 2013-08-18 12:27 - 00001886 _____ () C:\Windows\Tasks\Feven 1.5-chromeinstaller.job
2014-10-25 12:10 - 2013-08-03 16:19 - 00000900 _____ () C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineCore.job
2014-10-25 12:10 - 2011-06-24 16:07 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-25 12:10 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-25 12:09 - 2014-01-19 09:34 - 00015646 _____ () C:\Windows\setupact.log
2014-10-25 11:11 - 2011-06-21 00:49 - 01922628 _____ () C:\Windows\WindowsUpdate.log
2014-10-25 10:58 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-25 10:58 - 2009-07-14 06:45 - 00031680 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-25 10:57 - 2011-09-13 21:56 - 00000338 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-10-25 10:50 - 2014-06-19 06:46 - 00003240 _____ () C:\Windows\System32\Tasks\bench-sys
2014-10-25 10:50 - 2014-06-19 06:46 - 00003218 _____ () C:\Windows\System32\Tasks\bench-S-1-5-21-1148584671-988621172-509042803-1000
2014-10-25 10:48 - 2014-06-19 06:46 - 00000000 ____D () C:\Users\Admin\AppData\Local\SlamDunk Savings
2014-10-25 10:36 - 2012-03-31 08:17 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-25 10:34 - 2014-06-29 13:50 - 00003108 _____ () C:\Windows\System32\Tasks\RegClean Pro
2014-10-25 10:33 - 2014-08-21 11:18 - 00003132 _____ () C:\Windows\System32\Tasks\System Speedup
2014-10-25 10:30 - 2014-05-13 21:35 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\System Speedup
2014-10-22 19:05 - 2011-06-24 19:30 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1148584671-988621172-509042803-1000UA.job
2014-10-22 00:52 - 2010-11-21 09:01 - 00000000 ____D () C:\Program Files\Windows Journal
2014-10-22 00:45 - 2014-05-06 22:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-22 00:42 - 2014-07-26 16:15 - 00000000 ____D () C:\Users\Admin\AppData\Local\FunctionLogPath
2014-10-22 00:42 - 2014-07-10 09:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_89
2014-10-22 00:42 - 2014-07-10 09:14 - 00000000 ____D () C:\Users\Admin\AppData\Local\WPFBChanger
2014-10-22 00:42 - 2014-06-21 11:24 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_56
2014-10-22 00:42 - 2014-06-05 19:38 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_24
2014-10-22 00:42 - 2014-06-05 07:51 - 00000000 ____D () C:\Users\Admin\AppData\Local\fst_de_31
2014-10-22 00:42 - 2014-06-05 06:13 - 00000000 ____D () C:\Users\Admin\AppData\Local\f2dd4267ec6c7612b89b6123980a1fab
2014-10-22 00:42 - 2014-05-22 12:41 - 00000000 ____D () C:\Program Files (x86)\BlockAndSurf-soft
2014-10-22 00:42 - 2014-05-13 21:35 - 00000000 ____D () C:\Users\Admin\AppData\Local\emaze
2014-10-22 00:42 - 2014-04-10 08:07 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-10-22 00:42 - 2013-08-08 03:09 - 00000000 ____D () C:\Users\Admin\AppData\Local\Conduit
2014-10-22 00:42 - 2011-07-25 15:08 - 00000000 ____D () C:\Users\Admin\AppData\Local\Eastman_Kodak_Company
2014-10-22 00:42 - 2011-06-26 05:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\IM
2014-10-22 00:42 - 2011-06-24 14:27 - 00000000 ____D () C:\Users\Admin\AVM_Driver
2014-10-22 00:42 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-22 00:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-10-22 00:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration
2014-10-22 00:40 - 2012-01-09 00:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\Greyfirst
2014-10-22 00:40 - 2011-06-24 16:07 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-10-22 00:39 - 2014-05-04 00:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Comodo
2014-10-22 00:39 - 2014-05-04 00:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Chromatic Browser
2014-10-22 00:22 - 2013-08-03 16:19 - 00000290 _____ () C:\Windows\Tasks\Dealply.job
2014-10-22 00:03 - 2013-12-11 13:23 - 00001156 __RSH () C:\Users\Admin\ntuser.pol
2014-10-22 00:03 - 2011-06-24 16:07 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-22 00:03 - 2011-06-20 19:00 - 00000000 ____D () C:\Users\Admin
2014-10-21 13:20 - 2014-04-12 16:17 - 00000000 ____D () C:\Users\Admin\AppData\Local\MovieMode
2014-10-20 21:12 - 2013-08-16 00:54 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-20 20:52 - 2014-06-05 07:53 - 00000000 ____D () C:\Program Files (x86)\HomeTab
2014-10-20 20:27 - 2014-04-12 16:13 - 00000292 _____ () C:\Windows\Tasks\MySearchDial.job
2014-10-20 20:27 - 2013-08-03 16:19 - 00000904 _____ () C:\Windows\Tasks\DealPlyLiveUpdateTaskMachineUA.job
2014-10-20 19:23 - 2013-12-19 01:26 - 00000193 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG
2014-10-20 18:55 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-10-20 18:04 - 2011-11-08 18:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FRITZ!
2014-10-20 17:00 - 2010-11-21 08:50 - 00702598 _____ () C:\Windows\system32\perfh007.dat
2014-10-20 17:00 - 2010-11-21 08:50 - 00151390 _____ () C:\Windows\system32\perfc007.dat
2014-10-20 17:00 - 2009-07-14 07:13 - 01630758 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch
2014-10-20 16:22 - 2014-06-05 07:54 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater
2014-10-20 16:22 - 2013-11-09 11:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-20 16:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-20 16:21 - 2011-06-25 19:05 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-18 20:35 - 2011-11-12 15:10 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\vlc
2014-10-18 18:35 - 2014-04-12 16:01 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-10-18 18:15 - 2014-05-22 20:32 - 00002826 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-10-18 18:14 - 2014-04-15 21:15 - 00002828 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-10-18 17:41 - 2013-08-08 03:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2014-10-17 19:12 - 2014-06-05 07:52 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Activeris
2014-10-03 16:51 - 2012-03-31 08:17 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-03 16:42 - 2012-03-31 08:17 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-03 16:42 - 2011-06-21 18:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-03 16:37 - 2013-08-08 03:06 - 00000000 ____D () C:\Program Files (x86)\MyPC Backup
2014-10-03 13:07 - 2014-06-05 07:53 - 00034368 _____ () C:\Windows\Launcher.exe
2014-09-29 10:42 - 2013-12-09 12:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-29 10:26 - 2014-01-19 09:34 - 00158190 _____ () C:\Windows\PFRO.log
2014-09-28 22:20 - 2011-06-21 17:19 - 01604102 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-28 22:18 - 2013-02-28 04:09 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-09-28 22:18 - 2011-06-21 17:19 - 00001912 _____ () C:\Windows\epplauncher.mif
2014-09-28 22:18 - 2011-06-21 17:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client
2014-09-28 22:18 - 2011-06-21 17:18 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-09-28 20:38 - 2011-06-21 13:42 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-28 09:49 - 2011-06-24 18:20 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{C6295D87-0223-4913-87E0-549DC15EB489}
2014-09-28 08:59 - 2014-05-04 00:54 - 00000000 ____D () C:\ProgramData\2b58a7cbef08f6a2
Files to move or delete:
====================
C:\Users\Admin\photobooksmjpb2pah~1311301458036-5ec56f16-2b51-4723-bc50-88d0d8f055d7.js
C:\Users\Admin\photocardspah~1318247042883-e61ee557-bf45-42de-aea5-909a0eba5893.js
C:\Users\Admin\ShowScript.js
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\18be6784_.exe
C:\Users\Admin\AppData\Local\Temp\294823_.exe
C:\Users\Admin\AppData\Local\Temp\amsetup_activeris_default_010414_installer.exe
C:\Users\Admin\AppData\Local\Temp\BackupSetup.exe
C:\Users\Admin\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Admin\AppData\Local\Temp\Delta.exe
C:\Users\Admin\AppData\Local\Temp\DeltaTB.exe
C:\Users\Admin\AppData\Local\Temp\EasyLogin_setup_DE.exe
C:\Users\Admin\AppData\Local\Temp\fastagainsetup.exe
C:\Users\Admin\AppData\Local\Temp\findopolissetup.exe
C:\Users\Admin\AppData\Local\Temp\fp_pl_pfs_installer-1.exe
C:\Users\Admin\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Admin\AppData\Local\Temp\freesofttoday.exe
C:\Users\Admin\AppData\Local\Temp\gkc.exe
C:\Users\Admin\AppData\Local\Temp\hometab.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Admin\AppData\Local\Temp\mpam-7b2337eb.exe
C:\Users\Admin\AppData\Local\Temp\mpam-b138a77.exe
C:\Users\Admin\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Admin\AppData\Local\Temp\newvideoplayersetup.exe
C:\Users\Admin\AppData\Local\Temp\nsa2FFB.exe
C:\Users\Admin\AppData\Local\Temp\nsb806A.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nscFB44.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nsf34AD.exe
C:\Users\Admin\AppData\Local\Temp\nsg694A.exe
C:\Users\Admin\AppData\Local\Temp\nsp25AD.exe
C:\Users\Admin\AppData\Local\Temp\nsq5E8F.exe
C:\Users\Admin\AppData\Local\Temp\nsrD41.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nsv15DB.exe
C:\Users\Admin\AppData\Local\Temp\nsw6EEC.tmp.exe
C:\Users\Admin\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Admin\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Admin\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Admin\AppData\Local\Temp\nvStInst.exe
C:\Users\Admin\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Admin\AppData\Local\Temp\sdpupdater.exe
C:\Users\Admin\AppData\Local\Temp\SendMsg.dll
C:\Users\Admin\AppData\Local\Temp\setup_SlamDunk Savings-1.0.20141023.exe
C:\Users\Admin\AppData\Local\Temp\setup{1A91FE00-1E62-4889-9A90-09F85322BA9F}.exe
C:\Users\Admin\AppData\Local\Temp\setup{90EC946F-E8AA-4607-8B91-DC1C3F2819D1}.exe
C:\Users\Admin\AppData\Local\Temp\setup{C3142629-606B-41A8-A874-723AD72C361F}.exe
C:\Users\Admin\AppData\Local\Temp\setup{D5FDEF8D-2C39-4650-8FB8-8F5F71E951B2}.exe
C:\Users\Admin\AppData\Local\Temp\spidentifierimpl.exe
C:\Users\Admin\AppData\Local\Temp\Sqlite3.dll
C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
C:\Users\Admin\AppData\Local\Temp\tbu253B.exe
C:\Users\Admin\AppData\Local\Temp\tbu2599.exe
C:\Users\Admin\AppData\Local\Temp\tbu28E3.exe
C:\Users\Admin\AppData\Local\Temp\tbu2970.exe
C:\Users\Admin\AppData\Local\Temp\tbu29AE.exe
C:\Users\Admin\AppData\Local\Temp\tbu2BD0.exe
C:\Users\Admin\AppData\Local\Temp\tbu3726.exe
C:\Users\Admin\AppData\Local\Temp\tbu37B2.exe
C:\Users\Admin\AppData\Local\Temp\tbu4BC1.exe
C:\Users\Admin\AppData\Local\Temp\tbu669E.exe
C:\Users\Admin\AppData\Local\Temp\tbu7741.exe
C:\Users\Admin\AppData\Local\Temp\tbu7EFE.exe
C:\Users\Admin\AppData\Local\Temp\tbu7F7B.exe
C:\Users\Admin\AppData\Local\Temp\tbu9701.exe
C:\Users\Admin\AppData\Local\Temp\tbu9B45.exe
C:\Users\Admin\AppData\Local\Temp\tbu9D28.exe
C:\Users\Admin\AppData\Local\Temp\tbu9FF6.exe
C:\Users\Admin\AppData\Local\Temp\tbuAA61.exe
C:\Users\Admin\AppData\Local\Temp\tbuAEF3.exe
C:\Users\Admin\AppData\Local\Temp\tbuC051.exe
C:\Users\Admin\AppData\Local\Temp\tbuCABD.exe
C:\Users\Admin\AppData\Local\Temp\tbuCB4D.exe
C:\Users\Admin\AppData\Local\Temp\tbuEDE.exe
C:\Users\Admin\AppData\Local\Temp\tbuFB4E.exe
C:\Users\Admin\AppData\Local\Temp\tmp4D4E.dll
C:\Users\Admin\AppData\Local\Temp\v-bates.exe
C:\Users\Admin\AppData\Local\Temp\vbmz10.exe
C:\Users\Admin\AppData\Local\Temp\vlc-2.1.3-win32.exe
C:\Users\Admin\AppData\Local\Temp\vstor_redist_2010.exe
C:\Users\Admin\AppData\Local\Temp\WSSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-07-22 18:18
==================== End Of Log ============================
Gruß Riddle |
Baum-Darstellung