| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spyhunter4Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
26.03.2015, 17:44
| #16 |
| /// the machine /// TB-Ausbilder    |  Spyhunter4 Sorry, den Kaudawelsch hab ich echt nit verstanden. "Von meinem C"???? Also Tools und Logs auf deinem PC werden beim Cleanup gelöscht. Im Forum wird nix gelöscht, weißt Du ja aber durch Lesen der Regeln vor dem Posten  http://www.trojaner-board.de/108422-...-anfragen.html
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.03.2015, 17:52
| #17 |
| /// the machine /// TB-Ausbilder | Spyhunter4 und einen müssen wir noch nach-schiessen.
__________________Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter FF Extension: {c08d4f0f-41bf-4efd-9682-47120562260f} - C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\0cbfi67b.default\Extensions\{c08d4f0f-41bf-4efd-9682-47120562260f}.xpi [2015-03-05]
FF HKLM\...\Firefox\Extensions: [{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}] - C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}.xpi [2014-12-04]
C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Sonst is unser Adware-Matti böse mit mir 
__________________ |
|
27.03.2015, 10:37
| #18 | |
 | Spyhunter4Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Master at 2015-03-27 08:33:42 Run:1
Running from C:\Users\Master\Downloads
Loaded Profiles: Master (Available profiles: Master)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
FF Extension: {c08d4f0f-41bf-4efd-9682-47120562260f} - C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\0cbfi67b.default\Extensions\{c08d4f0f-41bf-4efd-9682-47120562260f}.xpi [2015-03-05]
FF HKLM\...\Firefox\Extensions: [{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}] - C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}.xpi
FF Extension: Download Protect - C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}.xpi [2014-12-04]
C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}
*****************
C:\Users\Master\AppData\Roaming\Mozilla\Firefox\Profiles\0cbfi67b.default\Extensions\{c08d4f0f-41bf-4efd-9682-47120562260f}.xpi => Moved successfully.
HKLM\Software\Mozilla\Firefox\Extensions\\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6} => value deleted successfully.
C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49}\{1487B389-CBE5-4D22-A18C-F504A1CEB5E6}.xpi => Moved successfully.
C:\Windows\Installer\{82806997-32A5-4906-97DF-4ADBB2999F49} => Moved successfully.
==== End of Fixlog 08:33:42 ====
Zitat:
Ha,ha,ha...wenn ich es posten (herunterladen) gelesen hätte, hätten wir uns nicht kennen gelernt :-) Der letzte Satz sollte heißen: wenn ich es vor dem Posten (oder vor dem Herunterladen) gelesen hätte, hätten wir uns nicht kennen gelernt :-)  Geändert von Taschaa (27.03.2015 um 08:35 Uhr) |
|
27.03.2015, 19:42
| #19 |
| /// the machine /// TB-Ausbilder | Spyhunter4 Da is doch das nicht-Löschen der Logs ein gerne angenommenes kleines Minus
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.03.2015, 09:22
| #20 |
| | Spyhunter4 Jedenfalls DANKE, eine kleine Spende ist auch überwiesen worden... ich habe da noch einen PC, den ich auch auf Vordermann bringen möchte... Ich möchte erst schauen, ob sich da etwas eingenistet hat. Den wird später mein Sohn bekommen. Muss sauber und kindergeschützt sein. Sag mir nur in welchem Forum ich posten sollte. Schöne Grüße und noch ein schöneres WE. |
|
28.03.2015, 19:39
| #21 |
| /// the machine /// TB-Ausbilder | Spyhunter4 Einfach hier, poste mal FRST Logs von der Kiste
__________________ --> Spyhunter4 |
|
02.04.2015, 08:06
| #22 |
| | Spyhunter4 Guten Morgen Schrauber, wollte Dich noch was fragen. Mein PC ist trotz aller Bemühungen total lahm und im Hintegrund laufen folg. Programme: Code:
ATTFilter Ja HKCU:Run Sidebar Microsoft Corporation C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
Ja HKLM:Run emsisoft anti-malware Emsisoft GmbH "c:\program files\emsisoft anti-malware\a2guard.exe" /d=60
Ja HKLM:Run GrooveMonitor Microsoft Corporation "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
Ja HKLM:Run HotKeysCmds Intel Corporation C:\Windows\system32\hkcmd.exe
Ja HKLM:Run IgfxTray Intel Corporation C:\Windows\system32\igfxtray.exe
Ja HKLM:Run Malwarebytes Anti-Exploit Malwarebytes Corporation C:\Program Files\Malwarebytes Anti-Exploit\mbae.exe
Ja HKLM:Run Persistence Intel Corporation C:\Windows\system32\igfxpers.exe
Ja HKLM:Run SunJavaUpdateSched Oracle Corporation "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
Ja Startup Common Acrobat Assistant.lnk Adobe Systems Inc. C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
Schöne Grüße |
|
02.04.2015, 20:00
| #23 |
| /// the machine /// TB-Ausbilder | Spyhunter4 Kann alles raus bis auf Emsisoft, Malwarebytes Anti-Exploit, Hotkey und IgfxTray.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.04.2015, 12:46
| #24 |
| | Spyhunter4 An diesem PC kannst du dich richtig austoben ;.) Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Natalie at 2015-04-07 13:25:20
Running from C:\Users\Natalie\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ATI AVIVO Codecs (Version: 10.10.0.40918 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{6923794C-23D0-AB85-ED14-E789C4F0C92A}) (Version: 3.0.745.0 - ATI Technologies, Inc.)
BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.908.2201 - Micro-Star International Co., Ltd.)
ccc-core-static (Version: 2009.0918.2132.36825 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
CIR Tool Kit (HKLM\...\{245BDABA-CD34-4A57-8BE7-F2784A4E0BA4}) (Version: 2.1.2009.0619 - Nuvoton)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Feven 1.5 (HKLM\...\Feven 1.5) (Version: 1.31.153.4 - Feven) <==== ATTENTION
FileParade bundle uninstaller (HKLM\...\FileParade bundle uninstaller) (Version: 2.0.0.5 - FileParade) <==== ATTENTION
Free YouTube Download version 3.2.16.1030 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.16.1030 - DVDVideoSoft Ltd.)
Freemake Audio Converter Version 1.1.0 (HKLM\...\Freemake Audio Converter_is1) (Version: 1.1.0 - Ellora Assets Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help Actualización (KB963678) (HKLM\...\{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{59E09C3D-4878-47D9-87DB-6D0018026889}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (HKLM\...\{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F318245D-05AE-4681-A749-A036CE44AF29}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Office Word 2007 Help Actualización (KB963665) (HKLM\...\{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{377BA42A-1C84-45D6-94B8-6D00887D172D}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: - )
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
msi Easy Mode (HKLM\...\InstallShield_{1E76851A-F0CD-40EE-B0FA-0A279E57A41C}) (Version: 0.10.2.3 - msi)
msi Easy Mode (Version: 0.10.2.3 - msi) Hidden
msi EasyViewer (HKLM\...\InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}) (Version: 1.2 - msi)
msi EasyViewer (Version: 1.2 - msi) Hidden
MSI Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.908.2001 - MSI)
PC-Kids Deutsch 3 (HKLM\...\PC-Kids Deutsch 3_is1) (Version: - PC-Kids)
PC-Kids Mathematik 1 (HKLM\...\PC-Kids Mathematik 1_is1) (Version: - PC-Kids)
Performancer (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version: - 24soft) <==== ATTENTION
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5897 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0124 - REALTEK Semiconductor Corp.)
Search Protect (HKLM\...\SearchProtect) (Version: 2.15.14.58 - Client Connect LTD) <==== ATTENTION
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Snap.Do (HKLM\...\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}) (Version: 11.20.1.15636 - ReSoft Ltd.) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SupTab (HKLM\...\SupTab) (Version: 1.1.1.0 - ) <==== ATTENTION
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
ViewPassword (HKLM\...\e9737a78-b8c6-4465-9feb-7e2a4f782ad9) (Version: - ViewPassword Software) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-06-2014 20:34:48 Windows Update
09-07-2014 14:40:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {18F33C20-ACE9-4B50-8104-A6B88919B31B} - System32\Tasks\Feven 1.5-chromeinstaller => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: {3EFCCEEB-36D7-492C-A890-60FC3F998592} - System32\Tasks\Feven 1.5-codedownloader => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: {41579739-7886-408D-A7CA-E59749C1B766} - System32\Tasks\ViewPassword Update => C:\Program Files\ViewPassword\ViewPassword.exe <==== ATTENTION
Task: {458EEF1C-C145-4B4E-904A-DA20802DEFEA} - System32\Tasks\LaunchApp => C:\Program Files\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {5069196D-7999-4ACB-853A-2F27AC1D8E43} - System32\Tasks\Feven 1.5-firefoxinstaller => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exe <==== ATTENTION
Task: {5BC26B85-069F-4594-B370-572272F9F289} - System32\Tasks\Feven 1.5-updater => C:\Program Files\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: {8494FBCE-60B7-4BE4-BD2D-BDE7F6D35231} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {968667C6-5948-424B-9D59-07910CE7699C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-07] (Adobe Systems Incorporated)
Task: {97994F1F-569B-49C3-ADA9-F969ECAFA483} - System32\Tasks\Feven 1.5-enabler => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Feven 1.5-chromeinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe)/installcrx /crxinstalltype=0 /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.crx' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-codedownloader.job => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe¾/reinstallapp /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /codedownloaddomain=http:/app-static.crossrider.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-enabler.job => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe“/enablebho /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-firefoxinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exeL/installxpi /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.xpi' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com /extensionversion=0.93 /prefsbranch=a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532 /updateurl=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/38532.rdf <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-updater.job => C:\Program Files\Feven 1.5\Feven 1.5-updater.exeö/runupdater /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /geoserviceurl=http:/ipgeoapi.com/ /updatejsondomain=http:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http:/stats.syncstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\ViewPassword Update.job => C:\Program Files\ViewPassword\ViewPassword.exe
==================== Loaded Modules (whitelisted) ==============
2006-09-14 08:20 - 2006-09-14 08:20 - 00126464 _____ () C:\Program Files\WinRAR 3.61 Multi\rarext.dll
2014-02-22 03:04 - 2014-02-22 03:04 - 00317720 ____N () C:\Program Files\PricePeep\PricePeepUpdater.exe
2009-10-08 01:49 - 2009-10-08 01:49 - 01888256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-10-17 04:48 - 2009-10-17 04:48 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-06-29 18:37 - 2014-06-29 18:37 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-04-07 10:40 - 2015-04-07 10:40 - 16852144 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
==================== Accounts: =============================
Administrator (S-1-5-21-2288368842-2800874389-3385798500-500 - Administrator - Disabled)
Gast (S-1-5-21-2288368842-2800874389-3385798500-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2288368842-2800874389-3385798500-1002 - Limited - Enabled)
Natalie (S-1-5-21-2288368842-2800874389-3385798500-1000 - Administrator - Enabled) => C:\Users\Natalie
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/22/2014 10:22:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 83c
Startzeit: 01cfa596cf78ff4c
Endzeit: 188
Anwendungspfad: C:\Program Files\Skype\Phone\Skype.exe
Berichts-ID:
Error: (07/22/2014 10:22:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/09/2014 02:10:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7a4a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0x0000046b
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xa10
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3
Error: (07/09/2014 09:56:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.15.11.3, Zeitstempel: 0x53abe664
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02a92738
ID des fehlerhaften Prozesses: 0x12a0
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/29/2014 08:18:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c707
ID des fehlerhaften Prozesses: 0x12c8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Error: (06/05/2014 03:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1490
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/03/2014 10:18:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/30/2014 10:37:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002689c0
ID des fehlerhaften Prozesses: 0x17e8
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/24/2014 07:24:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/23/2014 00:43:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x250
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
System errors:
=============
Error: (04/07/2015 11:37:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 11:37:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (04/07/2015 10:36:20 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 10:35:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/22/2014 00:22:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.
Error: (07/18/2014 00:34:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/16/2014 00:39:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/11/2014 03:43:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Microsoft Office Sessions:
=========================
Error: (01/08/2014 01:56:08 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 13987 seconds with 4140 seconds of active time. This session ended with a crash.
Error: (12/01/2013 07:32:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 5226 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz
Percentage of memory in use: 76%
Total physical RAM: 2047.37 MB
Available physical RAM: 484.37 MB
Total Pagefile: 4094.73 MB
Available Pagefile: 1937.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.18 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:68.36 GB) (Free:12.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:848.41 GB) (Free:778.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E174C2EB)
Partition 1: (Not Active) - (Size=14.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=68.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=848.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Natalie at 2015-04-07 13:25:20
Running from C:\Users\Natalie\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ATI AVIVO Codecs (Version: 10.10.0.40918 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{6923794C-23D0-AB85-ED14-E789C4F0C92A}) (Version: 3.0.745.0 - ATI Technologies, Inc.)
BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.908.2201 - Micro-Star International Co., Ltd.)
ccc-core-static (Version: 2009.0918.2132.36825 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
CIR Tool Kit (HKLM\...\{245BDABA-CD34-4A57-8BE7-F2784A4E0BA4}) (Version: 2.1.2009.0619 - Nuvoton)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Feven 1.5 (HKLM\...\Feven 1.5) (Version: 1.31.153.4 - Feven) <==== ATTENTION
FileParade bundle uninstaller (HKLM\...\FileParade bundle uninstaller) (Version: 2.0.0.5 - FileParade) <==== ATTENTION
Free YouTube Download version 3.2.16.1030 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.16.1030 - DVDVideoSoft Ltd.)
Freemake Audio Converter Version 1.1.0 (HKLM\...\Freemake Audio Converter_is1) (Version: 1.1.0 - Ellora Assets Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help Actualización (KB963678) (HKLM\...\{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{59E09C3D-4878-47D9-87DB-6D0018026889}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (HKLM\...\{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F318245D-05AE-4681-A749-A036CE44AF29}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Office Word 2007 Help Actualización (KB963665) (HKLM\...\{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{377BA42A-1C84-45D6-94B8-6D00887D172D}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: - )
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
msi Easy Mode (HKLM\...\InstallShield_{1E76851A-F0CD-40EE-B0FA-0A279E57A41C}) (Version: 0.10.2.3 - msi)
msi Easy Mode (Version: 0.10.2.3 - msi) Hidden
msi EasyViewer (HKLM\...\InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}) (Version: 1.2 - msi)
msi EasyViewer (Version: 1.2 - msi) Hidden
MSI Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.908.2001 - MSI)
PC-Kids Deutsch 3 (HKLM\...\PC-Kids Deutsch 3_is1) (Version: - PC-Kids)
PC-Kids Mathematik 1 (HKLM\...\PC-Kids Mathematik 1_is1) (Version: - PC-Kids)
Performancer (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version: - 24soft) <==== ATTENTION
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5897 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0124 - REALTEK Semiconductor Corp.)
Search Protect (HKLM\...\SearchProtect) (Version: 2.15.14.58 - Client Connect LTD) <==== ATTENTION
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Snap.Do (HKLM\...\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}) (Version: 11.20.1.15636 - ReSoft Ltd.) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SupTab (HKLM\...\SupTab) (Version: 1.1.1.0 - ) <==== ATTENTION
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
ViewPassword (HKLM\...\e9737a78-b8c6-4465-9feb-7e2a4f782ad9) (Version: - ViewPassword Software) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-06-2014 20:34:48 Windows Update
09-07-2014 14:40:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {18F33C20-ACE9-4B50-8104-A6B88919B31B} - System32\Tasks\Feven 1.5-chromeinstaller => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: {3EFCCEEB-36D7-492C-A890-60FC3F998592} - System32\Tasks\Feven 1.5-codedownloader => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: {41579739-7886-408D-A7CA-E59749C1B766} - System32\Tasks\ViewPassword Update => C:\Program Files\ViewPassword\ViewPassword.exe <==== ATTENTION
Task: {458EEF1C-C145-4B4E-904A-DA20802DEFEA} - System32\Tasks\LaunchApp => C:\Program Files\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {5069196D-7999-4ACB-853A-2F27AC1D8E43} - System32\Tasks\Feven 1.5-firefoxinstaller => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exe <==== ATTENTION
Task: {5BC26B85-069F-4594-B370-572272F9F289} - System32\Tasks\Feven 1.5-updater => C:\Program Files\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: {8494FBCE-60B7-4BE4-BD2D-BDE7F6D35231} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {968667C6-5948-424B-9D59-07910CE7699C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-07] (Adobe Systems Incorporated)
Task: {97994F1F-569B-49C3-ADA9-F969ECAFA483} - System32\Tasks\Feven 1.5-enabler => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Feven 1.5-chromeinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe)/installcrx /crxinstalltype=0 /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.crx' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-codedownloader.job => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe¾/reinstallapp /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /codedownloaddomain=http:/app-static.crossrider.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-enabler.job => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe“/enablebho /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-firefoxinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exeL/installxpi /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.xpi' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com /extensionversion=0.93 /prefsbranch=a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532 /updateurl=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/38532.rdf <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-updater.job => C:\Program Files\Feven 1.5\Feven 1.5-updater.exeö/runupdater /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /geoserviceurl=http:/ipgeoapi.com/ /updatejsondomain=http:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http:/stats.syncstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\ViewPassword Update.job => C:\Program Files\ViewPassword\ViewPassword.exe
==================== Loaded Modules (whitelisted) ==============
2006-09-14 08:20 - 2006-09-14 08:20 - 00126464 _____ () C:\Program Files\WinRAR 3.61 Multi\rarext.dll
2014-02-22 03:04 - 2014-02-22 03:04 - 00317720 ____N () C:\Program Files\PricePeep\PricePeepUpdater.exe
2009-10-08 01:49 - 2009-10-08 01:49 - 01888256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-10-17 04:48 - 2009-10-17 04:48 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-06-29 18:37 - 2014-06-29 18:37 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-04-07 10:40 - 2015-04-07 10:40 - 16852144 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
==================== Accounts: =============================
Administrator (S-1-5-21-2288368842-2800874389-3385798500-500 - Administrator - Disabled)
Gast (S-1-5-21-2288368842-2800874389-3385798500-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2288368842-2800874389-3385798500-1002 - Limited - Enabled)
Natalie (S-1-5-21-2288368842-2800874389-3385798500-1000 - Administrator - Enabled) => C:\Users\Natalie
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/22/2014 10:22:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 83c
Startzeit: 01cfa596cf78ff4c
Endzeit: 188
Anwendungspfad: C:\Program Files\Skype\Phone\Skype.exe
Berichts-ID:
Error: (07/22/2014 10:22:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/09/2014 02:10:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7a4a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0x0000046b
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xa10
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3
Error: (07/09/2014 09:56:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.15.11.3, Zeitstempel: 0x53abe664
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02a92738
ID des fehlerhaften Prozesses: 0x12a0
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/29/2014 08:18:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c707
ID des fehlerhaften Prozesses: 0x12c8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Error: (06/05/2014 03:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1490
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/03/2014 10:18:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/30/2014 10:37:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002689c0
ID des fehlerhaften Prozesses: 0x17e8
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/24/2014 07:24:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/23/2014 00:43:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x250
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
System errors:
=============
Error: (04/07/2015 11:37:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 11:37:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (04/07/2015 10:36:20 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 10:35:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/22/2014 00:22:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.
Error: (07/18/2014 00:34:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/16/2014 00:39:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/11/2014 03:43:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Microsoft Office Sessions:
=========================
Error: (01/08/2014 01:56:08 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 13987 seconds with 4140 seconds of active time. This session ended with a crash.
Error: (12/01/2013 07:32:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 5226 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz
Percentage of memory in use: 76%
Total physical RAM: 2047.37 MB
Available physical RAM: 484.37 MB
Total Pagefile: 4094.73 MB
Available Pagefile: 1937.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.18 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:68.36 GB) (Free:12.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:848.41 GB) (Free:778.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E174C2EB)
Partition 1: (Not Active) - (Size=14.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=68.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=848.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Natalie at 2015-04-07 13:25:20
Running from C:\Users\Natalie\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ATI AVIVO Codecs (Version: 10.10.0.40918 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{6923794C-23D0-AB85-ED14-E789C4F0C92A}) (Version: 3.0.745.0 - ATI Technologies, Inc.)
BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.908.2201 - Micro-Star International Co., Ltd.)
ccc-core-static (Version: 2009.0918.2132.36825 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
CIR Tool Kit (HKLM\...\{245BDABA-CD34-4A57-8BE7-F2784A4E0BA4}) (Version: 2.1.2009.0619 - Nuvoton)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Feven 1.5 (HKLM\...\Feven 1.5) (Version: 1.31.153.4 - Feven) <==== ATTENTION
FileParade bundle uninstaller (HKLM\...\FileParade bundle uninstaller) (Version: 2.0.0.5 - FileParade) <==== ATTENTION
Free YouTube Download version 3.2.16.1030 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.16.1030 - DVDVideoSoft Ltd.)
Freemake Audio Converter Version 1.1.0 (HKLM\...\Freemake Audio Converter_is1) (Version: 1.1.0 - Ellora Assets Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help Actualización (KB963678) (HKLM\...\{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{59E09C3D-4878-47D9-87DB-6D0018026889}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (HKLM\...\{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F318245D-05AE-4681-A749-A036CE44AF29}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Office Word 2007 Help Actualización (KB963665) (HKLM\...\{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{377BA42A-1C84-45D6-94B8-6D00887D172D}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: - )
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
msi Easy Mode (HKLM\...\InstallShield_{1E76851A-F0CD-40EE-B0FA-0A279E57A41C}) (Version: 0.10.2.3 - msi)
msi Easy Mode (Version: 0.10.2.3 - msi) Hidden
msi EasyViewer (HKLM\...\InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}) (Version: 1.2 - msi)
msi EasyViewer (Version: 1.2 - msi) Hidden
MSI Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.908.2001 - MSI)
PC-Kids Deutsch 3 (HKLM\...\PC-Kids Deutsch 3_is1) (Version: - PC-Kids)
PC-Kids Mathematik 1 (HKLM\...\PC-Kids Mathematik 1_is1) (Version: - PC-Kids)
Performancer (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version: - 24soft) <==== ATTENTION
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5897 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0124 - REALTEK Semiconductor Corp.)
Search Protect (HKLM\...\SearchProtect) (Version: 2.15.14.58 - Client Connect LTD) <==== ATTENTION
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Snap.Do (HKLM\...\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}) (Version: 11.20.1.15636 - ReSoft Ltd.) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SupTab (HKLM\...\SupTab) (Version: 1.1.1.0 - ) <==== ATTENTION
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
ViewPassword (HKLM\...\e9737a78-b8c6-4465-9feb-7e2a4f782ad9) (Version: - ViewPassword Software) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-06-2014 20:34:48 Windows Update
09-07-2014 14:40:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {18F33C20-ACE9-4B50-8104-A6B88919B31B} - System32\Tasks\Feven 1.5-chromeinstaller => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: {3EFCCEEB-36D7-492C-A890-60FC3F998592} - System32\Tasks\Feven 1.5-codedownloader => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: {41579739-7886-408D-A7CA-E59749C1B766} - System32\Tasks\ViewPassword Update => C:\Program Files\ViewPassword\ViewPassword.exe <==== ATTENTION
Task: {458EEF1C-C145-4B4E-904A-DA20802DEFEA} - System32\Tasks\LaunchApp => C:\Program Files\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {5069196D-7999-4ACB-853A-2F27AC1D8E43} - System32\Tasks\Feven 1.5-firefoxinstaller => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exe <==== ATTENTION
Task: {5BC26B85-069F-4594-B370-572272F9F289} - System32\Tasks\Feven 1.5-updater => C:\Program Files\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: {8494FBCE-60B7-4BE4-BD2D-BDE7F6D35231} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {968667C6-5948-424B-9D59-07910CE7699C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-07] (Adobe Systems Incorporated)
Task: {97994F1F-569B-49C3-ADA9-F969ECAFA483} - System32\Tasks\Feven 1.5-enabler => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Feven 1.5-chromeinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe)/installcrx /crxinstalltype=0 /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.crx' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-codedownloader.job => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe¾/reinstallapp /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /codedownloaddomain=http:/app-static.crossrider.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-enabler.job => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe“/enablebho /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-firefoxinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exeL/installxpi /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.xpi' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com /extensionversion=0.93 /prefsbranch=a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532 /updateurl=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/38532.rdf <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-updater.job => C:\Program Files\Feven 1.5\Feven 1.5-updater.exeö/runupdater /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /geoserviceurl=http:/ipgeoapi.com/ /updatejsondomain=http:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http:/stats.syncstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\ViewPassword Update.job => C:\Program Files\ViewPassword\ViewPassword.exe
==================== Loaded Modules (whitelisted) ==============
2006-09-14 08:20 - 2006-09-14 08:20 - 00126464 _____ () C:\Program Files\WinRAR 3.61 Multi\rarext.dll
2014-02-22 03:04 - 2014-02-22 03:04 - 00317720 ____N () C:\Program Files\PricePeep\PricePeepUpdater.exe
2009-10-08 01:49 - 2009-10-08 01:49 - 01888256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-10-17 04:48 - 2009-10-17 04:48 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-06-29 18:37 - 2014-06-29 18:37 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-04-07 10:40 - 2015-04-07 10:40 - 16852144 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
==================== Accounts: =============================
Administrator (S-1-5-21-2288368842-2800874389-3385798500-500 - Administrator - Disabled)
Gast (S-1-5-21-2288368842-2800874389-3385798500-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2288368842-2800874389-3385798500-1002 - Limited - Enabled)
Natalie (S-1-5-21-2288368842-2800874389-3385798500-1000 - Administrator - Enabled) => C:\Users\Natalie
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/22/2014 10:22:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 83c
Startzeit: 01cfa596cf78ff4c
Endzeit: 188
Anwendungspfad: C:\Program Files\Skype\Phone\Skype.exe
Berichts-ID:
Error: (07/22/2014 10:22:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/09/2014 02:10:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7a4a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0x0000046b
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xa10
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3
Error: (07/09/2014 09:56:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.15.11.3, Zeitstempel: 0x53abe664
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02a92738
ID des fehlerhaften Prozesses: 0x12a0
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/29/2014 08:18:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c707
ID des fehlerhaften Prozesses: 0x12c8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Error: (06/05/2014 03:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1490
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/03/2014 10:18:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/30/2014 10:37:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002689c0
ID des fehlerhaften Prozesses: 0x17e8
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/24/2014 07:24:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/23/2014 00:43:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x250
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
System errors:
=============
Error: (04/07/2015 11:37:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 11:37:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (04/07/2015 10:36:20 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 10:35:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/22/2014 00:22:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.
Error: (07/18/2014 00:34:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/16/2014 00:39:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/11/2014 03:43:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Microsoft Office Sessions:
=========================
Error: (01/08/2014 01:56:08 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 13987 seconds with 4140 seconds of active time. This session ended with a crash.
Error: (12/01/2013 07:32:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 5226 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz
Percentage of memory in use: 76%
Total physical RAM: 2047.37 MB
Available physical RAM: 484.37 MB
Total Pagefile: 4094.73 MB
Available Pagefile: 1937.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.18 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:68.36 GB) (Free:12.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:848.41 GB) (Free:778.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E174C2EB)
Partition 1: (Not Active) - (Size=14.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=68.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=848.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Natalie at 2015-04-07 13:25:20
Running from C:\Users\Natalie\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
ATI AVIVO Codecs (Version: 10.10.0.40918 - ATI Technologies Inc.) Hidden
ATI Catalyst Install Manager (HKLM\...\{6923794C-23D0-AB85-ED14-E789C4F0C92A}) (Version: 3.0.745.0 - ATI Technologies, Inc.)
BurnRecovery (HKLM\...\{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}) (Version: 3.0.908.2201 - Micro-Star International Co., Ltd.)
ccc-core-static (Version: 2009.0918.2132.36825 - ATI) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.07 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.2.4291 - CDBurnerXP)
CIR Tool Kit (HKLM\...\{245BDABA-CD34-4A57-8BE7-F2784A4E0BA4}) (Version: 2.1.2009.0619 - Nuvoton)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Feven 1.5 (HKLM\...\Feven 1.5) (Version: 1.31.153.4 - Feven) <==== ATTENTION
FileParade bundle uninstaller (HKLM\...\FileParade bundle uninstaller) (Version: 2.0.0.5 - FileParade) <==== ATTENTION
Free YouTube Download version 3.2.16.1030 (HKLM\...\Free YouTube Download_is1) (Version: 3.2.16.1030 - DVDVideoSoft Ltd.)
Freemake Audio Converter Version 1.1.0 (HKLM\...\Freemake Audio Converter_is1) (Version: 1.1.0 - Ellora Assets Corporation)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help - Aggiornamento (KB963678) (HKLM\...\{90120000-0016-0410-0000-0000000FF1CE}_HOMESTUDENTR_{9F57BDED-B51B-4D2F-B360-5B4EFAAF0F1A}) (Version: - Microsoft)
Microsoft Office Excel 2007 Help Actualización (KB963678) (HKLM\...\{90120000-0016-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{59E09C3D-4878-47D9-87DB-6D0018026889}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Powerpoint 2007 Help - Aggiornamento (KB963669) (HKLM\...\{90120000-0018-0410-0000-0000000FF1CE}_HOMESTUDENTR_{C76C02F1-B07F-4974-876A-A18DEC9887C8}) (Version: - Microsoft)
Microsoft Office Powerpoint 2007 Help Actualización (KB963669) (HKLM\...\{90120000-0018-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{F318245D-05AE-4681-A749-A036CE44AF29}) (Version: - Microsoft)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word 2007 Help - Aggiornamento (KB963665) (HKLM\...\{90120000-001B-0410-0000-0000000FF1CE}_HOMESTUDENTR_{E5B82DB3-DD7D-4C45-BC5E-09864B26F9BC}) (Version: - Microsoft)
Microsoft Office Word 2007 Help Actualización (KB963665) (HKLM\...\{90120000-001B-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{377BA42A-1C84-45D6-94B8-6D00887D172D}) (Version: - Microsoft)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: - )
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mise à jour Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-040C-0000-0000000FF1CE}_HOMESTUDENTR_{B761869A-B85C-40E2-994C-A1CE78AC8F2C}) (Version: - Microsoft)
Mise à jour Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-040C-0000-0000000FF1CE}_HOMESTUDENTR_{C3DCA38E-005E-41BA-A52A-7C3429F351C3}) (Version: - Microsoft)
Mise à jour Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-040C-0000-0000000FF1CE}_HOMESTUDENTR_{81536A04-DBFB-4DB3-978F-0F284590C223}) (Version: - Microsoft)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
msi Easy Mode (HKLM\...\InstallShield_{1E76851A-F0CD-40EE-B0FA-0A279E57A41C}) (Version: 0.10.2.3 - msi)
msi Easy Mode (Version: 0.10.2.3 - msi) Hidden
msi EasyViewer (HKLM\...\InstallShield_{EECD7B96-1416-4D3A-B12D-0D2512120C36}) (Version: 1.2 - msi)
msi EasyViewer (Version: 1.2 - msi) Hidden
MSI Software Install (HKLM\...\{07690F1C-04B1-4060-9691-6748ED1826B9}) (Version: 3.0.908.2001 - MSI)
PC-Kids Deutsch 3 (HKLM\...\PC-Kids Deutsch 3_is1) (Version: - PC-Kids)
PC-Kids Mathematik 1 (HKLM\...\PC-Kids Mathematik 1_is1) (Version: - PC-Kids)
Performancer (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{dfc86759}) (Version: - 24soft) <==== ATTENTION
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5897 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5936 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30102 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0124 - REALTEK Semiconductor Corp.)
Search Protect (HKLM\...\SearchProtect) (Version: 2.15.14.58 - Client Connect LTD) <==== ATTENTION
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Snap.Do (HKLM\...\{F4F6F37C-8D19-4DAD-BF7B-0953133FD43F}) (Version: 11.20.1.15636 - ReSoft Ltd.) <==== ATTENTION
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
SupTab (HKLM\...\SupTab) (Version: 1.1.1.0 - ) <==== ATTENTION
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
ViewPassword (HKLM\...\e9737a78-b8c6-4465-9feb-7e2a4f782ad9) (Version: - ViewPassword Software) <==== ATTENTION
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR archiver (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
12-06-2014 20:34:48 Windows Update
09-07-2014 14:40:53 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {18F33C20-ACE9-4B50-8104-A6B88919B31B} - System32\Tasks\Feven 1.5-chromeinstaller => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe <==== ATTENTION
Task: {3EFCCEEB-36D7-492C-A890-60FC3F998592} - System32\Tasks\Feven 1.5-codedownloader => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe <==== ATTENTION
Task: {41579739-7886-408D-A7CA-E59749C1B766} - System32\Tasks\ViewPassword Update => C:\Program Files\ViewPassword\ViewPassword.exe <==== ATTENTION
Task: {458EEF1C-C145-4B4E-904A-DA20802DEFEA} - System32\Tasks\LaunchApp => C:\Program Files\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {5069196D-7999-4ACB-853A-2F27AC1D8E43} - System32\Tasks\Feven 1.5-firefoxinstaller => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exe <==== ATTENTION
Task: {5BC26B85-069F-4594-B370-572272F9F289} - System32\Tasks\Feven 1.5-updater => C:\Program Files\Feven 1.5\Feven 1.5-updater.exe <==== ATTENTION
Task: {8494FBCE-60B7-4BE4-BD2D-BDE7F6D35231} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {968667C6-5948-424B-9D59-07910CE7699C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-07] (Adobe Systems Incorporated)
Task: {97994F1F-569B-49C3-ADA9-F969ECAFA483} - System32\Tasks\Feven 1.5-enabler => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe <==== ATTENTION
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Feven 1.5-chromeinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-chromeinstaller.exe)/installcrx /crxinstalltype=0 /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.crx' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-codedownloader.job => C:\Program Files\Feven 1.5\Feven 1.5-codedownloader.exe¾/reinstallapp /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /codedownloaddomain=http:/app-static.crossrider.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-enabler.job => C:\Program Files\Feven 1.5\Feven 1.5-enabler.exe“/enablebho /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-firefoxinstaller.job => C:\Program Files\Feven 1.5\Feven 1.5-firefoxinstaller.exeL/installxpi /agentregpath='Feven 1.5' /extensionfilepath C:\Program Files\Feven 1.5\38532.xpi' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installerfullversion=1.31.153.4 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /waitforbrowser=300 /extensionid=249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com /extensionversion=0.93 /prefsbranch=a249911bcd1bd4d668c17df533609e6d8c76f3de9939e4922b73c5d7a3139375dcom38532 /updateurl=https:/w9u6a2p6.ssl.hwcdn.net/plugin/ff/update/38532.rdf <==== ATTENTION
Task: C:\windows\Tasks\Feven 1.5-updater.job => C:\Program Files\Feven 1.5\Feven 1.5-updater.exeö/runupdater /agentregpath='Feven 1.5' /appid=38532 /srcid='000272' /subid='0' /zdata='0' /bic=7E7DAB8C2B4C4FFEBF091D1DEE3C5D36IE /verifier=871a704538cc29da7c71ae579fdd745f /installerversion=1_31_153 /installationtime=1387367617 /statsdomain=http:/stats.srvstatsdata.com /errorsdomain=http:/errors.srvstatsdata.com /geoserviceurl=http:/ipgeoapi.com/ /updatejsondomain=http:/update.srvstatsdata.com /updaterversion=2 /monetizationdomain=http:/stats.syncstatsdata.com <==== ATTENTION
Task: C:\windows\Tasks\ViewPassword Update.job => C:\Program Files\ViewPassword\ViewPassword.exe
==================== Loaded Modules (whitelisted) ==============
2006-09-14 08:20 - 2006-09-14 08:20 - 00126464 _____ () C:\Program Files\WinRAR 3.61 Multi\rarext.dll
2014-02-22 03:04 - 2014-02-22 03:04 - 00317720 ____N () C:\Program Files\PricePeep\PricePeepUpdater.exe
2009-10-08 01:49 - 2009-10-08 01:49 - 01888256 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll
2009-10-17 04:48 - 2009-10-17 04:48 - 00270336 _____ () C:\windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-06-29 18:37 - 2014-06-29 18:37 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2015-04-07 10:40 - 2015-04-07 10:40 - 16852144 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
==================== Accounts: =============================
Administrator (S-1-5-21-2288368842-2800874389-3385798500-500 - Administrator - Disabled)
Gast (S-1-5-21-2288368842-2800874389-3385798500-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2288368842-2800874389-3385798500-1002 - Limited - Enabled)
Natalie (S-1-5-21-2288368842-2800874389-3385798500-1000 - Administrator - Enabled) => C:\Users\Natalie
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/22/2014 10:22:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 83c
Startzeit: 01cfa596cf78ff4c
Endzeit: 188
Anwendungspfad: C:\Program Files\Skype\Phone\Skype.exe
Berichts-ID:
Error: (07/22/2014 10:22:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0xd10
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/09/2014 02:10:25 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnetwk.exe, Version: 12.0.7601.17514, Zeitstempel: 0x4ce7a4a7
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x531599f6
Ausnahmecode: 0x0000046b
Fehleroffset: 0x0000812f
ID des fehlerhaften Prozesses: 0xa10
Startzeit der fehlerhaften Anwendung: 0xwmpnetwk.exe0
Pfad der fehlerhaften Anwendung: wmpnetwk.exe1
Pfad des fehlerhaften Moduls: wmpnetwk.exe2
Berichtskennung: wmpnetwk.exe3
Error: (07/09/2014 09:56:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.15.11.3, Zeitstempel: 0x53abe664
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02a92738
ID des fehlerhaften Prozesses: 0x12a0
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/29/2014 08:18:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Name des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe, Version: 13.0.0.214, Zeitstempel: 0x5359c61d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002c707
ID des fehlerhaften Prozesses: 0x12c8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_13_0_0_214.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_13_0_0_214.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_13_0_0_214.exe2
Berichtskennung: FlashPlayerPlugin_13_0_0_214.exe3
Error: (06/05/2014 03:13:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1490
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (06/03/2014 10:18:37 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.3.38, Zeitstempel: 0x537ef668
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0xdec
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/30/2014 10:37:56 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x002689c0
ID des fehlerhaften Prozesses: 0x17e8
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/24/2014 07:24:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x1674
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
Error: (05/23/2014 00:43:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: cltmngui.exe, Version: 2.13.2.14, Zeitstempel: 0x5373c8ef
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00039342
ID des fehlerhaften Prozesses: 0x250
Startzeit der fehlerhaften Anwendung: 0xcltmngui.exe0
Pfad der fehlerhaften Anwendung: cltmngui.exe1
Pfad des fehlerhaften Moduls: cltmngui.exe2
Berichtskennung: cltmngui.exe3
System errors:
=============
Error: (04/07/2015 11:37:09 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 11:37:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (04/07/2015 10:36:20 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error: (04/07/2015 10:35:41 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/22/2014 00:22:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.
Error: (07/18/2014 01:59:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AntiVirSchedulerService erreicht.
Error: (07/18/2014 00:34:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/16/2014 00:39:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Error: (07/11/2014 03:43:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Performancer erreicht.
Microsoft Office Sessions:
=========================
Error: (01/08/2014 01:56:08 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 13987 seconds with 4140 seconds of active time. This session ended with a crash.
Error: (12/01/2013 07:32:21 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 5226 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Atom(TM) CPU 230 @ 1.60GHz
Percentage of memory in use: 76%
Total physical RAM: 2047.37 MB
Available physical RAM: 484.37 MB
Total Pagefile: 4094.73 MB
Available Pagefile: 1937.76 MB
Total Virtual: 2047.88 MB
Available Virtual: 1911.18 MB
==================== Drives ================================
Drive c: (OS_Install) (Fixed) (Total:68.36 GB) (Free:12.62 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Data) (Fixed) (Total:848.41 GB) (Free:778.09 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E174C2EB)
Partition 1: (Not Active) - (Size=14.6 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=27)
Partition 3: (Not Active) - (Size=68.4 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=848.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
 |
|
07.04.2015, 17:48
| #25 |
| /// the machine /// TB-Ausbilder | Spyhunter4 da fehlt aber noch die FRST.txt, dafür hab ich jetzt 4 mal Addition.txt
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.04.2015, 08:57
| #26 |
| | Spyhunter4 Leider habe ich gar keine Macht über diesem Rechner. Wenn ich eine Internetseite aufmache, es machen sich 60 weiteren Seiten von alleine auf. Gestern habe ich halbe Stunden versucht die Textdateien zu posten, Ergebniss lässt sich sehen ;-) Säter konnte ich es auch nich editieren. FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Natalie (administrator) on NATALIE-MSI on 07-04-2015 13:21:46
Running from C:\Users\Natalie\Downloads
Loaded Profiles: Natalie (Available profiles: Natalie)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files\PricePeep\PricePeepUpdater.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Freemake) C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe
(Microsoft Corp.) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Client Connect LTD) C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe
(Client Connect LTD) C:\Program Files\SearchProtect\SearchProtect\bin\cltmng.exe
(Client Connect LTD) C:\Program Files\SearchProtect\UI\bin\cltmngui.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_16_0_0_305.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-11] (Realtek Semiconductor)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-11-11] (Microsoft Corporation)
AppInit_DLLs: C:\PROGRA~1\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [184616 2014-07-16] (Client Connect LTD)
Startup: C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk
ShortcutTarget: PricePeepUpdater.lnk -> C:\Program Files\PricePeep\PricePeepUpdater.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49636;https=127.0.0.1:49636
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284&q={searchTerms}
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=f9399df4-cf16-10dc-4e9d-0e84ecdd7e7c&searchtype=ds&q={searchTerms}&installDate=20/02/2014
SearchScopes: HKLM -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=f9399df4-cf16-10dc-4e9d-0e84ecdd7e7c&searchtype=ds&q={searchTerms}&installDate=20/02/2014
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPA2AF4D4D-C670-448C-825B-13D2A56EE1A8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)
BHO: Snap.DoEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\SupTab\SupTab.dll [2014-04-11] (Thinknice Co. Limited)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
BHO: ViewPassword -> {e76da439-a1f1-4cfd-88c1-1fb8bac7e620} -> C:\Program Files\ViewPassword\150.dll [2013-12-27] ()
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.nationzoom.com/?type=sc&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
FireFox:
========
FF ProfilePath: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default
FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6
FF DefaultSearchEngine: Trovi search
FF SelectedSearchEngine: Trovi search
FF Homepage: hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
FF Keyword.URL: hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\searchplugins\trovi-search.xml [2015-04-07]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\nationzoom.xml [2013-12-18]
FF Extension: Feven 1.5 - C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com [2013-12-18]
FF Extension: Quick Start - C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\quick_start@gmail.com [2014-05-30]
FF Extension: Free Games 111 - C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\freegames4357@BestOffers.xpi [2014-01-03]
FF Extension: Speed Test 127 - C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\speedtest4354@BestOffers.xpi [2014-01-03]
FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\extensions\quick_start@gmail.com
FF HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Firefox\Extensions: [{0b67060e-62bf-4fc6-a316-c327841d0451}] - C:\Program Files\ViewPassword\150.xpi
FF Extension: ViewPassword - C:\Program Files\ViewPassword\150.xpi [2013-12-27]
Chrome:
=======
CHR Profile: C:\Users\Natalie\AppData\Local\Google\Chrome\User Data\default
CHR HKLM\...\Chrome\Extension: [jljheddigenhleadfofeccneimcmlefp] - C:\Users\Natalie\AppData\Roaming\speedtest4354\speedtest4354.crx [2013-10-15]
CHR HKLM\...\Chrome\Extension: [jmojojliiicbbihpjmiepllaiflnjobc] - C:\Program Files\ViewPassword\150.crx [2013-12-27]
CHR HKLM\...\Chrome\Extension: [lbgfiglojokgabdbhegbpjgojgppppgf] - C:\Users\Natalie\AppData\Roaming\freegames4357\freegames4357.crx [2013-10-22]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 CltMngSvc; C:\Program Files\SearchProtect\Main\bin\CltMngSvc.exe [2682152 2014-07-16] (Client Connect LTD)
R2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-02-11] (Freemake) [File not signed]
R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [510608 2014-03-05] (Cherished Technololgy LIMITED)
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe" [X]
S2 dfc86759; "C:\windows\system32\rundll32.exe" "c:\progra~2\perfor~1\PerformancerSvc.dll",service
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 nuviocir; C:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [29696 2009-06-19] (Nuvoton Technology Corp.)
R3 RTHDMIAzAudService; C:\windows\System32\drivers\RtHDMIV.sys [155648 2009-07-17] (Realtek Semiconductor Corp.)
R3 SPPD; \??\C:\windows\system32\drivers\SPPD.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-07 13:21 - 2015-04-07 13:23 - 00015161 _____ () C:\Users\Natalie\Downloads\FRST.txt
2015-04-07 13:20 - 2015-04-07 13:21 - 00000000 ____D () C:\FRST
2015-04-07 13:19 - 2015-04-07 13:19 - 01135104 _____ (Farbar) C:\Users\Natalie\Downloads\FRST.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-07 13:22 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-07 13:22 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-07 13:10 - 2013-10-31 10:04 - 01739797 _____ () C:\windows\WindowsUpdate.log
2015-04-07 12:55 - 2013-12-18 13:55 - 00001308 _____ () C:\windows\Tasks\Feven 1.5-updater.job
2015-04-07 12:55 - 2013-12-18 13:55 - 00001210 _____ () C:\windows\Tasks\Feven 1.5-codedownloader.job
2015-04-07 12:55 - 2013-12-18 13:55 - 00001110 _____ () C:\windows\Tasks\Feven 1.5-enabler.job
2015-04-07 12:54 - 2013-12-18 13:54 - 00002010 _____ () C:\windows\Tasks\Feven 1.5-firefoxinstaller.job
2015-04-07 12:54 - 2013-12-18 13:53 - 00001938 _____ () C:\windows\Tasks\Feven 1.5-chromeinstaller.job
2015-04-07 12:40 - 2013-11-06 15:18 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-07 12:38 - 2013-11-12 11:25 - 00000378 _____ () C:\windows\Tasks\ViewPassword Update.job
2015-04-07 11:50 - 2014-05-10 19:37 - 00000000 ____D () C:\Program Files\SearchProtect
2015-04-07 11:36 - 2014-07-03 18:31 - 00000560 _____ () C:\windows\setupact.log
2015-04-07 11:36 - 2014-01-21 09:26 - 02567680 ___SH () C:\Users\Natalie\Desktop\Thumbs.db
2015-04-07 11:36 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-07 11:35 - 2014-07-03 18:31 - 00001796 _____ () C:\windows\PFRO.log
2015-04-07 10:55 - 2009-10-17 04:37 - 01618320 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-07 10:40 - 2013-11-06 15:18 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-04-07 10:40 - 2013-11-06 15:18 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-03-04 14:21 - 2014-03-04 14:25 - 0000114 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2013-12-09 09:36 - 2014-05-25 18:48 - 0006144 _____ () C:\Users\Natalie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some content of TEMP:
====================
C:\Users\Natalie\AppData\Local\Temp\avgnt.exe
C:\Users\Natalie\AppData\Local\Temp\Setup.exe
C:\Users\Natalie\AppData\Local\Temp\SPSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-05-09 12:26
==================== End Of Log ============================
|
|
08.04.2015, 16:02
| #27 | |
| /// the machine /// TB-Ausbilder | Spyhunter4Zitat:
Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.04.2015, 18:52
| #28 |
| | Spyhunter4 Mann, war das ein Stück Arbeit!!! Kannst Du mir bitte sagen, wie ich es schaffe, dass sich nicht 100 Internetseite aufmachen, während ich im Internet bin. Danke Code:
ATTFilter ComboFix 15-04-09.01 - Natalie 08.04.2015 19:22:12.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2047.998 [GMT 2:00]
ausgeführt von:: c:\users\Natalie\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\PricePeep
c:\program files\PricePeep\PricePeepUpdater.exe
c:\programdata\2308189059
c:\users\Natalie\AppData\Local\lollipop
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome.manifest
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\asyncDB.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\browserAction.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\contextMenu.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\dbManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\dom_bg.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\fileManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefox.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefoxNotifications.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefoxOmnibox.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\message.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\pageAction.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\request.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\tabs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\webRequest.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\background.html
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\baseObject.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\browser.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\console.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\consts.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\delegate.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\extensionDataStore.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\folderIOWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\httpObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\IDBWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\installer.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\logFile.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\prefs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\progressListenerObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\registry.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\reloadObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\reports.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\requestObject.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\searchSettings.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\uninstallObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\updateManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\utils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\xhr.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\dialog.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\main.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\options.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\options.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\search_dialog.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\defaults\preferences\prefs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\manifest.xml
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins.json
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\1_base.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\102_dealply_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\103_intext_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\104_jollywallet_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\105_corticas_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\108_icm_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\119_similar_web_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\120_luck_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\123_intext_adv_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\125_arcadi2_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\127_revizer_p_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\135_arcadi3_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\138_getdeal_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\142_intext_fa_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\17_jQuery.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\171_arcadi2_sourceID_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\175_coolmirage_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\177_crossriderDashboard.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\178_revizer_ws_dynamic_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\180_bpo_serp_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\182_openUrl.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\183_tabsWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\184_noproblemppc_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\189_active_sanity.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\190_pops_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\191_ciuvo_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\194_retargeting_bi_m.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\197_kreapixel_pops_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\198_superfish_no_search_no_coupons_plushd_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\199_superfish_no_coupons_plushd_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\200_foxydeal_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\204_pricedetect_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\207_dbWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\21_debug.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\22_resources.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\28_initializer.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\47_resources_background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\64_appApiMessage.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\7_hooks.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\72_appApiValidation.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\9_search_engine_hook.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\98_omniCommands.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\userCode\background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\userCode\extension.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\install.rdf
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\locale\en-US\translations.dtd
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button1.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button2.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button3.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button4.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button5.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\crossrider_statusbar.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon128.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon16.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon24.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon48.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\panelarrow-up.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\popup.html
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\skin.css
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\update.css
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\searchplugins\trovi-search.xml
c:\users\Natalie\AppData\Roaming\systweak\ssd\SSDPTstub.exe
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_CltMngSvc
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-08 bis 2015-04-08 ))))))))))))))))))))))))))))))
.
.
2015-04-08 16:16 . 2015-04-08 16:16 -------- d-----w- c:\program files\VS Revo Group
2015-04-07 12:23 . 2015-04-07 12:25 -------- d-----w- c:\windows\rescache
2015-04-07 11:20 . 2015-04-07 11:28 -------- d-----w- C:\FRST
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-07 08:40 . 2013-11-06 13:18 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-04-07 08:40 . 2013-11-06 13:18 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-11-14 20584608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-19 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-11 7739936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-11-11 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-11-14 15:42 20584608 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R2 dfc86759;Performancer;c:\windows\system32\rundll32.exe [2009-07-14 44544]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-06-18 108032]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-08-10 171520]
R3 SPPD;SPPD;c:\windows\system32\drivers\SPPD.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 172032]
S2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2014-02-11 108032]
S2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe [2014-04-11 705136]
S2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe [2014-03-05 510608]
S3 nuviocir;Nuvoton W836x7HG CIR Device Driver;c:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [2009-06-19 29696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-21 189440]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-06 08:40]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
mStart Page = hxxp://www.nationzoom.com/?type=hp&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
uSearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\
FF - prefs.js: browser.search.selectedEngine - Trovi search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk - c:\program files\PricePeep\PricePeepUpdater.exe
AddRemove-SearchProtect - c:\progra~1\SearchProtect\Main\bin\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\UI0Detect.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-08 19:46:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-08 17:46
.
Vor Suchlauf: 7 Verzeichnis(se), 17.333.002.240 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 16.981.237.760 Bytes frei
.
- - End Of File - - 0C8485D2282C148B27D8551F72C6B758
A36C5E4F47E84449FF07ED3517B43A31
Geändert von Taschaa (08.04.2015 um 19:04 Uhr) |
|
09.04.2015, 09:35
| #29 |
| /// the machine /// TB-Ausbilder | Spyhunter4 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.04.2015, 13:22
| #30 |
| | Spyhunter4 Hallo, erstmal vielen herzlichen Dank. Ich glaube ich habe auf dem Rechner (Mal) Ware für EXPORT. Erste Ergebnisse (umgekehrte reihenfolge) Code:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 09/04/2015 um 13:53:53
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-08.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x86)
# Benutzername : Natalie - NATALIE-MSI
# Gestarted von : C:\Users\Natalie\Desktop\AdwCleaner_4.201.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : IePluginService
[#] Dienst Gelöscht : SPPD
[#] Dienst Gelöscht : Wpm
[#] Dienst Gelöscht : dfc86759
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\IePluginService
Ordner Gelöscht : C:\ProgramData\Performancer
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Program Files\Uninstaller
Ordner Gelöscht : C:\Program Files\Optimizer Pro
Ordner Gelöscht : C:\windows\system32\SearchProtect
Ordner Gelöscht : C:\Users\Natalie\AppData\Roaming\337Games
Ordner Gelöscht : C:\Users\Natalie\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Natalie\AppData\Roaming\DriverTurbo
Ordner Gelöscht : C:\Users\Natalie\Documents\Optimizer Pro
Datei Gelöscht : C:\Users\Natalie\Desktop\Free Games.lnk
Datei Gelöscht : C:\Users\Natalie\Desktop\Speed Test.lnk
***** [ Geplante Tasks ] *****
Task Gelöscht : LaunchApp
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Natalie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Natalie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{0b67060e-62bf-4fc6-a316-c327841d0451}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Wpm
Schlüssel Gelöscht : HKCU\Software\Mozilla\Extends
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\usyndication.com
Schlüssel Gelöscht : HKCU\Software\USyndication
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\SOFTWARE\IePlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Wpm
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\43C098337DB065A49B665D4EA7F16D1C
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A71991503412AEB42838B02C5ED9F9CD
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2E0D3DD9E5E4B74CA43BCE77815E287
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F7652513C62FF63448CFF05163719DB7
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] - hxxp=127.0.0.1:49636;hxxps=127.0.0.1:49636
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyEnable] - 1
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17207
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
-\\ Mozilla Firefox v37.0.1 (x86 de)
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SPC1D68679-55E[...]
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.selectedEngine", "Trovi search");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5[...]
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.BackPageActive", true);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.Visibility", false);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageCapacity", 3);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageCounter", 3);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageDay", 13);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageLastEvent", "1394695872140");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.backPageMinInterval", 15);
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.barcodeid", "35214");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.countryiso", "de");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.downloadprovider", "snapdoocyb");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\"],\\\"hxxpInjection\\\":\\\"hxxp:\\\\\\/\\\\\\/i.linkuryjs.info\\\\\\/kury\\\\\\[...]
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.fromautoupdate", "true");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.installationid", "f9399df4-cf16-10dc-4e9d-0e84ecdd7e7c");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.installdate", "20/02/2014");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.keepAliveLastevent", "1394607980");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1395298080666");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.helperbar.publisher", "snapdoocyb");
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"freegames4357@BestOffers\":{\"d\":\"C:\\\\Users\\\\Natalie\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\tz8y3jdt.default\\\\extensio[...]
[tz8y3jdt.default\prefs.js] - Zeile Gelöscht : user_pref("keyword.URL", "hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCL[...]
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [14552 Bytes] - [09/04/2015 13:34:11]
AdwCleaner[S0].txt - [13944 Bytes] - [09/04/2015 13:53:53]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [14004 Bytes] ##########
Code:
ATTFilter ComboFix 15-04-09.01 - Natalie 08.04.2015 19:22:12.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2047.998 [GMT 2:00]
ausgeführt von:: c:\users\Natalie\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\PricePeep
c:\program files\PricePeep\PricePeepUpdater.exe
c:\programdata\2308189059
c:\users\Natalie\AppData\Local\lollipop
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome.manifest
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\asyncDB.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\browserAction.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\contextMenu.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\dbManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\dom_bg.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\fileManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefox.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefoxNotifications.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\firefoxOmnibox.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\message.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\pageAction.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\request.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\tabs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\api\webRequest.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\background.html
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\baseObject.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\browser.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\console.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\consts.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\delegate.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\extensionDataStore.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\folderIOWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\httpObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\IDBWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\installer.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\logFile.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\prefs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\progressListenerObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\registry.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\reloadObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\reports.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\requestObject.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\searchSettings.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\uninstallObserver.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\updateManager.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\utils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\core\xhr.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\dialog.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\main.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\options.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\options.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\chrome\content\search_dialog.xul
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\defaults\preferences\prefs.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\manifest.xml
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins.json
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\1_base.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\102_dealply_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\103_intext_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\104_jollywallet_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\105_corticas_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\108_icm_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\119_similar_web_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\120_luck_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\123_intext_adv_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\125_arcadi2_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\127_revizer_p_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\135_arcadi3_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\138_getdeal_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\142_intext_fa_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\17_jQuery.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\171_arcadi2_sourceID_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\175_coolmirage_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\177_crossriderDashboard.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\178_revizer_ws_dynamic_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\180_bpo_serp_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\182_openUrl.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\183_tabsWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\184_noproblemppc_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\189_active_sanity.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\190_pops_5_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\191_ciuvo_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\194_retargeting_bi_m.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\197_kreapixel_pops_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\198_superfish_no_search_no_coupons_plushd_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\199_superfish_no_coupons_plushd_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\200_foxydeal_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\204_pricedetect_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\207_dbWrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\21_debug.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\22_resources.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\28_initializer.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\47_resources_background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\64_appApiMessage.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\7_hooks.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\72_appApiValidation.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\9_search_engine_hook.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\plugins\98_omniCommands.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\userCode\background.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\extensionData\userCode\extension.js
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\install.rdf
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\locale\en-US\translations.dtd
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button1.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button2.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button3.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button4.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\button5.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\crossrider_statusbar.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon128.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon16.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon24.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\icon48.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\panelarrow-up.png
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\popup.html
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\skin.css
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\Extensions\249911bc-d1bd-4d66-8c17-df533609e6d8@c76f3de9-939e-4922-b73c-5d7a3139375d.com\skin\update.css
c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\searchplugins\trovi-search.xml
c:\users\Natalie\AppData\Roaming\systweak\ssd\SSDPTstub.exe
c:\windows\system32\roboot.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_CltMngSvc
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-08 bis 2015-04-08 ))))))))))))))))))))))))))))))
.
.
2015-04-08 16:16 . 2015-04-08 16:16 -------- d-----w- c:\program files\VS Revo Group
2015-04-07 12:23 . 2015-04-07 12:25 -------- d-----w- c:\windows\rescache
2015-04-07 11:20 . 2015-04-07 11:28 -------- d-----w- C:\FRST
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-07 08:40 . 2013-11-06 13:18 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2015-04-07 08:40 . 2013-11-06 13:18 701616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2013-11-14 20584608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-19 98304]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-09-11 7739936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-11-11 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-11-14 15:42 20584608 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
R2 dfc86759;Performancer;c:\windows\system32\rundll32.exe [2009-07-14 44544]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6032.sys [2009-07-13 214016]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-06-18 108032]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-07-13 530944]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-08-10 171520]
R3 SPPD;SPPD;c:\windows\system32\drivers\SPPD.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-09-19 172032]
S2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [2014-02-11 108032]
S2 IePluginService;IePlugin Service;c:\programdata\IePluginService\PluginService.exe [2014-04-11 705136]
S2 Wpm;Wpm Service;c:\programdata\WPM\wprotectmanager.exe [2014-03-05 510608]
S3 nuviocir;Nuvoton W836x7HG CIR Device Driver;c:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [2009-06-19 29696]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-21 189440]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2009-08-19 859648]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-06 08:40]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
mStart Page = hxxp://www.nationzoom.com/?type=hp&ts=1387367628&from=tugs&uid=WDCXWD10EADS-00M2B0_WD-WCAV5265028450284
uSearchAssistant = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q={searchTerms}
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default\
FF - prefs.js: browser.search.selectedEngine - Trovi search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?gd=&ctid=CT3325830&octid=EB_ORIGINAL_CTID&ISID=MD092D93F-4DE7-4351-87EA-7CA5FA0245DF&SearchSource=55&CUI=&UM=5&UP=SPC1D68679-55E1-46E5-AE57-CD6121BDF6E6&SSPV=
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbPAMW02fQbYPFkTjj8jzRyB0rQvzyej3yvtbwnztdp5nXPZvpzCX4FgUB9XPNrLsdTBnZ39Mq6j90LSLGmlaeWjdpdZaqN4fUUWrSlHaCZj5m8MdLcspNC01wrdcAtEpNX2glCLYPYyrahvkJmRsHQgY6wUGLeJOJ-Szl342DqMGKy1YB7pLziZ&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
c:\users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PricePeepUpdater.lnk - c:\program files\PricePeep\PricePeepUpdater.exe
AddRemove-SearchProtect - c:\progra~1\SearchProtect\Main\bin\uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conhost.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
c:\windows\system32\UI0Detect.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-08 19:46:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-08 17:46
.
Vor Suchlauf: 7 Verzeichnis(se), 17.333.002.240 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 16.981.237.760 Bytes frei
.
- - End Of File - - 0C8485D2282C148B27D8551F72C6B758
A36C5E4F47E84449FF07ED3517B43A31
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.5.3 (04.07.2015:1)
OS: Windows 7 Home Premium x86
Ran by Natalie on 09.04.2015 at 14:05:05,98
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Natalie\AppData\Roaming\mozilla\firefox\profiles\tz8y3jdt.default\minidumps [112 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 09.04.2015 at 14:10:37,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Natalie (administrator) on NATALIE-MSI on 09-04-2015 14:19:09
Running from C:\Users\Natalie\Desktop
Loaded Profiles: Natalie (Available profiles: Natalie)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-09-19] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7739936 2009-09-11] (Realtek Semiconductor)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\windows\System32\SPReview\SPReview.exe [280576 2013-11-11] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:49636;https=127.0.0.1:49636
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-2288368842-2800874389-3385798500-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> URL hxxp://search.conduit.com/Results.aspx?ctid=CT3320133&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPA2AF4D4D-C670-448C-825B-13D2A56EE1A8&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2013-05-08] (Adobe Systems Incorporated)
BHO: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File
BHO: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll [2009-01-14] (Microsoft Corp.)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Windows Live Toolbar Helper -> {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} -> C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-2288368842-2800874389-3385798500-1000 -> &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll [2009-02-06] (Microsoft Corporation)
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-08] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll [2009-07-26] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Natalie\AppData\Roaming\Mozilla\Firefox\Profiles\tz8y3jdt.default
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-04-07] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2009-07-10] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2013-05-08] (Adobe Systems Inc.)
Chrome:
=======
CHR Profile: C:\Users\Natalie\AppData\Local\Google\Chrome\User Data\default
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [108032 2014-02-11] (Freemake) [File not signed]
S2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S4 AntiVirWebService; "C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-09] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R3 nuviocir; C:\windows\system32\DRIVERS\nuviocir_win7_x86.sys [29696 2009-06-19] (Nuvoton Technology Corp.)
R3 RTHDMIAzAudService; C:\windows\System32\drivers\RtHDMIV.sys [155648 2009-07-17] (Realtek Semiconductor Corp.)
U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Natalie\AppData\Local\Temp\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-09 14:10 - 2015-04-09 14:10 - 00000946 _____ () C:\Users\Natalie\Desktop\JRT.txt
2015-04-09 14:05 - 2015-04-09 14:05 - 00000207 _____ () C:\windows\tweaking.com-regbackup-NATALIE-MSI-Windows-7-Home-Premium-(32-bit).dat
2015-04-09 14:05 - 2015-04-09 14:05 - 00000000 ____D () C:\RegBackup
2015-04-09 14:03 - 2015-04-09 14:03 - 02686959 _____ (Thisisu) C:\Users\Natalie\Desktop\JRT.exe
2015-04-09 13:59 - 2015-04-09 14:00 - 00014085 _____ () C:\Users\Natalie\Desktop\AdwCleaner[S1]..txt
2015-04-09 13:32 - 2015-04-09 13:54 - 00000000 ____D () C:\AdwCleaner
2015-04-09 13:32 - 2015-04-09 13:32 - 02217984 _____ () C:\Users\Natalie\Desktop\AdwCleaner_4.201.exe
2015-04-09 13:15 - 2015-04-09 13:23 - 00212626 _____ () C:\Users\Natalie\Desktop\Malware.txt
2015-04-09 12:48 - 2015-04-09 13:56 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-09 12:46 - 2015-04-09 12:46 - 00001074 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-09 12:46 - 2015-04-09 12:46 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware
2015-04-09 12:46 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-04-09 12:46 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2015-04-09 12:44 - 2015-04-09 12:44 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Natalie\Downloads\mbam-setup-2.1.4.1018.exe
2015-04-09 12:42 - 2015-04-09 12:42 - 00002199 _____ () C:\Users\Natalie\Desktop\next ste.txt
2015-04-08 20:10 - 2015-04-08 20:11 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-08 19:53 - 2015-04-08 19:53 - 00033956 _____ () C:\Users\Natalie\Desktop\combifix.txt
2015-04-08 19:46 - 2015-04-08 19:46 - 00033956 _____ () C:\ComboFix.txt
2015-04-08 19:19 - 2011-06-26 08:45 - 00256000 _____ () C:\windows\PEV.exe
2015-04-08 19:19 - 2010-11-07 19:20 - 00208896 _____ () C:\windows\MBR.exe
2015-04-08 19:19 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00098816 _____ () C:\windows\sed.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00080412 _____ () C:\windows\grep.exe
2015-04-08 19:19 - 2000-08-31 02:00 - 00068096 _____ () C:\windows\zip.exe
2015-04-08 19:18 - 2015-04-08 19:46 - 00000000 ____D () C:\Qoobox
2015-04-08 19:18 - 2015-04-08 19:42 - 00000000 ____D () C:\windows\erdnt
2015-04-08 19:16 - 2015-04-08 19:17 - 05617275 ____R (Swearware) C:\Users\Natalie\Desktop\ComboFix.exe
2015-04-08 18:16 - 2015-04-08 18:16 - 00001236 _____ () C:\Users\Natalie\Desktop\Revo Uninstaller.lnk
2015-04-08 18:16 - 2015-04-08 18:16 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-04-08 18:14 - 2015-04-08 18:15 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Natalie\Desktop\revosetup95.exe
2015-04-07 14:23 - 2015-04-07 14:25 - 00000000 ____D () C:\windows\rescache
2015-04-07 13:25 - 2015-04-07 13:28 - 00027726 _____ () C:\Users\Natalie\Desktop\Addition.txt
2015-04-07 13:21 - 2015-04-09 14:19 - 00008464 _____ () C:\Users\Natalie\Desktop\FRST.txt
2015-04-07 13:20 - 2015-04-09 14:19 - 00000000 ____D () C:\FRST
2015-04-07 13:19 - 2015-04-07 13:19 - 01135104 _____ (Farbar) C:\Users\Natalie\Desktop\FRST.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-09 14:02 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-09 14:02 - 2009-07-14 06:34 - 00017376 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-09 13:55 - 2014-07-03 18:31 - 00381392 _____ () C:\windows\PFRO.log
2015-04-09 13:55 - 2014-07-03 18:31 - 00000896 _____ () C:\windows\setupact.log
2015-04-09 13:55 - 2013-11-06 10:32 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-09 13:55 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-04-09 13:54 - 2013-10-31 10:04 - 01837444 _____ () C:\windows\WindowsUpdate.log
2015-04-09 13:53 - 2013-10-31 11:27 - 00001166 _____ () C:\Users\Natalie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-09 13:40 - 2013-11-06 15:18 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-04-09 13:16 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration
2015-04-09 11:01 - 2013-11-06 12:22 - 00000000 ____D () C:\Users\Natalie\AppData\Roaming\Skype
2015-04-09 10:17 - 2009-10-17 04:37 - 01618320 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-08 19:46 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-04-08 19:39 - 2009-07-14 04:04 - 00000215 _____ () C:\windows\system.ini
2015-04-08 19:37 - 2009-07-14 04:03 - 45875200 _____ () C:\windows\system32\config\software.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 19398656 _____ () C:\windows\system32\config\system.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00524288 _____ () C:\windows\system32\config\default.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\security.bak
2015-04-08 19:37 - 2009-07-14 04:03 - 00262144 _____ () C:\windows\system32\config\sam.bak
2015-04-07 11:36 - 2014-01-21 09:26 - 02567680 ___SH () C:\Users\Natalie\Desktop\Thumbs.db
2015-04-07 10:40 - 2013-11-06 15:18 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe
2015-04-07 10:40 - 2013-11-06 15:18 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl
==================== Files in the root of some directories =======
2014-03-04 14:21 - 2014-03-04 14:25 - 0000114 _____ () C:\Users\Natalie\AppData\Roaming\wklnhst.dat
2013-12-09 09:36 - 2014-05-25 18:48 - 0006144 _____ () C:\Users\Natalie\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
Some content of TEMP:
====================
C:\Users\Natalie\AppData\Local\temp\Quarantine.exe
C:\Users\Natalie\AppData\Local\temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\windows\explorer.exe => File is digitally signed
C:\windows\system32\winlogon.exe => File is digitally signed
C:\windows\system32\wininit.exe => File is digitally signed
C:\windows\system32\svchost.exe => File is digitally signed
C:\windows\system32\services.exe => File is digitally signed
C:\windows\system32\User32.dll => File is digitally signed
C:\windows\system32\userinit.exe => File is digitally signed
C:\windows\system32\rpcss.dll => File is digitally signed
C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-07 14:16
==================== End Of Log ============================
--- --- --- |
|
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
Linear-Darstellung
