| |
| |||||||
Log-Analyse und Auswertung: SSL Verbindungen nicht möglich, Werbeeinblendungen etc..Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
13.11.2014, 23:26
| #1 |
 |  SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Nabend, also bei ist neuerdings das Problem, dass ich keine SSL Seiten öffnen kann, also alles mit https. Habe nun eine Logdatei von Malwarebytes und Spybot gepostet, was kann man da denn draus erkennen? Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 13.11.2014 Scan Time: 22:55:44 Logfile: Administrator: Yes Version: 2.00.3.1025 Malware Database: v2014.11.13.09 Rootkit Database: v2014.11.12.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 8.1 CPU: x64 File System: NTFS User: Neo Scan Type: Threat Scan Result: Completed Objects Scanned: 369018 Time Elapsed: 16 min, 28 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 2 PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.exe, 5616, , [8bc2cd6e007c2b0b42742d3eaa59f50b] PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, 3836, , [8bc2cd6e007c2b0b42742d3eaa59f50b] Modules: 0 (No malicious items detected) Registry Keys: 14 PUP.Optional.Snapdo.T, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, , [440929126c10c670fcc133bf45bd728e], PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\CLASSES\HD Streamer.ScriptHostObject, , [fb52cc6f96e6a690dca6437225ddb050], PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\CLASSES\HD Streamer.ScriptHostObject.1, , [f65786b5522a60d6d6aca80d0ff3728e], PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\HD Streamer.ScriptHostObject, , [f65786b5522a60d6d6aca80d0ff3728e], PUP.Optional.HDStreamer.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\HD Streamer.ScriptHostObject.1, , [f65786b5522a60d6d6aca80d0ff3728e], PUP.Optional.UniversalUpdater.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UniversalUpdater, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.Salus.A, HKLM\SOFTWARE\WOW6432NODE\Salus, , [b39a73c85e1eed49d87b40ff649f649c], PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FB385922-2E32-4462-A7DC-27159614A660}, , [113ceb50106c1c1a65b7e86e8c77c838], PUP.Optional.Salus.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Salus, , [2e1ffa41532952e42bceaf90a45f817f], PUP.Optional.ReMarkit.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, , [19347bc00379f73fbaa41623fa09aa56], PUP.Optional.ReMarkit.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, , [44092912bdbfe74f7de121182ad9669a], PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [68e534071d5ffc3a30d3f8770af93ac6], PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [9ab352e98fedc57174c77213e3213cc4], PUP.Optional.SuperFish.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, , [1f2e1e1dbbc163d3d7c2480323e06d93], Registry Values: 5 PUP.Optional.Bundle, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Salus CrashMon, "C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe" "b786bdb3c67d.exe" "hxxp://log.data-url.com/salus/crash", , [8dc0d6652557da5cd2651822c63feb15] PUP.Optional.UniversalUpdater.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|CrashMon, "C:\Program Files (x86)\Universal Updater\CrashMon.exe" "UniversalUpdater", , [8bc2cd6e007c2b0b42742d3eaa59f50b] PUP.Optional.UniversalUpdater.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\UNIVERSALUPDATER|ImagePath, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, , [39143308bebed75fddda82e94fb46f91] PUP.Optional.InstallCore.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0R2Y1I1P1N0J1U1C, , [9ab352e98fedc57174c77213e3213cc4] PUP.Optional.QuickStart.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, , [2e1f52e9c0bc78bef1b426272fd4b64a] Registry Data: 8 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),,[81ccf348a2da0c2a9b61b195d2337987] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,),,[014c1d1e126a53e3ca7ba3988d787b85] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[0b426ad10577af87340f2b1016ef07f9] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[b697f84378045cda75cf44f753b26c94] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[e6676bd00e6e1422192d95a6f1148c74] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[9cb128134a32ad8948ffe8538184fc04] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),,[8fbe77c40676270fdb67f546b550ab55] PUP.Optional.Spigot.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie, Good: (www.google.com), Bad: (https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie),,[0647f14a611b8fa71b0c3ffd8f76ff01] Folders: 5 PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.HDStreamer.A, C:\Users\Neo\AppData\Local\HD Streamer, , [e36ac6750e6e70c681f70c1133d0867a], PUP.Optional.HDStreamer, C:\Program Files (x86)\HD Streamer, , [b09df348621ac1758b4b66b837cc9d63], PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain, , [2825211a295357df56295eca2bd8768a], PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain\logs, , [2825211a295357df56295eca2bd8768a], Files: 14 PUP.Optional.Bundle, C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe, , [8dc0d6652557da5cd2651822c63feb15], PUP.Optional.Salus.A, C:\Program Files (x86)\f552dd4c52e3\uninstall.exe, , [d07d8eadfe7ee551f0fb02b6fd045ea2], PUP.Optional.Salus.A, C:\Windows\Temp\5762.tmp, , [dd7044f76c101026ea36a724e61b2dd3], PUP.Optional.Salus.A, C:\Windows\Temp\8DCB.tmp, , [68e51526d5a7ed49be62705bf40d32ce], PUP.Optional.Softonic.A, C:\Users\Neo\Downloads\SoftonicDownloader_fuer_usenext-by-tangysoft.exe, , [0f3e9aa118643501b77880b90ef37d83], PUP.Optional.SnapDo.A, C:\Windows\Installer\3f13e2a.msi, , [103dee4d8af20f278e8d2d709c65f30d], PUP.Optional.SmartBar, C:\Windows\Installer\3f13e2f.msi, , [f657df5cfb8171c5e76c114c20e0b24e], PUP.Optional.SmartBar, C:\Windows\Installer\MSICE74.tmp, , [b19cd96218642c0ad47ce34b0ff16f91], PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\settings.json, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.exe, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\CrashMon.log, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.exe, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.UniversalUpdater.A, C:\Program Files (x86)\Universal Updater\UpdaterService.log, , [8bc2cd6e007c2b0b42742d3eaa59f50b], PUP.Optional.PriceFountain.A, C:\Users\Neo\AppData\Local\PriceFountain\logs\installation.log, , [2825211a295357df56295eca2bd8768a], Physical Sectors: 0 (No malicious items detected) (end) -------------------------------------------------------------------------------------- Search results from Spybot - Search & Destroy 13.11.2014 21:55:40 Scan took 00:54:27. 17 items found. Salus: [SBI $02CA90FA] Uninstall settings (Registry Key, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Salus Internet Explorer: [SBI $1E8157BE] Typed URL list (Registry Key, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Internet Explorer\TypedURLs Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent Internet Explorer: [SBI $0BC7B918] User agent (Registry Change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent MS DirectDraw: [SBI $EB49D5AF] Most recent application (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication\Name Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources Windows: [SBI $1E4E2003] Drivers installation paths (Registry Change, nothing done) HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\Installation Sources Windows.OpenWith: [SBI $F7204896] Open with list - .AVI extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AVI\OpenWithList Windows.OpenWith: [SBI $A1C94E79] Open with list - .BMP extension (Registry Key, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.BMP\OpenWithList Windows Explorer: [SBI $D20DA0AD] Recent file global history (Registry Key, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs Windows Explorer: [SBI $85C2C910] Last Copy/MoveTo folder (Registry Value, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CopyMoveTo\LastFolder Windows Media SDK: [SBI $37AAEDE6] Computer name (Registry Change, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\ComputerName Windows Media SDK: [SBI $CAA58B6E] Unique ID (Registry Change, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\UniqueID Windows Media SDK: [SBI $BACCD0DA] Volume serial number (Registry Value, nothing done) HKEY_USERS\S-1-5-21-4021730028-2611376806-967486672-1001\Software\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber Cookie: [SBI $49804B54] Browser: Cookie (71) (Browser: Cookie, nothing done) Cache: [SBI $49804B54] Browser: Cache (4348) (Browser: Cache, nothing done) Verlauf: [SBI $49804B54] Browser: History (595) (Browser: History, nothing done) --- Spybot - Search & Destroy version: 2.1.18.131 DLL (build: 20130516) --- 2013-09-20 blindman.exe (2.2.18.151) 2013-09-20 explorer.exe (2.2.18.177) 2013-09-20 SDBootCD.exe (2.2.18.109) 2013-09-20 SDCleaner.exe (2.2.18.110) 2013-09-20 SDDelFile.exe (2.2.18.94) 2013-06-18 SDDisableProxy.exe 2013-09-20 SDFiles.exe (2.2.18.135) 2013-09-20 SDFileScanHelper.exe (2.2.16.1) 2013-10-15 SDFSSvc.exe (2.2.25.211) 2013-10-10 SDHookHelper.exe (2.3.30.2) 2013-10-10 SDHookInst32.exe (2.3.30.2) 2013-10-10 SDHookInst64.exe (2.3.30.2) 2013-09-20 SDImmunize.exe (2.2.18.130) 2013-05-16 SDLogReport.exe (2.1.18.107) 2013-10-14 SDOnAccess.exe (2.2.25.4) 2013-09-20 SDPESetup.exe (2.2.18.3) 2013-09-20 SDPEStart.exe (2.2.18.86) 2013-09-20 SDPhoneScan.exe (2.2.18.28) 2013-09-20 SDPRE.exe (2.2.18.22) 2013-09-20 SDPrepPos.exe (2.2.18.10) 2013-09-20 SDQuarantine.exe (2.2.18.103) 2013-09-20 SDRootAlyzer.exe (2.2.18.116) 2013-09-20 SDSBIEdit.exe (2.2.18.39) 2013-09-20 SDScan.exe (2.2.18.177) 2013-09-20 SDScript.exe (2.2.18.53) 2013-10-15 SDSettings.exe (2.2.25.138) 2013-09-20 SDShell.exe (2.2.18.2) 2013-09-20 SDShred.exe (2.2.18.107) 2013-09-20 SDSysRepair.exe (2.2.18.101) 2013-09-20 SDTools.exe (2.2.18.150) 2013-07-25 SDTray.exe (2.1.21.129) 2013-09-20 SDUpdate.exe (2.2.18.91) 2013-09-20 SDUpdSvc.exe (2.2.18.76) 2013-09-20 SDWelcome.exe (2.2.21.129) 2013-09-13 SDWSCSvc.exe (2.2.22.2) 2014-05-20 spybotsd2-install-bdcore-update.exe (2.3.39.0) 2014-07-31 spybotsd2-translation-esx.exe 2013-06-19 spybotsd2-translation-frx.exe 2014-08-25 spybotsd2-translation-hux2.exe 2014-10-01 spybotsd2-translation-nlx2.exe 2014-11-05 spybotsd2-translation-ukx.exe 2014-03-18 unins000.exe (51.1052.0.0) 1999-12-02 xcacls.exe 2012-08-23 borlndmm.dll (10.0.2288.42451) 2012-09-05 DelZip190.dll (1.9.0.107) 2012-09-10 libeay32.dll (1.0.0.4) 2012-09-10 libssl32.dll (1.0.0.4) 2013-05-16 SDAdvancedCheckLibrary.dll (2.1.18.98) 2013-05-16 SDAV.dll 2013-05-16 SDECon32.dll (2.1.18.113) 2013-05-16 SDECon64.dll (2.1.18.113) 2013-04-05 SDEvents.dll (2.1.16.2) 2013-10-14 SDFileScanLibrary.dll (2.2.25.14) 2013-10-10 SDHook32.dll (2.3.30.2) 2013-10-10 SDHook64.dll (2.3.30.2) 2013-05-16 SDImmunizeLibrary.dll (2.1.18.2) 2013-05-16 SDLicense.dll (2.1.18.0) 2013-05-16 SDLists.dll (2.1.18.4) 2013-05-16 SDResources.dll (2.1.18.7) 2013-05-16 SDScanLibrary.dll (2.1.18.131) 2013-05-16 SDTasks.dll (2.1.18.15) 2013-05-16 SDWinLogon.dll (2.1.18.0) 2012-08-23 sqlite3.dll 2012-09-10 ssleay32.dll (1.0.0.4) 2013-05-16 Tools.dll (2.1.18.36) 2014-03-05 Includes\Adware-000.sbi (*) 2014-01-08 Includes\Adware-001.sbi (*) 2014-11-11 Includes\Adware-C.sbi (*) 2014-01-13 Includes\Adware.sbi (*) 2014-01-13 Includes\AdwareC.sbi (*) 2010-08-13 Includes\Cookies.sbi (*) 2014-01-08 Includes\Dialer-000.sbi (*) 2014-01-08 Includes\Dialer-001.sbi (*) 2014-01-08 Includes\Dialer-C.sbi (*) 2014-01-13 Includes\Dialer.sbi (*) 2014-01-13 Includes\DialerC.sbi (*) 2014-01-09 Includes\Fraud-000.sbi (*) 2014-01-09 Includes\Fraud-001.sbi (*) 2014-03-31 Includes\Fraud-002.sbi (*) 2014-01-09 Includes\Fraud-003.sbi (*) 2012-11-14 Includes\HeavyDuty.sbi (*) 2014-01-08 Includes\Hijackers-000.sbi (*) 2014-01-08 Includes\Hijackers-001.sbi (*) 2014-01-08 Includes\Hijackers-C.sbi (*) 2014-01-13 Includes\Hijackers.sbi (*) 2014-01-13 Includes\HijackersC.sbi (*) 2014-01-08 Includes\iPhone-000.sbi (*) 2014-01-08 Includes\iPhone.sbi (*) 2014-01-08 Includes\Keyloggers-000.sbi (*) 2014-09-24 Includes\Keyloggers-C.sbi (*) 2014-01-13 Includes\Keyloggers.sbi (*) 2014-01-13 Includes\KeyloggersC.sbi (*) 2014-10-07 Includes\Malware-000.sbi (*) 2014-01-09 Includes\Malware-001.sbi (*) 2014-01-09 Includes\Malware-002.sbi (*) 2014-02-05 Includes\Malware-003.sbi (*) 2014-01-28 Includes\Malware-004.sbi (*) 2014-04-15 Includes\Malware-005.sbi (*) 2014-02-26 Includes\Malware-006.sbi (*) 2014-01-09 Includes\Malware-007.sbi (*) 2014-11-05 Includes\Malware-C.sbi (*) 2014-01-13 Includes\Malware.sbi (*) 2013-12-23 Includes\MalwareC.sbi (*) 2014-01-15 Includes\PUPS-000.sbi (*) 2014-01-15 Includes\PUPS-001.sbi (*) 2014-01-15 Includes\PUPS-002.sbi (*) 2014-11-12 Includes\PUPS-C.sbi (*) 2012-11-14 Includes\PUPS.sbi (*) 2014-01-07 Includes\PUPSC.sbi (*) 2014-01-08 Includes\Security-000.sbi (*) 2014-01-08 Includes\Security-C.sbi (*) 2014-01-21 Includes\Security.sbi (*) 2014-01-21 Includes\SecurityC.sbi (*) 2014-01-08 Includes\Spyware-000.sbi (*) 2014-01-08 Includes\Spyware-001.sbi (*) 2014-10-29 Includes\Spyware-C.sbi (*) 2014-01-21 Includes\Spyware.sbi (*) 2014-01-21 Includes\SpywareC.sbi (*) 2011-06-07 Includes\Tracks.sbi (*) 2012-11-19 Includes\Tracks.uti (*) 2014-01-15 Includes\Trojans-000.sbi (*) 2014-01-15 Includes\Trojans-001.sbi (*) 2014-01-15 Includes\Trojans-002.sbi (*) 2014-01-15 Includes\Trojans-003.sbi (*) 2014-01-15 Includes\Trojans-004.sbi (*) 2014-03-19 Includes\Trojans-005.sbi (*) 2014-07-09 Includes\Trojans-006.sbi (*) 2014-01-15 Includes\Trojans-007.sbi (*) 2014-07-09 Includes\Trojans-008.sbi (*) 2014-07-09 Includes\Trojans-009.sbi (*) 2014-11-11 Includes\Trojans-C.sbi (*) 2014-01-15 Includes\Trojans-OG-000.sbi (*) 2014-01-15 Includes\Trojans-TD-000.sbi (*) 2014-01-15 Includes\Trojans-VM-000.sbi (*) 2014-01-15 Includes\Trojans-VM-001.sbi (*) 2014-01-15 Includes\Trojans-VM-002.sbi (*) 2014-01-15 Includes\Trojans-VM-003.sbi (*) 2014-01-15 Includes\Trojans-VM-004.sbi (*) 2014-01-15 Includes\Trojans-VM-005.sbi (*) 2014-01-15 Includes\Trojans-VM-006.sbi (*) 2014-01-15 Includes\Trojans-VM-007.sbi (*) 2014-01-15 Includes\Trojans-VM-008.sbi (*) 2014-01-15 Includes\Trojans-VM-009.sbi (*) 2014-01-15 Includes\Trojans-VM-010.sbi (*) 2014-01-15 Includes\Trojans-VM-011.sbi (*) 2014-01-15 Includes\Trojans-VM-012.sbi (*) 2014-01-15 Includes\Trojans-VM-013.sbi (*) 2014-01-15 Includes\Trojans-VM-014.sbi (*) 2014-01-15 Includes\Trojans-VM-015.sbi (*) 2014-01-15 Includes\Trojans-VM-016.sbi (*) 2014-01-15 Includes\Trojans-VM-017.sbi (*) 2014-01-15 Includes\Trojans-VM-018.sbi (*) 2014-01-15 Includes\Trojans-VM-019.sbi (*) 2014-01-15 Includes\Trojans-VM-020.sbi (*) 2014-01-15 Includes\Trojans-VM-021.sbi (*) 2014-01-15 Includes\Trojans-VM-022.sbi (*) 2014-01-15 Includes\Trojans-VM-023.sbi (*) 2014-01-15 Includes\Trojans-VM-024.sbi (*) 2014-01-15 Includes\Trojans-ZB-000.sbi (*) 2014-01-15 Includes\Trojans-ZL-000.sbi (*) 2014-01-09 Includes\Trojans.sbi (*) 2014-01-16 Includes\TrojansC-01.sbi (*) 2014-01-16 Includes\TrojansC-02.sbi (*) 2014-01-16 Includes\TrojansC-03.sbi (*) 2014-01-16 Includes\TrojansC-04.sbi (*) 2014-01-16 Includes\TrojansC-05.sbi (*) 2014-01-09 Includes\TrojansC.sbi (*) -------------------------------------------------------------------------------------- |
|
13.11.2014, 23:36
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Scan mit Farbar's Recovery Scan Tool (FRST)
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
13.11.2014, 23:47
| #3 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. so fertig.
__________________Mir fällt grad auf dass die ganze Zeit ein Scrypt bei mir läuft, das ich ständig stoppen muss. Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-11-2014 02
Ran by Neo at 2014-11-13 23:42:34
Running from C:\Users\Neo\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5315 - AVG Technologies)
AVG 2015 (Version: 15.0.4213 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5315 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.1.9.799 - AVG Technologies)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Epson Easy Photo Print 2 (HKLM-x32\...\{94FA9FA6-5294-494D-A8F1-1E654CBB5736}) (Version: 2.2.3.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
EPSON-Drucker-Software (HKLM-x32\...\EPSON Printer and Utilities) (Version: - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )
HebRech HebRechw (HKLM-x32\...\{C63B768B-8B87-46F0-B56E-F863FD9E0870}) (Version: 0 - )
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3349 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
kwiksupport.me (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\kwiksupport.me) (Version: 12.0.36.1315 - pcvisit Software AG)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0094 - Pegatron Corporation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Snap.Do (HKLM-x32\...\{FB385922-2E32-4462-A7DC-27159614A660}) (Version: 10.213.1.15234 - ReSoft Ltd.) <==== ATTENTION
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Unity Web Player (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.)
ValueApps (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\ValueApps) (Version: 1.4.0.3 - Conduit) <==== ATTENTION
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}) (Version: 1.0.1720.1 - Microsoft Corporation)
YTD Video Downloader 4.8.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.1 - GreenTree Applications SRL) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
29-10-2014 07:34:17 Installiert HebRech
01-11-2014 17:32:32 Windows Update
09-11-2014 12:16:09 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2014-11-13 22:06 - 00450713 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01072E6C-C09D-4986-9538-5AB4A7BC5EE0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {2E4E5FB0-8196-4357-99FC-83CA1E6C56CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {3A5C66F6-D705-4625-B73A-76C548EAC52C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {3E3F5009-1629-4E68-873A-9B257B89535F} - \AmiUpdXp No Task File <==== ATTENTION
Task: {5361FB93-DA83-4C45-BC63-C968DC5054D4} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)
Task: {63507F5D-2B25-4F2C-B91C-37AF27306AC8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)
Task: {770BA74E-28E4-4E65-90B5-625D6C5C4010} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-01] (Microsoft Corporation)
Task: {8E16DB4C-8B87-4373-BD41-69A7C7308962} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rmv => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()
Task: {97DB4190-102B-4B17-BBA8-F2A377B3D6F7} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)
Task: {9AEA6DB9-8F05-4D7B-B764-225E14DAE2EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)
Task: {C8CAF07B-7DAC-47DF-AF3E-BFDA1E22560C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DD1CB7F8-F551-4981-8AD1-DAD7C2C1DE18} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rel => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
==================== Loaded Modules (whitelisted) =============
2013-12-03 07:30 - 2013-12-03 00:21 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2014-08-26 09:38 - 2014-08-26 09:38 - 00034304 _____ () C:\Windows\System32\ssd3clm.dll
2014-08-29 23:36 - 2014-08-29 23:36 - 02782744 _____ () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
2013-11-18 17:35 - 2013-09-26 21:08 - 00061440 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-03-19 02:11 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-11-12 16:53 - 2013-03-06 15:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-06-18 14:51 - 2014-06-18 14:51 - 00606136 _____ () C:\Program Files (x86)\Universal Updater\UpdaterService.exe
2014-08-12 16:18 - 2014-08-12 16:18 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe
2013-12-03 07:30 - 2013-10-14 20:11 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-12-03 07:30 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-12-03 07:30 - 2013-10-14 18:09 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-07-24 19:26 - 2014-08-25 19:25 - 02640408 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe
2014-11-05 17:20 - 2014-11-05 17:20 - 00997952 _____ () C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-18 19:54 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-03-18 19:54 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-03-18 19:54 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-03-18 19:54 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-03-18 19:54 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2014-08-12 16:18 - 2014-08-12 16:18 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\log4cplusU.dll
2013-12-03 07:30 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-12-03 07:30 - 2013-09-18 00:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-07-24 19:26 - 2014-07-24 19:26 - 01645592 _____ () C:\Program Files (x86)\AVG Secure Search\TBAPI.dll
2014-04-04 09:25 - 2014-04-04 09:25 - 00102400 _____ () C:\Program Files (x86)\f552dd4c52e3\nfapi.dll
2014-06-05 05:41 - 2014-06-05 05:41 - 00331776 _____ () C:\Program Files (x86)\f552dd4c52e3\ProtocolFilters.dll
2014-11-11 00:05 - 2014-11-11 00:05 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-08-12 16:18 - 2014-08-12 16:18 - 00693784 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.1.9\NativeBrowserApi.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Neo\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKCU\...\StartupApproved\Run: => "AppLauncher"
HKCU\...\StartupApproved\Run: => "TomTomHOME.exe"
========================= Accounts: ==========================
admin (S-1-5-21-4021730028-2611376806-967486672-1004 - Limited - Enabled) => C:\Users\admin
Administrator (S-1-5-21-4021730028-2611376806-967486672-500 - Administrator - Disabled)
Gast (S-1-5-21-4021730028-2611376806-967486672-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4021730028-2611376806-967486672-1003 - Limited - Enabled)
Neo (S-1-5-21-4021730028-2611376806-967486672-1001 - Administrator - Enabled) => C:\Users\Neo
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (11/13/2014 11:21:50 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/13/2014 11:21:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000fb87
ID des fehlerhaften Prozesses: 0x15f0
Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0
Pfad der fehlerhaften Anwendung: CrashMon.exe1
Pfad des fehlerhaften Moduls: CrashMon.exe2
Berichtskennung: CrashMon.exe3
Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
Error: (11/13/2014 09:02:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000fb87
ID des fehlerhaften Prozesses: 0x1638
Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0
Pfad der fehlerhaften Anwendung: CrashMon.exe1
Pfad des fehlerhaften Moduls: CrashMon.exe2
Berichtskennung: CrashMon.exe3
Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
Error: (11/13/2014 08:57:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WWAHost.exe, Version 6.3.9600.17031 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: fa4
Startzeit: 01cfff7bf23336dd
Endzeit: 4294967295
Anwendungspfad: C:\Windows\System32\WWAHost.exe
Berichts-ID: 46b01ab9-6b6f-11e4-82bd-0c54a5f6bf74
Vollständiger Name des fehlerhaften Pakets: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Windows.Store
Error: (11/13/2014 08:57:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Angie)
Description: Das Paket „winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy+Windows.Store“ wurde beendet, da das Anhalten zu lange dauerte.
Error: (11/13/2014 08:41:50 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database
Error: (11/13/2014 10:13:48 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/12/2014 00:02:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Name des fehlerhaften Moduls: CrashMon.exe, Version: 0.0.0.0, Zeitstempel: 0x53a1993a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000fb87
ID des fehlerhaften Prozesses: 0x658
Startzeit der fehlerhaften Anwendung: 0xCrashMon.exe0
Pfad der fehlerhaften Anwendung: CrashMon.exe1
Pfad des fehlerhaften Moduls: CrashMon.exe2
Berichtskennung: CrashMon.exe3
Vollständiger Name des fehlerhaften Pakets: CrashMon.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CrashMon.exe5
Error: (11/12/2014 09:57:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/10/2014 11:37:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
System errors:
=============
Error: (11/13/2014 05:58:01 PM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (11/13/2014 05:57:31 PM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (11/12/2014 11:01:16 AM) (Source: DCOM) (EventID: 10016) (User: Angie)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}AngieNeoS-1-5-21-4021730028-2611376806-967486672-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (11/12/2014 10:15:55 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (11/12/2014 10:15:25 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (11/11/2014 11:26:54 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (11/11/2014 11:26:24 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (11/11/2014 11:08:43 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (11/11/2014 11:08:13 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (11/11/2014 10:51:02 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Microsoft Office Sessions:
=========================
Error: (11/13/2014 11:21:50 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/13/2014 11:21:39 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb8715f001cfff87c37353ecC:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe6fcd5f25-6b83-11e4-82be-0c54a5f6bf74
Error: (11/13/2014 09:02:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb87163801cfff745c2b1021C:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe087e339f-6b70-11e4-82bd-0c54a5f6bf74
Error: (11/13/2014 08:57:36 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WWAHost.exe6.3.9600.17031fa401cfff7bf23336dd4294967295C:\Windows\System32\WWAHost.exe46b01ab9-6b6f-11e4-82bd-0c54a5f6bf74winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewyWindows.Store
Error: (11/13/2014 08:57:20 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: Angie)
Description: winstore_1.0.0.0_neutral_neutral_cw5n1h2txyewy+Windows.Store
Error: (11/13/2014 08:41:50 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: -2147024883
Error: (11/13/2014 10:13:48 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/12/2014 00:02:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: CrashMon.exe0.0.0.053a1993aCrashMon.exe0.0.0.053a1993ac00000050000fb8765801cffe5fa8f1b02fC:\Program Files (x86)\Universal Updater\CrashMon.exeC:\Program Files (x86)\Universal Updater\CrashMon.exe55575a60-6a5b-11e4-82bb-0c54a5f6bf74
Error: (11/12/2014 09:57:23 AM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -1073415161
Error: (11/10/2014 11:37:39 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Percentage of memory in use: 51%
Total physical RAM: 3975.78 MB
Available physical RAM: 1923.46 MB
Total Pagefile: 6151.78 MB
Available Pagefile: 3693.02 MB
Total Virtual: 131072 MB
Available Virtual: 131071.79 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:869.8 GB) (Free:459.6 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.39 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 0433B666)
Partition: GPT Partition Type.
==================== End Of Log ============================
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02 Ran by Neo (administrator) on ANGIE on 13-11-2014 23:41:11 Running from C:\Users\Neo\Downloads Loaded Profile: Neo (Available profiles: Neo & admin) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe (Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe (Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe () C:\Program Files (x86)\Universal Updater\UpdaterService.exe (AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe () C:\Program Files (x86)\PHotkey\POsd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files (x86)\PHotkey\GPMTray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe () C:\Program Files (x86)\AVG Secure Search\vprot.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe () C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653720 2013-09-24] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353944 2013-09-16] (Realtek Semiconductor) HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated) HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink) HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-10] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.) HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-08-01] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Run: [CrashMon] => C:\Program Files (x86)\Universal Updater\CrashMon.exe [388096 2014-06-18] () HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3593744 2014-09-05] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Secure Search\vprot.exe [2640408 2014-08-25] () HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.) HKLM-x32\...\Run: [Salus CrashMon] => "C:\Program Files (x86)\f552dd4c52e3\a7d12b5975b4.exe" "b786bdb3c67d.exe" "hxxp://log.data-url.com/salus/crash" HKLM-x32\...\Run: [Salus] => C:\Program Files (x86)\f552dd4c52e3\b786bdb3c67d.exe [997952 2014-11-05] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1 HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo) HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.) HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom) HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AVG-Secure-Search-Update_0814tb] => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2782744 2014-08-29] () BootExecute: autocheck autochk * sdnclean64.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/?type=501549&fr=spigot-yhp-ie HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKLM - {80000762-D5FE-434E-9FED-DDFEDDA3D72F} URL = hxxp://www.sm.de/?q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKCU - DefaultScope {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms} SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3326313&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SPCA3FDFB3-3725-46F8-A30D-E19ECF8D739A&q={searchTerms}&SSPV= SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms} SearchScopes: HKCU - {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms} BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation) Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default FF DefaultSearchEngine: Yahoo! FF SelectedSearchEngine: Yahoo! FF Homepage: https://www.google.de/ FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=501549&p= FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Neo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Cliqz Beta - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\cliqz@cliqz.com [2014-11-13] FF Extension: Adblock Plus - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-26] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-11] FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.1.9.799 [2014-08-25] FF Extension: No Name - avg@toolbar [Not Found] Chrome: ======= CHR Profile: C:\Users\Neo\AppData\Local\Google\Chrome\User Data\Default ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3364368 2014-09-05] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [293448 2014-09-05] (AVG Technologies CZ, s.r.o.) R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed] R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation) R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink) R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation) R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation) S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation) S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation) R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2013-12-03] () [File not signed] R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] () R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation) S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation) R2 UniversalUpdater; C:\Program Files (x86)\Universal Updater\UpdaterService.exe [606136 2014-06-18] () R2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [247576 2014-07-24] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-20] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-12] (AVG Technologies) R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [273176 2014-07-18] (AVG Technologies CZ, s.r.o.) R1 b786bdb3c67d; C:\Windows\System32\drivers\b786bdb3c67d.sys [52016 2014-11-05] (Windows (R) Win 7 DDK provider) S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-13] (Malwarebytes Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider) R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation ) S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated) R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation) S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation) S1 Salus; system32\drivers\Salus.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-13 23:41 - 2014-11-13 23:41 - 00021021 _____ () C:\Users\Neo\Downloads\FRST.txt 2014-11-13 23:40 - 2014-11-13 23:41 - 00000000 ____D () C:\FRST 2014-11-13 23:39 - 2014-11-13 23:39 - 02116608 _____ (Farbar) C:\Users\Neo\Downloads\FRST64.exe 2014-11-13 22:53 - 2014-11-13 22:53 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-13 22:51 - 2014-11-13 22:51 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2014-11-13 22:51 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-11-13 22:51 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-11-13 22:51 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-11-13 22:49 - 2014-11-13 22:49 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Cliqz 2014-11-13 22:49 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll 2014-11-13 22:49 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll 2014-11-13 22:47 - 2014-11-13 22:47 - 01125200 _____ () C:\Users\Neo\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe 2014-11-13 22:16 - 2014-11-13 22:16 - 00000000 ____D () C:\Windows\softwaredistribution.bak2 2014-11-13 22:06 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141113-220659.backup 2014-11-13 21:55 - 2014-11-13 21:55 - 00009839 _____ () C:\Users\Neo\Desktop\Scan Results.141113-2155.txt 2014-11-13 18:14 - 2014-11-13 18:14 - 00000000 ____D () C:\Program Files (x86)\f552dd4c52e3 2014-11-11 00:05 - 2014-11-11 00:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\ProgramData\Samsung 2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate 2014-11-05 18:36 - 2014-11-05 18:36 - 00052016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\b786bdb3c67d.sys 2014-10-24 12:57 - 2014-10-24 13:24 - 614846156 _____ () C:\Users\Neo\Desktop\Freunde fürs Leben.mp4 2014-10-24 12:52 - 2014-10-24 12:57 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\HandBrake 2014-10-24 12:51 - 2014-10-24 12:51 - 14298467 _____ () C:\Users\Neo\Downloads\HandBrake-0.9.9-1_x86_64-Win_GUI.exe 2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\Neo\Desktop\Handbrake.lnk 2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\admin\Desktop\Handbrake.lnk 2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake 2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake 2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Program Files\Handbrake 2014-10-24 12:34 - 2014-10-24 12:34 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk 2014-10-24 12:34 - 2014-10-24 12:34 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk 2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Canneverbe Limited 2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\ProgramData\Canneverbe Limited 2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP 2014-10-24 12:33 - 2014-10-24 12:33 - 05402840 _____ (Canneverbe Limited ) C:\Users\Neo\Downloads\cdbxp_setup_4.5.4.5143_minimal.exe 2014-10-21 20:46 - 2014-10-21 20:46 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\AVG2015 2014-10-21 20:45 - 2014-10-21 20:45 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk 2014-10-21 20:43 - 2014-10-30 23:35 - 00000000 ____D () C:\ProgramData\AVG2015 2014-10-21 20:43 - 2014-10-21 20:43 - 00000000 ____D () C:\Users\admin\AppData\Local\Avg 2014-10-21 20:39 - 2014-10-22 14:42 - 00000000 ____D () C:\Users\Neo\AppData\Local\Avg2015 2014-10-15 19:55 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-10-15 19:55 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-10-15 19:55 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-10-15 19:55 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2014-10-15 19:55 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2014-10-15 19:55 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll 2014-10-15 19:55 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll 2014-10-15 19:55 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll 2014-10-15 19:55 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-10-15 19:55 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-10-15 19:55 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-10-15 19:38 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-10-15 19:38 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2014-10-15 19:38 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll 2014-10-15 19:38 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll 2014-10-15 19:38 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2014-10-15 19:38 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2014-10-15 19:38 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2014-10-15 19:38 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2014-10-15 19:38 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2014-10-15 19:38 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2014-10-15 19:38 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2014-10-15 19:38 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2014-10-15 19:38 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2014-10-15 19:38 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2014-10-15 19:38 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2014-10-15 19:37 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-10-15 19:37 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll 2014-10-15 19:36 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-10-15 19:36 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-10-15 19:36 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-10-15 19:36 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-10-15 19:36 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-10-15 19:36 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-10-15 19:36 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-10-15 19:36 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-10-15 19:36 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-10-15 19:36 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-10-15 19:36 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-10-15 19:36 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-10-15 19:36 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-10-15 19:36 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-10-15 19:36 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-10-15 19:36 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-10-15 19:36 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-10-15 19:36 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-10-15 19:36 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-10-15 19:36 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-10-15 19:36 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-10-15 19:36 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-10-15 19:36 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-10-15 19:36 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-10-15 19:36 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-10-15 19:36 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-10-15 19:36 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-10-15 19:36 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-10-15 19:36 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-10-15 19:36 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-10-15 19:36 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll 2014-10-15 19:36 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll 2014-10-15 19:36 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-10-15 19:36 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-10-15 19:36 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-10-15 19:36 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll 2014-10-15 19:36 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll 2014-10-15 19:36 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll 2014-10-15 19:36 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-10-15 19:36 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll 2014-10-15 19:36 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-10-15 19:35 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll 2014-10-15 19:35 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-10-15 19:35 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-10-15 19:35 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-10-15 19:35 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll 2014-10-15 19:35 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-10-15 19:35 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-10-15 19:35 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll 2014-10-15 19:35 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll 2014-10-15 19:35 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll 2014-10-15 19:35 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll 2014-10-15 19:35 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll 2014-10-15 19:35 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll 2014-10-15 19:35 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll 2014-10-15 19:35 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-10-15 19:35 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll 2014-10-15 19:35 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-15 19:35 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll 2014-10-15 19:35 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll 2014-10-15 19:35 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-10-15 19:35 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll 2014-10-15 19:35 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll 2014-10-15 19:35 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2014-10-15 19:35 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe 2014-10-15 19:35 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2014-10-15 19:35 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-13 23:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru 2014-11-13 22:58 - 2014-01-15 19:52 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4021730028-2611376806-967486672-1001 2014-11-13 22:51 - 2014-03-16 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-11-13 22:45 - 2014-03-15 20:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-13 22:43 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF 2014-11-13 22:31 - 2014-01-15 19:45 - 01351603 _____ () C:\Windows\WindowsUpdate.log 2014-11-13 22:28 - 2013-11-12 12:57 - 00793160 _____ () C:\Windows\system32\perfh010.dat 2014-11-13 22:28 - 2013-11-12 12:57 - 00156082 _____ () C:\Windows\system32\perfc010.dat 2014-11-13 22:28 - 2013-11-12 12:32 - 00765582 _____ () C:\Windows\system32\perfh007.dat 2014-11-13 22:28 - 2013-11-12 12:32 - 00159366 _____ () C:\Windows\system32\perfc007.dat 2014-11-13 22:28 - 2013-11-12 12:09 - 02726338 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-13 22:20 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job 2014-11-13 22:20 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job 2014-11-13 22:20 - 2014-08-16 19:44 - 00042398 _____ () C:\Windows\PFRO.log 2014-11-13 22:20 - 2014-01-15 19:46 - 00400956 _____ () C:\Users\Neo\AppData\Local\BTServer.log 2014-11-13 22:20 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-13 22:09 - 2014-07-23 18:47 - 00000000 ____D () C:\ProgramData\MFAData 2014-11-13 20:50 - 2014-03-18 19:54 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-11-13 19:58 - 2014-01-17 17:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2014-11-13 19:36 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI 2014-11-13 17:40 - 2014-08-25 22:51 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9D5DDB08-682D-474D-B8F1-06065B577A40} 2014-11-13 17:40 - 2014-08-24 13:49 - 00000220 _____ () C:\Users\Neo\BullseyeCoverageError.txt 2014-11-13 12:28 - 2014-01-15 22:19 - 00000000 ____D () C:\HebRechw 2014-11-12 11:00 - 2014-03-22 13:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-12 10:57 - 2014-07-31 16:44 - 00010763 _____ () C:\Windows\setupact.log 2014-11-12 10:45 - 2014-03-15 20:48 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-12 10:02 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp 2014-11-08 19:31 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2014-11-05 23:06 - 2014-09-02 21:03 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Skype 2014-11-02 13:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache 2014-11-01 19:04 - 2014-01-22 18:55 - 00000000 ___RD () C:\Users\Neo\SkyDrive 2014-11-01 19:03 - 2013-08-22 15:44 - 00515072 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sl-SI 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager 2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera 2014-11-01 18:40 - 2014-01-20 00:12 - 00000000 ____D () C:\Windows\system32\MRT 2014-11-01 18:34 - 2013-11-12 13:49 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-11-01 18:33 - 2014-07-24 20:16 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-10-30 23:42 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports 2014-10-29 08:35 - 2013-11-12 16:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-10-24 15:34 - 2014-02-09 13:03 - 00411648 ___SH () C:\Users\Neo\Desktop\Thumbs.db 2014-10-24 15:30 - 2014-01-17 18:27 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\vlc 2014-10-21 20:46 - 2014-07-23 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ___HD () C:\$AVG 2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ____D () C:\Program Files (x86)\AVG 2014-10-20 09:04 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness Some content of TEMP: ==================== C:\Users\Neo\AppData\Local\Temp\AppLauncher.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-09 12:52 ==================== End Of Log ============================ |
|
14.11.2014, 00:14
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
14.11.2014, 00:22
| #5 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Fehlermeldung: System not supportet, könnte daran liegen das ich Windows 8.1 habe |
|
14.11.2014, 00:30
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Jup, jetzt seh ich es auch, dachte CF unterstützt 8.1 mittlerweile... Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ --> SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. |
|
14.11.2014, 01:08
| #7 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc..Code:
ATTFilter # AdwCleaner v4.101 - Bericht erstellt am 14/11/2014 um 00:36:59
# Aktualisiert 09/11/2014 von Xplode
# Database : 2014-11-13.1 [Live]
# Betriebssystem : Windows 8.1 (64 bits)
# Benutzername : Neo - ANGIE
# Gestartet von : C:\Users\Neo\Downloads\AdwCleaner_4.101.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : UniversalUpdater
Dienst Gelöscht : vToolbarUpdater18.1.9
Dienst Gelöscht : salus
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\AVG Secure Search
Ordner Gelöscht : C:\ProgramData\AVG Security Toolbar
Ordner Gelöscht : C:\Program Files (x86)\AVG Secure Search
Ordner Gelöscht : C:\Program Files (x86)\GreenTree Applications
Ordner Gelöscht : C:\Program Files (x86)\HD Streamer
Ordner Gelöscht : C:\Program Files (x86)\Universal Updater
Ordner Gelöscht : C:\Program Files (x86)\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\admin\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\AVG Secure Search
Ordner Gelöscht : C:\Users\Neo\AppData\Local\AVG Secure Search
Ordner Gelöscht : C:\Users\Neo\AppData\Local\HD Streamer
Ordner Gelöscht : C:\Users\Neo\AppData\Local\PriceFountain
Ordner Gelöscht : C:\Users\Neo\AppData\LocalLow\AVG Secure Search
Datei Gelöscht : C:\Users\Neo\Favorites\Startfenster.lnk
Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk
Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Startfenster.lnk
Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\Neo\AppData\Roaming\Opera Software\Opera Stable\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
***** [ Tasks ] *****
Task Gelöscht : AmiUpdXp
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]
Schlüssel Gelöscht : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.BackgroundHostObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.BackgroundHostObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Navbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Navbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.ScriptHostObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.ScriptHostObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\HD Streamer.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protocols\handler\viprotocol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BackgroundHost.EXE
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [CrashMon]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Salus]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Salus CrashMon]
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{33E06582-221E-400F-809B-30D3984DB355}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3868E0C2-3E75-445F-B748-C97BB82300AC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CACBAC2D-FDC3-4608-A289-6F281F471B83}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5375FB9F-DF09-444B-9DC0-C6ED079C2577}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6D697641-4C65-49F0-8CED-FE8180B5E37E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{73BB74C6-8886-4245-BCDA-448137D75D42}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E7ABCD91-74F6-45AD-968B-A45EB265072C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{33E06582-221E-400F-809B-30D3984DB355}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{3868E0C2-3E75-445F-B748-C97BB82300AC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CACBAC2D-FDC3-4608-A289-6F281F471B83}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{80000762-D5FE-434E-9FED-DDFEDDA3D72F}
Schlüssel Gelöscht : HKCU\Software\AVG Secure Search
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SecuredDownload
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Secure Search
Schlüssel Gelöscht : HKLM\SOFTWARE\AVG Security Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Salus
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\ValueApps
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\portaldosites.com
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v33.1 (x86 de)
[jy54wylz.default\prefs.js] - Zeile gelöscht : user_pref("avg.install.installDirPath", "C:\\ProgramData\\AVG Secure Search\\FireFoxExt\\18.1.9.799");
[jy54wylz.default\prefs.js] - Zeile gelöscht : user_pref("avg.userPreferences.URLBarFocus.whiteList", "bing\\.comgoogle\\.\\w+yahoo\\.\\w+gmail\\.\\w+hotmail\\.\\w+live\\.\\w+isearch\\.avg\\.commysearch\\.avg\\.com");
-\\ Google Chrome v
-\\ Opera v0.0.0.0
*************************
AdwCleaner[R0].txt - [15027 octets] - [23/05/2014 12:22:57]
AdwCleaner[R1].txt - [1012 octets] - [24/05/2014 22:42:04]
AdwCleaner[R2].txt - [9533 octets] - [14/11/2014 00:34:24]
AdwCleaner[S0].txt - [13516 octets] - [23/05/2014 12:26:00]
AdwCleaner[S1].txt - [1073 octets] - [24/05/2014 22:43:48]
AdwCleaner[S2].txt - [9001 octets] - [14/11/2014 00:36:59]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [9061 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.7 (11.08.2014:1)
OS: Windows 8.1 x64
Ran by Neo on 14.11.2014 at 0:43:59,54
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] "C:\Users\Neo\favorites\links\startfenster.lnk"
Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC-STANDALONE-SETUP.-F6245FA5.pf
Successfully deleted: [File] C:\Windows\prefetch\SPEEDUPMYPC.TMP-473CCC3F.pf
Successfully deleted: [File] "C:\Windows\wininit.ini"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\ytd video downloader"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ytd video downloader"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\Neo\AppData\Roaming\mozilla\firefox\profiles\jy54wylz.default\minidumps [7 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.11.2014 at 0:49:09,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-11-2014 02
Ran by Neo (administrator) on ANGIE on 14-11-2014 00:59:19
Running from C:\Users\Neo\Downloads
Loaded Profile: Neo (Available profiles: Neo & admin)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
() C:\Program Files (x86)\PHotkey\POsd.exe
() C:\Program Files (x86)\PHotkey\GPMTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13653720 2013-09-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1353944 2013-09-16] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-09-29] (Realtek Semiconductor Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2777840 2013-08-14] (Synaptics Incorporated)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-09-10] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [95192 2013-03-11] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-08-01] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-31] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3593744 2014-09-05] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [ConfirmFileDelete] 1
HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AppLauncher] => C:\Program Files (x86)\Medion MediaPack 3\Ashampoo AppLauncher (Medion)\AppLauncher.exe [969656 2012-08-10] (Ashampoo)
HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [3666224 2013-09-20] (Safer-Networking Ltd.)
HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [TomTomHOME.exe] => C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\Run: [AVG-Secure-Search-Update_0814tb] => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2782744 2014-08-29] ()
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3326313&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=5&UP=SPCA3FDFB3-3725-46F8-A30D-E19ECF8D739A&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {E2EA62CA-BA84-41BC-BA91-6121E4C1291F} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=501549&p={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default
FF DefaultSearchEngine: Yahoo!
FF SelectedSearchEngine: Yahoo!
FF Homepage: https://www.google.de/
FF Keyword.URL: https://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=501549&p=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @lightspark.github.com/Lightspark;version=1 -> C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF Plugin HKU\S-1-5-21-4021730028-2611376806-967486672-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Neo\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Cliqz Beta - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\cliqz@cliqz.com [2014-11-13]
FF Extension: Adblock Plus - C:\Users\Neo\AppData\Roaming\Mozilla\Firefox\Profiles\jy54wylz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-26]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-11-11]
Chrome:
=======
CHR Profile: C:\Users\Neo\AppData\Local\Google\Chrome\User Data\Default
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3364368 2014-09-05] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [293448 2014-09-05] (AVG Technologies CZ, s.r.o.)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [61440 2013-09-26] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2443960 2014-10-30] (Microsoft Corporation)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [74712 2013-03-11] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [316376 2013-03-11] (CyberLink)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-14] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-06] (Microsoft Corporation)
R2 PGFNEXSrv; C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe [136192 2013-12-03] () [File not signed]
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [389896 2013-03-06] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [20496 2013-09-04] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [247576 2014-07-24] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-20] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-12] (AVG Technologies)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [273176 2014-07-18] (AVG Technologies CZ, s.r.o.)
R1 b786bdb3c67d; C:\Windows\System32\drivers\b786bdb3c67d.sys [52016 2014-11-05] (Windows (R) Win 7 DDK provider)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 PegaRadioSwitch; C:\Windows\System32\drivers\PegaRadioSwitch.sys [23552 2013-08-22] (Windows (R) Win 7 DDK provider)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [548056 2013-09-05] (Realtek Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2945240 2013-09-12] (Realtek Semiconductor Corporation )
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-14] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-14] (Synaptics Incorporated)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [87568 2013-07-01] (Intel Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-14 00:49 - 2014-11-14 00:49 - 00001294 _____ () C:\Users\Neo\Desktop\JRT.txt
2014-11-14 00:43 - 2014-11-14 00:43 - 00000000 ____D () C:\Windows\ERUNT
2014-11-14 00:42 - 2014-11-14 00:42 - 01706808 _____ (Thisisu) C:\Users\Neo\Downloads\JRT.exe
2014-11-14 00:39 - 2014-11-14 00:39 - 00009189 _____ () C:\Users\Neo\Desktop\AdwCleaner[S2].txt
2014-11-14 00:32 - 2014-11-14 00:32 - 02140160 _____ () C:\Users\Neo\Downloads\AdwCleaner_4.101.exe
2014-11-14 00:19 - 2014-11-14 00:19 - 05597734 _____ (Swearware) C:\Users\Neo\Downloads\ComboFix.exe
2014-11-13 23:42 - 2014-11-13 23:43 - 00029599 _____ () C:\Users\Neo\Downloads\Addition.txt
2014-11-13 23:41 - 2014-11-14 00:59 - 00018954 _____ () C:\Users\Neo\Downloads\FRST.txt
2014-11-13 23:40 - 2014-11-14 00:59 - 00000000 ____D () C:\FRST
2014-11-13 23:39 - 2014-11-13 23:39 - 02116608 _____ (Farbar) C:\Users\Neo\Downloads\FRST64.exe
2014-11-13 22:53 - 2014-11-13 22:53 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-13 22:51 - 2014-11-13 22:51 - 00001118 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2014-11-13 22:51 - 2014-11-13 22:51 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2014-11-13 22:51 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-13 22:51 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-13 22:51 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-13 22:49 - 2014-11-13 22:49 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Cliqz
2014-11-13 22:49 - 2011-05-13 11:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-11-13 22:49 - 2011-03-25 19:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-11-13 22:47 - 2014-11-13 22:47 - 01125200 _____ () C:\Users\Neo\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-11-13 22:16 - 2014-11-13 22:16 - 00000000 ____D () C:\Windows\softwaredistribution.bak2
2014-11-13 22:06 - 2013-08-22 14:25 - 00000824 _____ () C:\Windows\system32\Drivers\etc\hosts.20141113-220659.backup
2014-11-13 21:55 - 2014-11-13 21:55 - 00009839 _____ () C:\Users\Neo\Desktop\Scan Results.141113-2155.txt
2014-11-13 18:14 - 2014-11-13 18:14 - 00000000 ____D () C:\Program Files (x86)\f552dd4c52e3
2014-11-11 00:05 - 2014-11-11 00:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\ProgramData\Samsung
2014-11-10 08:47 - 2014-11-10 08:47 - 00000000 ____D () C:\Program Files (x86)\SamsungPrinterLiveUpdate
2014-11-05 18:36 - 2014-11-05 18:36 - 00052016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\b786bdb3c67d.sys
2014-10-24 12:57 - 2014-10-24 13:24 - 614846156 _____ () C:\Users\Neo\Desktop\Freunde fürs Leben.mp4
2014-10-24 12:52 - 2014-10-24 12:57 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\HandBrake
2014-10-24 12:51 - 2014-10-24 12:51 - 14298467 _____ () C:\Users\Neo\Downloads\HandBrake-0.9.9-1_x86_64-Win_GUI.exe
2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\Neo\Desktop\Handbrake.lnk
2014-10-24 12:51 - 2014-10-24 12:51 - 00000840 _____ () C:\Users\admin\Desktop\Handbrake.lnk
2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Handbrake
2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Handbrake
2014-10-24 12:51 - 2014-10-24 12:51 - 00000000 ____D () C:\Program Files\Handbrake
2014-10-24 12:34 - 2014-10-24 12:34 - 00001171 _____ () C:\Users\Public\Desktop\CDBurnerXP.lnk
2014-10-24 12:34 - 2014-10-24 12:34 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Canneverbe Limited
2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\ProgramData\Canneverbe Limited
2014-10-24 12:34 - 2014-10-24 12:34 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2014-10-24 12:33 - 2014-10-24 12:33 - 05402840 _____ (Canneverbe Limited ) C:\Users\Neo\Downloads\cdbxp_setup_4.5.4.5143_minimal.exe
2014-10-21 20:46 - 2014-10-21 20:46 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\AVG2015
2014-10-21 20:45 - 2014-10-21 20:45 - 00001001 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2014-10-21 20:43 - 2014-10-30 23:35 - 00000000 ____D () C:\ProgramData\AVG2015
2014-10-21 20:43 - 2014-10-21 20:43 - 00000000 ____D () C:\Users\admin\AppData\Local\Avg
2014-10-21 20:39 - 2014-10-22 14:42 - 00000000 ____D () C:\Users\Neo\AppData\Local\Avg2015
2014-10-15 19:55 - 2014-10-09 23:16 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-15 19:55 - 2014-10-08 23:09 - 00275968 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-15 19:55 - 2014-09-19 02:24 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-15 19:55 - 2014-09-13 07:02 - 02779648 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-15 19:55 - 2014-09-13 06:30 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 19:55 - 2014-09-04 01:10 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\winbici.dll
2014-10-15 19:55 - 2014-09-04 00:57 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-10-15 19:55 - 2014-09-04 00:49 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-10-15 19:55 - 2014-08-29 02:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-10-15 19:55 - 2014-08-29 00:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-10-15 19:55 - 2014-08-29 00:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-10-15 19:38 - 2014-09-27 23:25 - 04183040 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-15 19:38 - 2014-09-08 04:15 - 00054752 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-10-15 19:38 - 2014-09-08 02:46 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-10-15 19:38 - 2014-09-08 02:46 - 00050688 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-10-15 19:38 - 2014-09-08 01:08 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-10-15 19:38 - 2014-09-08 01:07 - 00137728 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-10-15 19:38 - 2014-09-08 01:05 - 03448320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-10-15 19:38 - 2014-09-08 01:04 - 00388608 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-10-15 19:38 - 2014-09-08 01:04 - 00093696 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-10-15 19:38 - 2014-09-08 01:03 - 01702400 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-10-15 19:38 - 2014-09-08 01:03 - 00839680 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-10-15 19:38 - 2014-09-08 00:59 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-10-15 19:38 - 2014-09-08 00:59 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-10-15 19:38 - 2014-09-08 00:56 - 00672256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-10-15 19:38 - 2014-09-08 00:56 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-10-15 19:37 - 2014-09-13 07:29 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-15 19:37 - 2014-09-13 06:49 - 00068608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-15 19:36 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-15 19:36 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 19:36 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 19:36 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 19:36 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 19:36 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-15 19:36 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-15 19:36 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 19:36 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-15 19:36 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-15 19:36 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-15 19:36 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-15 19:36 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 19:36 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-15 19:36 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 19:36 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-15 19:36 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 19:36 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-15 19:36 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 19:36 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-15 19:36 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-15 19:36 - 2014-09-19 01:42 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-15 19:36 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-15 19:36 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 19:36 - 2014-09-19 01:20 - 00315904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 19:36 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-15 19:36 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 19:36 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-15 19:36 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 19:36 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 19:36 - 2014-09-04 01:12 - 00590336 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-15 19:36 - 2014-09-04 01:01 - 00514048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 19:36 - 2014-08-16 05:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-15 19:36 - 2014-08-16 04:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-10-15 19:36 - 2014-08-16 04:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-15 19:36 - 2014-08-16 01:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-10-15 19:36 - 2014-08-16 01:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-10-15 19:36 - 2014-08-16 01:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-10-15 19:36 - 2014-08-16 01:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-15 19:36 - 2014-08-16 01:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-10-15 19:36 - 2014-08-16 01:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 19:35 - 2014-08-16 05:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-10-15 19:35 - 2014-08-16 05:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-10-15 19:35 - 2014-08-16 04:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 04:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-10-15 19:35 - 2014-08-16 04:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-10-15 19:35 - 2014-08-16 04:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-10-15 19:35 - 2014-08-16 02:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-10-15 19:35 - 2014-08-16 02:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 01:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2014-10-15 19:35 - 2014-08-16 01:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2014-10-15 19:35 - 2014-08-16 01:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll
2014-10-15 19:35 - 2014-08-16 01:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2014-10-15 19:35 - 2014-08-16 01:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-10-15 19:35 - 2014-08-16 01:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2014-10-15 19:35 - 2014-08-16 01:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-15 19:35 - 2014-08-16 01:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll
2014-10-15 19:35 - 2014-08-16 01:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 01:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-10-15 19:35 - 2014-08-16 01:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 01:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-10-15 19:35 - 2014-08-16 01:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll
2014-10-15 19:35 - 2014-08-16 01:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-10-15 19:35 - 2014-08-16 01:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-10-15 19:35 - 2014-08-16 01:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-10-15 19:35 - 2014-08-16 01:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-10-15 19:35 - 2014-08-01 00:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-11-14 00:56 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job
2014-11-14 00:56 - 2014-08-29 23:36 - 00000390 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job
2014-11-14 00:56 - 2014-08-16 19:44 - 00043296 _____ () C:\Windows\PFRO.log
2014-11-14 00:56 - 2014-01-15 19:46 - 00403207 _____ () C:\Users\Neo\AppData\Local\BTServer.log
2014-11-14 00:56 - 2014-01-15 19:45 - 01369221 _____ () C:\Windows\WindowsUpdate.log
2014-11-14 00:56 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-14 00:55 - 2014-05-23 12:22 - 00000000 ____D () C:\AdwCleaner
2014-11-14 00:51 - 2014-01-15 19:52 - 00003596 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-4021730028-2611376806-967486672-1001
2014-11-14 00:45 - 2014-03-15 20:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-14 00:43 - 2013-11-12 12:57 - 00793160 _____ () C:\Windows\system32\perfh010.dat
2014-11-14 00:43 - 2013-11-12 12:57 - 00156082 _____ () C:\Windows\system32\perfc010.dat
2014-11-14 00:43 - 2013-11-12 12:32 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2014-11-14 00:43 - 2013-11-12 12:32 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2014-11-14 00:43 - 2013-11-12 12:09 - 02726338 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-14 00:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2014-11-13 23:56 - 2014-08-25 22:51 - 00003910 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9D5DDB08-682D-474D-B8F1-06065B577A40}
2014-11-13 22:51 - 2014-03-16 15:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-11-13 22:43 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-11-13 22:09 - 2014-07-23 18:47 - 00000000 ____D () C:\ProgramData\MFAData
2014-11-13 20:50 - 2014-03-18 19:54 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-11-13 19:58 - 2014-01-17 17:17 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-11-13 19:36 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-11-13 17:40 - 2014-08-24 13:49 - 00000220 _____ () C:\Users\Neo\BullseyeCoverageError.txt
2014-11-13 12:28 - 2014-01-15 22:19 - 00000000 ____D () C:\HebRechw
2014-11-12 11:00 - 2014-03-22 13:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-12 10:57 - 2014-07-31 16:44 - 00010763 _____ () C:\Windows\setupact.log
2014-11-12 10:45 - 2014-03-15 20:48 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-12 10:02 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-11-08 19:31 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-11-05 23:06 - 2014-09-02 21:03 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\Skype
2014-11-02 13:41 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2014-11-01 19:04 - 2014-01-22 18:55 - 00000000 ___RD () C:\Users\Neo\SkyDrive
2014-11-01 19:03 - 2013-08-22 15:44 - 00515072 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ___RD () C:\Windows\ToastData
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\WinStore
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\sl-SI
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\SysWOW64\en-GB
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sl-SI
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\en-GB
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\MediaViewer
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\FileManager
2014-11-01 19:00 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\Camera
2014-11-01 18:40 - 2014-01-20 00:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-11-01 18:34 - 2013-11-12 13:49 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-11-01 18:33 - 2014-07-24 20:16 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-30 23:42 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-10-29 08:35 - 2013-11-12 16:46 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-24 15:34 - 2014-02-09 13:03 - 00411648 ___SH () C:\Users\Neo\Desktop\Thumbs.db
2014-10-24 15:30 - 2014-01-17 18:27 - 00000000 ____D () C:\Users\Neo\AppData\Roaming\vlc
2014-10-21 20:46 - 2014-07-23 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ___HD () C:\$AVG
2014-10-21 20:46 - 2014-07-23 18:48 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-10-20 09:04 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
Some content of TEMP:
====================
C:\Users\Neo\AppData\Local\Temp\AppLauncher.exe
C:\Users\Neo\AppData\Local\Temp\Quarantine.exe
C:\Users\Neo\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-11-09 12:52
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-11-2014 02
Ran by Neo at 2014-11-14 01:00:34
Running from C:\Users\Neo\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ashampoo AppLauncher (Medion) v.1.0.0 (HKLM-x32\...\Ashampoo AppLauncher (Medion)_is1) (Version: 1.0.0 - Ashampoo GmbH & Co. KG)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5315 - AVG Technologies)
AVG 2015 (Version: 15.0.4213 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5315 - AVG Technologies) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.31 - Cliqz.com)
CyberLink Home Cinema 10 (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
CyberLink PowerDirector 11 (Version: 11.0.0.3215 - CyberLink Corp.) Hidden
CyberLink PowerRecover (HKLM-x32\...\InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.7.0.2103 - CyberLink Corp.)
CyberLink PowerRecover (Version: 5.7.0.2103 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Epson Easy Photo Print 2 (HKLM-x32\...\{94FA9FA6-5294-494D-A8F1-1E654CBB5736}) (Version: 2.2.3.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
EPSON-Drucker-Software (HKLM-x32\...\EPSON Printer and Utilities) (Version: - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotogalerija (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fotótár (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Galerie de photos (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
HandBrake 0.9.9.1 (HKLM-x32\...\HandBrake) (Version: 0.9.9.1 - )
HebRech HebRechw (HKLM-x32\...\{C63B768B-8B87-46F0-B56E-F863FD9E0870}) (Version: 0 - )
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3349 - Intel Corporation)
Intel(R) Trusted Execution Engine (HKLM\...\{176E2755-0A17-42C6-88E2-192AB2131278}) (Version: 1.0.0.1050 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
kwiksupport.me (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\kwiksupport.me) (Version: 12.0.36.1315 - pcvisit Software AG)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4667.1002 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4667.1002 - Microsoft Corporation) Hidden
OpenOffice 4.1.0 (HKLM-x32\...\{E19483E2-6C18-494D-A307-D4498BCFD2C7}) (Version: 4.10.9764 - Apache Software Foundation)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0094 - Pegatron Corporation)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.769.769.093013 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.39052 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7045 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.00.0227 - REALTEK Semiconductor Corp.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Snap.Do (HKLM-x32\...\{FB385922-2E32-4462-A7DC-27159614A660}) (Version: 10.213.1.15234 - ReSoft Ltd.) <==== ATTENTION
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.9.1 - Synaptics Incorporated)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Unity Web Player (HKU\S-1-5-21-4021730028-2611376806-967486672-1001\...\UnityWebPlayer) (Version: 4.5.3f3 - Unity Technologies ApS)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version: - Tangysoft Ltd.)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Phone app for desktop (HKLM-x32\...\{9C4D79B6-238E-49D8-AEBC-26384EBDE6B3}) (Version: 1.0.1720.1 - Microsoft Corporation)
YTD Video Downloader 4.8.1 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.1 - GreenTree Applications SRL) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-4021730028-2611376806-967486672-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Neo\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910_1\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
29-10-2014 07:34:17 Installiert HebRech
01-11-2014 17:32:32 Windows Update
09-11-2014 12:16:09 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2014-11-13 22:06 - 00450713 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
127.0.0.1 123moviedownload.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01072E6C-C09D-4986-9538-5AB4A7BC5EE0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {2E4E5FB0-8196-4357-99FC-83CA1E6C56CC} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {3A5C66F6-D705-4625-B73A-76C548EAC52C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {5361FB93-DA83-4C45-BC63-C968DC5054D4} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-10-22] (Microsoft Corporation)
Task: {63507F5D-2B25-4F2C-B91C-37AF27306AC8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-10-07] (Microsoft Corporation)
Task: {770BA74E-28E4-4E65-90B5-625D6C5C4010} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-11-01] (Microsoft Corporation)
Task: {8E16DB4C-8B87-4373-BD41-69A7C7308962} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rmv => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()
Task: {97DB4190-102B-4B17-BBA8-F2A377B3D6F7} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-14] (Synaptics Incorporated)
Task: {9AEA6DB9-8F05-4D7B-B764-225E14DAE2EA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)
Task: {C8CAF07B-7DAC-47DF-AF3E-BFDA1E22560C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DD1CB7F8-F551-4981-8AD1-DAD7C2C1DE18} - System32\Tasks\AVG-Secure-Search-Update_0814tb_rel => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe [2014-08-29] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rel.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0814tb_rmv.job => C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
==================== Loaded Modules (whitelisted) =============
2013-12-03 07:30 - 2013-12-03 00:21 - 00136192 _____ () C:\Program Files (x86)\PHotkey\PGFNEXSrv.exe
2014-08-26 09:38 - 2014-08-26 09:38 - 00034304 _____ () C:\Windows\System32\ssd3clm.dll
2013-11-18 17:35 - 2013-09-26 21:08 - 00061440 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-03-19 02:11 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-11-12 16:53 - 2013-03-06 15:42 - 00389896 _____ () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-08-29 23:36 - 2014-08-29 23:36 - 02782744 _____ () C:\Program Files (x86)\Avg Secure Update\AVG-Secure-Search-Update_0814tb.exe
2013-12-03 07:30 - 2013-10-14 20:11 - 02215424 _____ () C:\Program Files (x86)\PHotkey\PHotkey.exe
2013-12-03 07:30 - 2012-10-23 19:07 - 03471872 _____ () C:\Program Files (x86)\PHotkey\POSD.exe
2013-12-03 07:30 - 2013-10-14 18:09 - 08856576 _____ () C:\Program Files (x86)\PHotkey\GPMTray.exe
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-18 19:54 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-03-18 19:54 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-03-18 19:54 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-03-18 19:54 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-03-18 19:54 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-12-03 07:30 - 2009-12-18 16:36 - 00973432 _____ () C:\Program Files (x86)\PHotkey\acAuth.dll
2013-12-03 07:30 - 2013-09-18 00:23 - 00108032 _____ () C:\Program Files (x86)\PHotkey\PGFNEX.dll
2014-11-11 00:05 - 2014-11-11 00:05 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Neo\SkyDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKCU\...\StartupApproved\Run: => "AppLauncher"
HKCU\...\StartupApproved\Run: => "TomTomHOME.exe"
========================= Accounts: ==========================
admin (S-1-5-21-4021730028-2611376806-967486672-1004 - Limited - Enabled) => C:\Users\admin
Administrator (S-1-5-21-4021730028-2611376806-967486672-500 - Administrator - Disabled)
Gast (S-1-5-21-4021730028-2611376806-967486672-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4021730028-2611376806-967486672-1003 - Limited - Enabled)
Neo (S-1-5-21-4021730028-2611376806-967486672-1001 - Administrator - Enabled) => C:\Users\Neo
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Error: (11/14/2014 00:53:29 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (11/14/2014 00:52:59 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Error: (11/14/2014 00:52:29 AM) (Source: DCOM) (EventID: 10010) (User: Angie)
Description: {9AA46009-3CE0-458A-A354-715610A075E6}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU N3520 @ 2.16GHz
Percentage of memory in use: 41%
Total physical RAM: 3975.78 MB
Available physical RAM: 2325.92 MB
Total Pagefile: 6151.78 MB
Available Pagefile: 4445.21 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:869.8 GB) (Free:459.55 GB) NTFS
Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.39 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 0433B666)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
14.11.2014, 01:17
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Program Files (x86)\f552dd4c52e3
C:\Windows\system32\Drivers\b786bdb3c67d.sys
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.11.2014, 01:39
| #9 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc..Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-11-2014 02
Ran by Neo at 2014-11-14 01:35:08 Run:1
Running from C:\Users\Neo\Downloads
Loaded Profile: Neo (Available profiles: Neo & admin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\Program Files (x86)\f552dd4c52e3
C:\Windows\system32\Drivers\b786bdb3c67d.sys
EmptyTemp:
Hosts:
*****************
C:\Windows\system32\GroupPolicy\Machine => Moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully.
C:\Program Files (x86)\f552dd4c52e3 => Moved successfully.
C:\Windows\system32\Drivers\b786bdb3c67d.sys => Moved successfully.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 421 MB temporary data.
The system needed a reboot.
==== End of Fixlog ====
|
|
14.11.2014, 01:42
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.11.2014, 09:43
| #11 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Moin moin, mir ist da wohl ein Fehler unterlaufen gestern nacht. Habe den mbam durchlaufen lassen, alles gut. Dann den Eset, der hat 36 Ergebnisse gefunden und auch gecleant, hier habe ich dann aber blöderweise erst eset gelöscht und wollte dann die logdatei sichern, was wohl eine ziemlich blöde idee war  Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.11.2014 Suchlauf-Zeit: 01:46:35 Logdatei: Verlaufsprotokoll MBAM 14.11. um 01-46.txt Administrator: Ja Version: 2.00.3.1025 Malware Datenbank: v2014.11.13.11 Rootkit Datenbank: v2014.11.12.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Neo Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 368052 Verstrichene Zeit: 14 Min, 13 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 3 PUP.Optional.Snapdo.T, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [69e695a63b4148eefcd2965cd13135cb], PUP.Optional.SnapDo.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{FB385922-2E32-4462-A7DC-27159614A660}, In Quarantäne, [f25d63d8770576c0202a1b3b50b333cd], PUP.Optional.ReMarkit.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Re_markit, In Quarantäne, [db74b8839edef34394f80435956e5fa1], Registrierungswerte: 1 PUP.Optional.QuickStart.A, HKU\S-1-5-21-4021730028-2611376806-967486672-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MOZILLA\EXTENDS|appid, quick_start@gmail.com, In Quarantäne, [28270e2daeceb08621b2d67734cfa35d] Registrierungsdaten: 7 PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[89c640fb92eafe3856d46ddafd08bf41] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3eba5_DiucFdLYTB9pFW2cL4NJdjxdt3hOhFUD8xYbZwZWIFyg5rrfRBjDSxIi8A,,),Ersetzt,[3b143605710b1422b1c2e754f0150ef2] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Bar, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[e56ad06b6616f541363bf2497b8a1ce4] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[074806355725b38384ee6bd04cb97c84] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|Default_Search_URL, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[450ac8738cf0c5717ff585b63acb1fe1] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCH|SearchAssistant, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[88c78dae631974c27cf9c17a5da8d030] PUP.Optional.SnapDo.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURL|Default, hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}, Gut: (www.google.com), Schlecht: (hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPBDDI6Pk-fpITtt_7-dx2uywuT-4gdlO-xkuKtzfsTQg0iHq479UdDx0gr_AOT-HMvba7NyKJEnmvKQ0GzMHvr-ySCO0-3Te0PbmfCNBQh6w3SBKgxVQ_XSw4QbQNn23-VOI-0FmHGoBqkXyViEiSNV8p1-mjMgwtr9NBPgUZuHg,,&q={searchTerms}),Ersetzt,[a6a92f0cdba1cd6996da14273dc838c8] Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 4 PUP.Optional.Softonic.A, C:\Users\Neo\Downloads\SoftonicDownloader_fuer_usenext-by-tangysoft.exe, In Quarantäne, [c986d5660676da5cde5289b02fd2b050], PUP.Optional.SnapDo.A, C:\Windows\Installer\3f13e2a.msi, In Quarantäne, [a8a7093281fb290d4cd0d5c8d928ec14], PUP.Optional.SmartBar, C:\Windows\Installer\3f13e2f.msi, In Quarantäne, [f35cf843d2aa69cd0e45e974768ae917], PUP.Optional.SmartBar, C:\Windows\Installer\MSICE74.tmp, In Quarantäne, [07489c9f344877bf53fdc06e3ac6b64a], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) |
|
14.11.2014, 09:58
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Nachsehen ob das Log noch da ist => C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt
__________________ Logfiles bitte immer in CODE-Tags posten |
|
14.11.2014, 11:17
| #13 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. die Logdatei ist nicht enthalten, aber der Quarantäneordner also wenn es jetzt grad nicht passt, komme ich gern später nochmal vorbei |
|
14.11.2014, 11:53
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | SSL Verbindungen nicht möglich, Werbeeinblendungen etc.. Dann poste mal was im Q-Ordner so drin ist. BTW: beim nächsten Mal Anleitungen sorgfältiger lesen und umsetzen! Es war nämlich auch nirgends davon die Rede, gleich alle Funde von ESET entfernen/qurantänisieren zu lassen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.11.2014, 10:52
| #15 |
| | SSL Verbindungen nicht möglich, Werbeeinblendungen etc..Code:
ATTFilter "C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\0F2D328D247CA15F94E213F9CE672C26CA38D1CB.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\0F2D328D247CA15F94E213F9CE672C26CA38D1CB.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\02EE6953C42E00D8537F9D4EE4FC17FBC585A977.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\02EE6953C42E00D8537F9D4EE4FC17FBC585A977.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\3E8819650A18C03766FC2E3BE41229F5A8714A2D.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\3E8819650A18C03766FC2E3BE41229F5A8714A2D.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\4B260C65E134BD727DCB64C6714E1FFB254CB530.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\4B260C65E134BD727DCB64C6714E1FFB254CB530.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\5EDE20FC0EA1624A137C1BF287B92652D9FA66E1.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\5EDE20FC0EA1624A137C1BF287B92652D9FA66E1.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\6BF3E641CE0003E395A0A0D98AFB3F025334F695.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\6BF3E641CE0003E395A0A0D98AFB3F025334F695.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8AB15733E80D0AE684F54EB075FC220DF1BD5721.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8AB15733E80D0AE684F54EB075FC220DF1BD5721.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8BC417D84335C8A2984292D841C3006F4AA33F19.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8BC417D84335C8A2984292D841C3006F4AA33F19.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9F0EA35160926E4942A6BC111D875996998C4FD6.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9F0EA35160926E4942A6BC111D875996998C4FD6.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\10F9842480E87690836752FCBA2B6E344D0E054D.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\10F9842480E87690836752FCBA2B6E344D0E054D.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\014F23F5E81D3CC85A71475CA1B02E8A3731FAAC.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\014F23F5E81D3CC85A71475CA1B02E8A3731FAAC.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\31CE21FE36C11E107A6E315EFE1875743809B4CC.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\31CE21FE36C11E107A6E315EFE1875743809B4CC.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36A651B5F6A5FB5D5A745EECCD12DEAEAB11AE8A.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36A651B5F6A5FB5D5A745EECCD12DEAEAB11AE8A.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36BCD3D0EE6EF331F04718C7CED07A334D81552D.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\36BCD3D0EE6EF331F04718C7CED07A334D81552D.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\86FD2D88F3C4675471D14644D2A2D8A0B08BA2F4.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\95D8C7F2851240F836D46EBD0DCB0BBAE3C9C3C8.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\95D8C7F2851240F836D46EBD0DCB0BBAE3C9C3C8.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\110D3E4159E6C7B402007177EE69E327FA0AC162.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\110D3E4159E6C7B402007177EE69E327FA0AC162.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\189FC4DEFBF3AF52775F7A922789A0CA6A8FF6F8.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\189FC4DEFBF3AF52775F7A922789A0CA6A8FF6F8.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\464FD963183897BB987030A2097E759ED613A79C.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\464FD963183897BB987030A2097E759ED613A79C.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8092C608B4E086365D99AC1EA8AF340C95A6B1B2.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8092C608B4E086365D99AC1EA8AF340C95A6B1B2.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8774AA195A698576B83AF82BE29B362AF8C0B512.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\8774AA195A698576B83AF82BE29B362AF8C0B512.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9645D8A917BFFE50ED3F525480EFE951FDE8E146.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\9645D8A917BFFE50ED3F525480EFE951FDE8E146.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\A277DF5632CC598D56A87ACEAC6E7C5FC07E3644.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\A277DF5632CC598D56A87ACEAC6E7C5FC07E3644.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\B310E48B006E13F32CF85BD62F52BB75F2A6C239.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\B310E48B006E13F32CF85BD62F52BB75F2A6C239.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\C1FE3F6968B84F8ACA156B5A6F421D9A09893B3F.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\C1FE3F6968B84F8ACA156B5A6F421D9A09893B3F.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\D1AC909FA3DA3ACE7120A10116A2172DE0FCA1ED.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\D1AC909FA3DA3ACE7120A10116A2172DE0FCA1ED.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E4D52A13B9D9F3D5BE0C4653857250D633223518.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E4D52A13B9D9F3D5BE0C4653857250D633223518.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E262DCB663133609DD976740F886911FD404FEE1.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\E262DCB663133609DD976740F886911FD404FEE1.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\F94B61AC9BAA10B3CF6B6016E30DB718667FD14C.NDF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\F94B61AC9BAA10B3CF6B6016E30DB718667FD14C.NQF"
"C:\Program Files (x86)\ESET\ESET Online Scanner\Quarantine\INFO.NQI"
|
|
Linear-Darstellung
