Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Win7: Verlinkungen + lästige Popups (https://www.trojaner-board.de/158075-win7-verlinkungen-laestige-popups.html)

Nameegal 28.08.2014 16:41
Win7: Verlinkungen + lästige Popups
 
Hallo,

seit einiger Zeit wird die Arbeitsgeschwindigkeit meines Computers durch ständige Popups mit seltsamen Hinweisen wie "Windows-Fehler reparieren" und so ziemlich eingeschränkt, was es mir schwer macht, im Internet zu surfen. Ich vermute, ich habe mir da etwas eingefangen und hoffe, dass mir hier jemand helfen kann. Ich habe alle Programme durchlaufen lassen, die man vor Eröffnung eines Themas ausführen soll und poste hier einmal die Logfiles:

defogger:

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:53 on 28/08/2014 (****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
FRST:

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-08-2014
Ran by **** (administrator) on ****-PC on 28-08-2014 15:55:33
Running from C:\Users\****\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\Tor\tor.exe
() C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Pay By Ads LTD) C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
() C:\Users\****\AppData\Roaming\BrowserCompanion\tbhcn.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_145.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_14_0_0_145_ActiveX.exe
(1&1 Mail & Media GmbH) C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [Lwinst Run Profiler] => C:\Program Files (x86)\Logitech\WingMan Profiler\Lwtest.exe /detect /quiet /launch "C:\Program Files (x86)\Logitech\WingMan Profiler\Lwpevntm.exe"
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\panelmgr\SSMMgr.exe [698984 2013-05-24] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-11] (Easybits)
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1957784 2014-08-05] (APN)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-08-20] (Hewlett-Packard Company)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [shopwit] => C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe [510976 2014-05-13] (Pay By Ads LTD)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\MountPoints2: {087074cd-3677-11df-a6ac-806e6f6e6963} - E:\Setup.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tbhcn.lnk
ShortcutTarget: tbhcn.lnk -> C:\Users\****\AppData\Roaming\BrowserCompanion\tbhcn.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://ixquick.com/deu/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQDSK/4
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www1.delta-search.com/?affID=119556&tt=gc_&babsrc=HP_ss&mntrId=D48CF4CE46F0911D
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6R8yYOecHF&i=26
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.max-start.com/?q={searchTerms}&affID=119556&tt=gc_&babsrc=SP_ss_mib2&mntrId=D48CF4CE46F0911D
SearchScopes: HKCU - {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKCU - {55390F36-4471-4935-89A5-F40C3DEC5F90} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKCU - {B73C62F9-0383-4AFA-87A4-1D889C7B0B4D} URL = hxxp://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=%5EU3%5EOSJ000%5EYY%5EDE&gct=&itbv=12.10.3.24&apn_uid=20BE25D5-E334-40CC-88EF-0F09B56063A6&apn_ptnrs=%5EU3&apn_dtid=%5EOSJ000%5EYY%5EDE&apn_dbr=ff_13.0.1&doi=2014-02-12&trgb=IE,FF&q={searchTerms}&psv=
SearchScopes: HKCU - {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb164/?search={searchTerms}&loc=IB_DS&a=6R8yYOecHF&i=26
SearchScopes: HKCU - {D157F501-BD1E-4ECE-B34F-A1133BB42765} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin
SearchScopes: HKCU - {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension64.dll ()
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Browser Companion Helper -> {00cbb66b-1d3b-46d3-9577-323a336acb50} -> C:\Program Files (x86)\BrowserCompanion\jsloader.dll ( )
BHO-x32: WEB.DE Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension32.dll ()
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: Incredibar.com Helper Object -> {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} -> C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Browser Companion Helper Verifier -> {963B125B-8B21-49A2-A3A8-E37092276531} -> C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll ( )
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Ask Shopping Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Incredibar Toolbar - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
Toolbar: HKLM-x32 - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {C424171E-592A-415A-9EB1-DFD6D95D3530} -  No File
Toolbar: HKCU - Ask Shopping Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport_x64.dll (APN LLC.)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-03-23] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF DefaultSearchEngine: FileConverter 1.3 Customized Web Search
FF SearchEngineOrder.1: Delta Search
FF SelectedSearchEngine: FileConverter 1.3 Customized Web Search
FF Homepage: hxxp://www.enhanced-search.com/?affID=119556&tt=gc_&babsrc=HP_ss_mib2&mntrId=D48CF4CE46F0911D
FF Keyword.URL: hxxp://trovi.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN15372992237491412&UM=&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\user.js
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\1und1-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\fileconverter-13-customized-web-search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\mailcom-search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\MyStart Search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Browser Companion Helper - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\bbrs_002@blabbers.com [2012-07-14]
FF Extension: incredibar.com - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\ffxtlbr@incredibar.com [2012-07-14]
FF Extension: FileConverter 1.3  - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee} [2014-08-01]
FF Extension: preisspion.de - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\finder@meingutscheincode.de.xpi [2011-08-03]
FF Extension: Ask Toolbar - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\toolbar@ask.com.xpi [2014-08-06]
FF Extension: WEB.DE MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\toolbar@web.de.xpi [2011-05-15]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2011-11-16]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-07-14]
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-07-14]
CHR HKLM-x32\...\Chrome\Extension: [aaaaojmikegpiepcfdkkjaplodkpfmlo] - C:\Users\****\AppData\Local\APN\GoogleCRXs\apnorjtoolbar.crx [2012-07-14]
CHR HKLM-x32\...\Chrome\Extension: [bodddioamolcibagionmmobehnbhiakf] - C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx [2012-07-03]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-07-14]
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\****\AppData\Roaming\BabSolution\CR\delta1.crx [2013-05-14]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-24] (APN LLC.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NMSAccess; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [508464 2013-05-23] (Samsung Electronics Co., Ltd.)
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-08-27] () [File not signed]
R2 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-29] () [File not signed]
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-02-23] (Samsung Electronics)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] () [File not signed]
S3 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [7168 2009-11-12] () [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-28 15:55 - 2014-08-28 15:57 - 00025497 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-28 15:55 - 2014-08-28 15:55 - 00000000 ____D () C:\FRST
2014-08-28 15:54 - 2014-08-28 15:54 - 02103296 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-23 12:30 - 2014-08-23 12:51 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-17 13:19 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-17 13:19 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-17 13:19 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-17 13:19 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-17 13:18 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-17 13:18 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-17 10:54 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-17 10:54 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-17 10:54 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-17 10:53 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-17 10:53 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-17 10:53 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-17 10:53 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-17 10:53 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-17 10:53 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-17 10:53 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-17 10:53 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-17 10:53 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-17 10:53 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-17 10:53 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-17 10:53 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-17 10:53 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-17 10:53 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-17 10:53 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-17 10:53 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-17 10:53 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-17 10:53 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-17 10:53 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-17 10:53 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-17 10:53 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-17 10:53 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-17 10:53 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-17 10:51 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-17 10:51 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-17 10:51 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-17 10:51 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 00:33 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 00:33 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 00:33 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 00:33 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 00:33 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-28 15:57 - 2014-08-28 15:55 - 00025497 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-28 15:55 - 2014-08-28 15:55 - 00000000 ____D () C:\FRST
2014-08-28 15:54 - 2014-08-28 15:54 - 02103296 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:53 - 2010-07-06 11:28 - 00000000 ____D () C:\Users\****
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-28 15:51 - 2012-07-14 18:25 - 00000000 ____D () C:\Users\****\AppData\Roaming\BrowserCompanion
2014-08-28 15:50 - 2010-03-23 14:28 - 01494144 _____ () C:\Windows\WindowsUpdate.log
2014-08-28 15:48 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-28 15:48 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-28 15:45 - 2010-07-08 21:02 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C520D87-8FBF-4B53-930F-24CA574869F3}
2014-08-28 15:41 - 2011-12-27 15:18 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-08-28 15:41 - 2011-03-21 18:42 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-28 15:41 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-28 15:41 - 2009-07-14 06:51 - 00134969 _____ () C:\Windows\setupact.log
2014-08-27 20:10 - 2013-11-05 19:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-27 19:38 - 2011-03-21 18:42 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-27 19:10 - 2011-11-15 16:52 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-08-27 19:10 - 2010-10-06 18:43 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-08-24 23:34 - 2010-07-13 16:31 - 00000000 ____D () C:\Users\****\AppData\Local\CrashDumps
2014-08-23 18:57 - 2013-05-14 17:55 - 00000099 _____ () C:\Users\Public\LMDebug.log
2014-08-23 13:04 - 2014-03-04 13:32 - 00000000 ____D () C:\Users\****\Desktop\Risszeichnungen
2014-08-23 13:04 - 2013-09-28 11:55 - 00000000 ____D () C:\Users\****\Desktop\RHODAN
2014-08-23 13:01 - 2013-11-24 20:42 - 00000000 ____D () C:\Users\****\Desktop\SCANNER
2014-08-23 12:51 - 2014-08-23 12:30 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-23 12:31 - 2013-05-28 21:04 - 00000000 ____D () C:\Users\****\Desktop\TECHNICAL CUTAWAYS
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-21 21:35 - 2012-02-11 12:39 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2014-08-21 21:35 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-21 20:28 - 2013-05-27 22:01 - 00000000 ___RD () C:\Users\****\Desktop\VATI
2014-08-20 18:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-18 01:00 - 2013-08-14 23:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-18 00:57 - 2010-07-10 15:49 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-17 22:44 - 2010-03-24 02:56 - 00699884 _____ () C:\Windows\system32\perfh007.dat
2014-08-17 22:44 - 2010-03-24 02:56 - 00149766 _____ () C:\Windows\system32\perfc007.dat
2014-08-17 22:44 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-17 21:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-17 18:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-17 13:18 - 2014-05-06 21:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-17 13:17 - 2011-11-26 11:39 - 00000000 ____D () C:\Users\****\AppData\Roaming\SoftGrid Client
2014-08-07 22:18 - 2011-12-27 15:18 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-07 22:18 - 2011-04-02 11:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-17 10:51 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-17 10:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-17 10:53 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-17 10:53 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

Files to move or delete:
====================
C:\Users\****\mseinstall.exe


Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\0iai4vdn.dll
C:\Users\****\AppData\Local\Temp\4pfrpr2a.dll
C:\Users\****\AppData\Local\Temp\APNStub.exe
C:\Users\****\AppData\Local\Temp\drm_dialogs.dll
C:\Users\****\AppData\Local\Temp\DSP.dll
C:\Users\****\AppData\Local\Temp\FileSystemView.dll
C:\Users\****\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\****\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\****\AppData\Local\Temp\FP_PL_PFS_INSTALLER-1.exe
C:\Users\****\AppData\Local\Temp\FP_PL_PFS_INSTALLER-2.exe
C:\Users\****\AppData\Local\Temp\FP_PL_PFS_INSTALLER-3.exe
C:\Users\****\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\****\AppData\Local\Temp\GLF1901.tmp.tbProd.dll
C:\Users\****\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\****\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\****\AppData\Local\Temp\jre-6u32-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-6u34-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\****\AppData\Local\Temp\prxGLF1901.tmp.tbProd.dll
C:\Users\****\AppData\Local\Temp\qc_e3f0f3ef_27e6_4ca8_8a7c_a3d761aa54bb_64.exe
C:\Users\****\AppData\Local\Temp\Resource.exe
C:\Users\****\AppData\Local\Temp\setup.exe
C:\Users\****\AppData\Local\Temp\SkypeSetup.exe
C:\Users\****\AppData\Local\Temp\sp46257.exe
C:\Users\****\AppData\Local\Temp\sp49905.exe.exe
C:\Users\****\AppData\Local\Temp\sp53904.exe
C:\Users\****\AppData\Local\Temp\sp54931.exe
C:\Users\****\AppData\Local\Temp\sp58915.exe
C:\Users\****\AppData\Local\Temp\sp64126.exe
C:\Users\****\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\****\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\****\AppData\Local\Temp\unrar.dll
C:\Users\****\AppData\Local\Temp\WEB.DE_Sicherheitsupdate_Dez2011.exe
C:\Users\****\AppData\Local\Temp\YontooSetup-S.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-17 21:11

==================== End Of Log ============================
Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-08-2014
Ran by **** at 2014-08-28 15:57:52
Running from C:\Users\****\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
Ask Shopping Toolbar (HKLM-x32\...\{4F524A00-6A76-A76A-76A7-A758B70C0F05}) (Version: 12.15.5.6 - APN, LLC) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{67CA5B4D-32DA-B54C-1851-F68ECD83262E}) (Version: 3.0.754.0 - ATI Technologies, Inc.)
B400 Series PCL Driver from OKI® Printing Solutions for Windows  (HKLM-x32\...\{E327C2A5-E236-44C4-A410-B899403A49A9}) (Version: 102 - OKI® Printing Solutions)
Benutzerhandbuch anzeigen (HKLM-x32\...\View User Guide) (Version: 3.60.30 - )
BH - RT (HKLM-x32\...\BH - RT) (Version:  - )
Bing Bar (HKLM-x32\...\{B4089055-D468-45A4-A6BA-5A138DD715FC}) (Version: 7.0.850.0 - Microsoft Corporation)
BrowserCompanion (HKLM-x32\...\BrowserCompanion) (Version:  - ) <==== ATTENTION
CameraHelperMsi (x32 Version: 13.50.854.0 - Logitech) Hidden
Canon CanoScan Toolbox 5.0 (HKLM-x32\...\CanoScan Toolbox 5.0) (Version:  - )
CanoScan 4400F (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4803) (Version:  - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center HydraVision Full (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2009.1201.2247.40849 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2009.1201.2247.40849 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Czech (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Danish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Dutch (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help English (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Finnish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help French (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help German (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Greek (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Italian (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Japanese (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Korean (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Polish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Russian (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Spanish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Swedish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Thai (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
CCC Help Turkish (x32 Version: 2009.1201.2246.40849 - ATI) Hidden
ccc-core-static (x32 Version: 2009.1201.2247.40849 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2009.1201.2247.40849 - ATI) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.2.2212 - CDBurnerXP)
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.2115 - CyberLink Corp.)
CyberLink DVD Suite Deluxe (x32 Version: 7.0.2115 - CyberLink Corp.) Hidden
Delta Chrome Toolbar (HKLM-x32\...\Delta Chrome Toolbar) (Version:  - Delta) <==== ATTENTION
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Hardwarediagnosetools (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5247.34 - PC-Doctor, Inc.)
Heavy Weapon (x32 Version: 2.2.0.95 - WildTangent) Hidden
Hell-Copter (HKLM-x32\...\HellCopter) (Version:  - )
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.3.9512.3162 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.3 - Hewlett-Packard) Hidden
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Product Detection (HKLM-x32\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)
HP Remote Solution (HKLM-x32\...\HP Remote Solution) (Version: 1.1.11.0 - Hewlett-Packard)
HP Remote Solution (x32 Version: 1.1.12.0 - Hewlett-Packard) Hidden
HP Setup (HKLM-x32\...\{17B4760F-334B-475D-829F-1A3E94A6A4E6}) (Version: 1.2.3560.3170 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}) (Version: 10.1.0002 - Hewlett-Packard)
HP Update (HKLM-x32\...\{D46D081B-F60E-467E-A7C4-117B70D76731}) (Version: 5.001.000.014 - Hewlett-Packard)
HydraVision (x32 Version: 4.2.128.0 - ATI Technologies Inc.) Hidden
Incredibar Toolbar  on IE (HKLM-x32\...\incredibar) (Version:  - ) <==== ATTENTION
Jagen 2011 (HKLM-x32\...\{45A583AC-22D5-44F1-B093-FF0429D764E9}) (Version: 1.00.0000 - Valusoft)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2017 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2017 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{CC8E94A2-55C7-4460-953C-2A790180578C}) (Version: 1.18.8.1 - LightScribe)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.30 - Logitech Inc.)
LWS Facebook (x32 Version: 13.50.854.0 - Logitech) Hidden
LWS Gallery (x32 Version: 13.50.854.0 - Logitech) Hidden
LWS Help_main (x32 Version: 13.50.862.0 - Logitech) Hidden
LWS Launcher (x32 Version: 13.50.859.0 - Logitech) Hidden
LWS Motion Detection (x32 Version: 13.30.1395.0 - Logitech) Hidden
LWS Pictures And Video (x32 Version: 13.50.861.0 - Logitech) Hidden
LWS Twitter (x32 Version: 13.30.1346.0 - Logitech) Hidden
LWS Video Mask Maker (x32 Version: 13.30.1379.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
LWS Webcam Software (x32 Version: 13.31.1038.0 - Logitech) Hidden
LWS WLM Plugin (x32 Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (x32 Version: 13.31.1038.0 - Logitech) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version:  - EasyBits Software AS)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.6109.5003 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 13.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 13.0.1 (x86 de)) (Version: 13.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 13.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyHeritage Family Tree Builder (HKLM-x32\...\Family Tree Builder) (Version: 5.0.0.1168 - MyHeritage.com)
Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.20.0 - Symantec)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.6 - NVIDIA Corporation)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.3304 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.3304 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.3405 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.3405 - CyberLink Corp.) Hidden
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.10 - ProtectDisc Software GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5938 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.2216 - CyberLink Corp.) Hidden
Rome - Total War - Gold Edition (HKLM-x32\...\{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}) (Version: 1.6 - The Creative Assembly)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.05.62 (30.04.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.03.30.00(24.05.2013) - Samsung Electronics Co., Ltd.)
Samsung M267x 287x Series (HKLM-x32\...\Samsung M267x 287x Series) (Version: 1.18 (28.06.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.10.05 (23.05.2013) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.00.07 (10.10.2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.00.56.01 - Samsung Electronics Co., Ltd.) Hidden
Shattered Union (HKLM-x32\...\{781D316B-77BA-48C3-8310-42EAFB61ED31}) (Version: 1.00.000 - )
Shop-wit (HKCU\...\shopwit) (Version:  - shopwit)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
SWF Opener (HKLM-x32\...\{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1) (Version: 1.3 - UnH Solutions)
Testversion von Microsoft Office Home and Student 2007 (HKLM\...\OfficeTrial) (Version:  - )
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Wartung Samsung ML-191x 252x Series (HKLM-x32\...\Samsung ML-191x 252x Series) (Version:  - Samsung Electronics CO.,LTD)
Web Assistant 2.0.0.572 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.572 - IncrediBar) <==== ATTENTION
WEB.DE Internet Explorer Addon (HKLM-x32\...\1&1 Mail & Media GmbH 1und1InternetExplorerAddon) (Version: 1.0.1.0 - 1&1 Mail & Media GmbH)
WEB.DE Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 2.0.2.0 - 1&1 Mail & Media GmbH)
WEB.DE Toolbar für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 1.6.4.0 - 1&1 Mail & Media GmbH)
WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-wildgames) (Version: 4.0.9.7 - WildTangent)
WildTangent Games App für HP (x32 Version: 4.0.11.14 - WildTangent) Hidden
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

27-07-2014 08:45:58 Windows Update
27-07-2014 17:00:06 Windows-Sicherung
30-07-2014 19:38:21 Windows Update
31-07-2014 22:32:36 Windows Update
03-08-2014 17:54:43 Windows Update
07-08-2014 20:33:43 Windows Update
11-08-2014 06:53:46 Windows-Sicherung
11-08-2014 15:15:46 Windows Update
17-08-2014 08:54:53 Windows Update
17-08-2014 11:17:55 Windows Update
17-08-2014 17:00:07 Windows-Sicherung
17-08-2014 22:56:24 Windows Update
18-08-2014 11:06:25 Windows Update
22-08-2014 11:49:16 Windows Update
24-08-2014 19:54:24 Windows-Sicherung
27-08-2014 17:08:22 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0BCBDEF1-F58A-4F01-B33B-9CFA0405405D} - System32\Tasks\{94B0383D-AA8B-472F-A156-BAD71121D3C9} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.59.116/de/abandoninstall?page=tsMain
Task: {1B51E654-F502-49E8-969C-93CC3BECFE4D} - System32\Tasks\{2B81A918-5080-4C0D-A970-0DBF7C480F8D} => C:\Program Files (x86)\Windows Live\Mail\wlmail.exe [2009-07-26] (Microsoft Corporation)
Task: {20BB04F4-5830-4212-B499-041897A1DC1F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {2E82251C-6C49-4C23-8AC4-E4A0BA88773C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-10] (Adobe Systems Incorporated)
Task: {5C5D467B-ECD5-4D9D-A2FD-CAD74F2C6F8B} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {5CAEA72B-D24B-4C08-8CA7-E25805AAFE74} - System32\Tasks\{98F9FDEC-B240-4FFA-B4A1-D699294D23A5} => C:\Program Files (x86)\Windows Live\Mail\wlmail.exe [2009-07-26] (Microsoft Corporation)
Task: {81968735-3B4D-4176-BBBE-F4A1EF22AC94} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2011-12-02] (1&1 Mail & Media GmbH)
Task: {842967E4-E008-4AAD-8E96-E858D4DD88FB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21] (Google Inc.)
Task: {8B58EC17-14BA-4850-9CD1-A235622D6BB1} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {8EDC85E7-4A61-40C8-90CB-9A030B2118EB} - System32\Tasks\{5B652186-7E9B-4FA1-9F06-128518C9950E} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.59.124/de/abandoninstall?source=lightinstaller&amp;page=tsMain&amp;installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {9160999D-7FFC-4E94-975C-8A8F7D07EA88} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {9ACC76C7-BA60-4313-80F7-6CABF94D9C98} - System32\Tasks\Shop-wit => C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe [2014-05-13] (Pay By Ads LTD)
Task: {9D2E7204-E70F-436C-9E9A-0B5BA7651279} - System32\Tasks\PCDRScheduledMaintenance => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18] (PC-Doctor, Inc.)
Task: {9E2080CE-263B-4C3E-9733-C8A9C9325260} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION
Task: {AF64504F-C21E-4A74-AEB5-98A39AA7D4E5} - System32\Tasks\1und1 Konfiguration => C:\ProgramData\1und1InternetExplorerAddon\ConfigTask.exe [2011-04-19] (1und1 Mail und Media GmbH)
Task: {C1F01CF5-192B-42DA-8756-1801E38856E9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {CA53D63B-40F6-40BA-8263-19E77BB9A33F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21] (Google Inc.)
Task: {E14BF6C8-155F-4BEF-B84E-598D873D586B} - System32\Tasks\ExtendedServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2009-10-20] ()
Task: {E39A2997-6D30-477E-A0F2-AFA7E7C0CB63} - System32\Tasks\EPUpdater => C:\Users\****\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] () <==== ATTENTION
Task: {E7B1A514-6BDD-4BE7-9A39-C3A832DAC5BD} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION
Task: {E80AAE9F-70CE-4B4C-BB63-53495C395036} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-08-04] (Hewlett-Packard)
Task: {EB4189F2-2E8A-4905-B293-2785EC33B5A1} - System32\Tasks\{1E570857-F779-4540-8D4E-2E16A953D8C7} => C:\Program Files (x86)\EasyBits For Kids\ezSecShield.exe [2009-09-02] (EasyBits Software AS)
Task: {F5B33F4B-6389-4C2D-8F6C-CF54E79A3106} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDRScheduledMaintenance.job => C:\Program Files\PC-Doctor for Windows\pcdrcui.exe

==================== Loaded Modules (whitelisted) =============

2013-06-26 12:42 - 2013-06-26 12:42 - 00034304 _____ () C:\Windows\System32\ssa6mlm.dll
2013-05-14 17:54 - 2009-03-02 13:06 - 00027648 _____ () C:\Windows\System32\ssp4ml6.dll
2010-07-08 14:41 - 2010-03-04 23:38 - 00071096 _____ () C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
2013-08-27 19:24 - 2013-08-27 19:24 - 03233806 _____ () C:\Program Files (x86)\Tor\tor.exe
2012-07-14 18:25 - 2013-01-29 14:28 - 00188760 _____ () C:\Program Files\Web Assistant\ExtensionUpdaterService.exe
2012-03-09 10:58 - 2012-03-09 10:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 10:58 - 2012-03-09 10:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2012-07-03 15:13 - 2012-07-03 15:13 - 00695448 _____ () C:\Users\****\AppData\Roaming\BrowserCompanion\tbhcn.exe
2013-05-24 12:48 - 2013-05-24 12:48 - 00698984 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2011-11-11 15:07 - 2011-11-11 15:07 - 00265240 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2013-05-14 17:53 - 2009-03-05 14:05 - 00306688 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2011-08-12 13:19 - 2011-08-12 13:19 - 00680984 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
2009-06-26 12:25 - 2009-06-26 12:25 - 00098304 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-03-23 18:12 - 2010-03-23 18:12 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2009-08-20 13:35 - 2009-08-20 13:35 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2009-08-20 13:35 - 2009-08-20 13:35 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2009-08-20 13:35 - 2009-08-20 13:35 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2011-08-12 13:18 - 2011-08-12 13:18 - 02145304 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2011-08-12 13:18 - 2011-08-12 13:18 - 07956504 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2011-08-12 13:18 - 2011-08-12 13:18 - 00342552 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2011-08-12 13:18 - 2011-08-12 13:18 - 00029208 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-08-12 13:18 - 2011-08-12 13:18 - 00128536 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-07-23 15:10 - 2012-07-23 15:10 - 00336232 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2011-04-02 11:28 - 2012-06-26 16:27 - 02042848 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-07-10 22:10 - 2014-07-10 22:10 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\****\Downloads\HOMBRES___2.mpg:TOC.WMV
AlternateDataStreams: C:\Users\****\Downloads\Kr_de__auta_an_ln_m_vzru_ovadlem.avi:TOC.WMV
AlternateDataStreams: C:\Users\****\Downloads\Kr_de__auta_d_lkov_m_ovlada_em.avi:TOC.WMV
AlternateDataStreams: C:\Users\****\Downloads\Kr_de__auta_z_chodov_m_zvonem.avi:TOC.WMV

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Easybits Recovery => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
MSCONFIG\startupreg: HP Remote Solution => %ProgramFiles%\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe
MSCONFIG\startupreg: HP Software Update => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPADVISOR => C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/24/2014 11:34:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: shopwit.exe, Version: 1.1.0.2, Zeitstempel: 0x5371dc97
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003bc24
ID des fehlerhaften Prozesses: 0xf7c
Startzeit der fehlerhaften Anwendung: 0xshopwit.exe0
Pfad der fehlerhaften Anwendung: shopwit.exe1
Pfad des fehlerhaften Moduls: shopwit.exe2
Berichtskennung: shopwit.exe3

Error: (08/24/2014 10:26:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: IEXPLORE.EXE, Version: 11.0.9600.17239, Zeitstempel: 0x53d22946
Name des fehlerhaften Moduls: MSHTML.dll, Version: 11.0.9600.17239, Zeitstempel: 0x53d26078
Ausnahmecode: 0xc0000005
Fehleroffset: 0x001e0b5e
ID des fehlerhaften Prozesses: 0x1188
Startzeit der fehlerhaften Anwendung: 0xIEXPLORE.EXE0
Pfad der fehlerhaften Anwendung: IEXPLORE.EXE1
Pfad des fehlerhaften Moduls: IEXPLORE.EXE2
Berichtskennung: IEXPLORE.EXE3

Error: (08/23/2014 06:31:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17239 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1540

Startzeit: 01cfbeeead0bb040

Endzeit: 63

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (08/22/2014 01:59:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: shopwit.exe, Version: 1.1.0.2, Zeitstempel: 0x5371dc97
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x65746e49
ID des fehlerhaften Prozesses: 0xfa8
Startzeit der fehlerhaften Anwendung: 0xshopwit.exe0
Pfad der fehlerhaften Anwendung: shopwit.exe1
Pfad des fehlerhaften Moduls: shopwit.exe2
Berichtskennung: shopwit.exe3

Error: (08/22/2014 01:17:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17239 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: a50

Startzeit: 01cfbdfa8cd4c630

Endzeit: 31

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (08/22/2014 01:16:41 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17239 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 544

Startzeit: 01cfbdf8696e0230

Endzeit: 31

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:

Error: (08/21/2014 09:15:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: shopwit.exe, Version: 1.1.0.2, Zeitstempel: 0x5371dc97
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003bc24
ID des fehlerhaften Prozesses: 0xf0c
Startzeit der fehlerhaften Anwendung: 0xshopwit.exe0
Pfad der fehlerhaften Anwendung: shopwit.exe1
Pfad des fehlerhaften Moduls: shopwit.exe2
Berichtskennung: shopwit.exe3

Error: (08/19/2014 06:35:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: shopwit.exe, Version: 1.1.0.2, Zeitstempel: 0x5371dc97
Name des fehlerhaften Moduls: ole32.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7b96f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003bc24
ID des fehlerhaften Prozesses: 0x2194
Startzeit der fehlerhaften Anwendung: 0xshopwit.exe0
Pfad der fehlerhaften Anwendung: shopwit.exe1
Pfad des fehlerhaften Moduls: shopwit.exe2
Berichtskennung: shopwit.exe3

Error: (08/18/2014 09:16:47 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "Microsoft.Build.Tasks, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil" /NoDependencies .  The error returned was Error: The specified assembly is not installed.
.

Error: (08/17/2014 11:51:25 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm IEXPLORE.EXE, Version 11.0.9600.17239 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: af0

Startzeit: 01cfba65209f5d60

Endzeit: 32

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Berichts-ID:


System errors:
=============
Error: (08/27/2014 07:34:15 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:34:15 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:15:00 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:11:40 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:07:18 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:07:18 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:07:17 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/27/2014 07:06:45 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/25/2014 08:59:18 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (08/25/2014 08:59:17 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.


Microsoft Office Sessions:
=========================
Error: (08/24/2014 11:34:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: shopwit.exe1.1.0.25371dc97ole32.dll6.1.7601.175144ce7b96fc00000050003bc24f7c01cfbfd3d747b800C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exeC:\Windows\syswow64\ole32.dll65be75b0-2bd6-11e4-a35c-f4ce46f0911d

Error: (08/24/2014 10:26:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: IEXPLORE.EXE11.0.9600.1723953d22946MSHTML.dll11.0.9600.1723953d26078c0000005001e0b5e118801cfbf7475c7ed70C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXEC:\Windows\system32\MSHTML.dll677da470-2b68-11e4-9517-f4ce46f0911d

Error: (08/23/2014 06:31:46 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17239154001cfbeeead0bb04063C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (08/22/2014 01:59:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: shopwit.exe1.1.0.25371dc97unknown0.0.0.000000000c000000565746e49fa801cfbdfd7a77b9e0C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exeunknownc72722a0-29f3-11e4-adc9-f4ce46f0911d

Error: (08/22/2014 01:17:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17239a5001cfbdfa8cd4c63031C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (08/22/2014 01:16:41 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.1723954401cfbdf8696e023031C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Error: (08/21/2014 09:15:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: shopwit.exe1.1.0.25371dc97ole32.dll6.1.7601.175144ce7b96fc00000050003bc24f0c01cfbd56f402d080C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exeC:\Windows\syswow64\ole32.dll7ff3b5b0-2967-11e4-97aa-f4ce46f0911d

Error: (08/19/2014 06:35:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: shopwit.exe1.1.0.25371dc97ole32.dll6.1.7601.175144ce7b96fc00000050003bc24219401cfbbbaf792ec50C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exeC:\Windows\syswow64\ole32.dllc6d16270-27be-11e4-b476-f4ce46f0911d

Error: (08/18/2014 09:16:47 AM) (Source: .NET Runtime Optimization Service) (EventID: 1107) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32) - Failed to execute command from the offline queue: uninstall "Microsoft.Build.Tasks, Version=2.0.0.0, Culture=Neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil" /NoDependencies .  The error returned was Error: The specified assembly is not installed.
.

Error: (08/17/2014 11:51:25 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: IEXPLORE.EXE11.0.9600.17239af001cfba65209f5d6032C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE


==================== Memory info ===========================

Processor: AMD Athlon(tm) II X4 630 Processor
Percentage of memory in use: 43%
Total physical RAM: 4095.3 MB
Available physical RAM: 2332.02 MB
Total Pagefile: 8188.79 MB
Available Pagefile: 5938.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:453.67 GB) (Free:372.26 GB) NTFS
Drive d: (FACTORY_IMAGE) (Fixed) (Total:12 GB) (Free:1.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (ROMETWGOLD) (CDROM) (Total:3.09 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=453.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12 GB) - (Type=07 NTFS)

==================== End Of Log ============================
GMER:

Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-28 17:08:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000057 ST350041 rev.HP34 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\****~1\AppData\Local\Temp\fwtoyaog.sys


---- User code sections - GMER 2.1 ----

.text  c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                              0000000077681465 2 bytes [68, 77]
.text  c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                            00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
?      C:\Windows\system32\mssprxy.dll [2540] entry point in ".rdata" section                                                                                                                                0000000071b871e6
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                  0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2856] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[3256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                            0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[3256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                          00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[3364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                            0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[3364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                            00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3428] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                              0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2
.text  C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                      0000000077681465 2 bytes [68, 77]
.text  C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[920] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                    00000000776814bb 2 bytes [68, 77]
.text  ...                                                                                                                                                                                                  * 2

---- Registry - GMER 2.1 ----

Reg    HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\****\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- Disk sectors - GMER 2.1 ----

Disk  \Device\Harddisk0\DR0                                                                                                                                                                                unknown MBR code

---- EOF - GMER 2.1 ----
Anmerkung: Beim ersten GMER-Scan stürzte der Computer mittendrin ab, konnte sich dann aber mit einem Neustart regenerieren. Der zweite Scan lief dann problemlos.

Ich hoffe, ich habe bis hierhin alles richtig gemacht und hoffe nun auf eure fachliche Hilfe. Vielen Dank schonmal im Voraus! :)

schrauber 28.08.2014 17:50
hi,

Adware & Co. deinstallieren




Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Nameegal 28.08.2014 23:11
Hallo und danke für die Antwort! :)

Habe deine Schritte befolgt. Bei RevoUninstaller gab es ein kleines Problem:

Zitat:
Web Assistant 2.0.0.572 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.572 - IncrediBar) <==== ATTENTION
Dieses Programm erschien nicht unter den anderen im Revo-Fenster der auf dem PC installierten Programme und deswegen konnte ich es auch nicht manuell deinstallieren. Bei Combofix (der eine gute Stunde geackert hat) sehe ich "Web Assistant" allerdings auch im Logfile - vielleicht hat Combofix das Problem auch beseitigt. Hier auf jeden Fall noch das Combofix-Log:

Code:
ComboFix 14-08-28.01 - **** 28.08.2014  22:40:31.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4095.2594 [GMT 2:00]
ausgeführt von:: c:\users\****\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Web Assistant\ExTEnsion64.dll
c:\users\****\4.0
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-07-28 bis 2014-08-28  ))))))))))))))))))))))))))))))
.
.
2014-08-28 21:53 . 2014-08-28 21:53        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-08-28 20:28 . 2014-08-21 03:43        11319192        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C619B2BD-ACF7-4292-81CA-50DB8B0DCBBE}\mpengine.dll
2014-08-28 20:20 . 2014-08-28 20:20        --------        d-----w-        c:\program files (x86)\VS Revo Group
2014-08-28 15:21 . 2014-08-28 15:21        --------        d-----w-        c:\program files (x86)\Common Files\Java
2014-08-28 15:21 . 2014-07-25 10:55        98216        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-28 14:42 . 2014-08-21 03:43        11319192        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-08-28 13:55 . 2014-08-28 13:59        --------        d-----w-        C:\FRST
2014-08-28 13:49 . 2014-08-23 02:07        404480        ----a-w-        c:\windows\system32\gdi32.dll
2014-08-28 13:49 . 2014-08-23 00:59        3163648        ----a-w-        c:\windows\system32\win32k.sys
2014-08-28 13:49 . 2014-08-23 01:45        311808        ----a-w-        c:\windows\SysWow64\gdi32.dll
2014-08-21 19:35 . 2014-08-21 19:35        --------        d-----w-        c:\programdata\BlueStacks
2014-08-20 07:44 . 2014-08-20 07:43        1169712        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{0D7FFC7C-E9E6-4237-A991-085218B5C4A3}\gapaengine.dll
2014-08-17 11:19 . 2014-03-09 21:48        171160        ----a-w-        c:\windows\system32\infocardapi.dll
2014-08-17 11:19 . 2014-03-09 21:47        99480        ----a-w-        c:\windows\SysWow64\infocardapi.dll
2014-08-17 11:19 . 2014-03-09 21:48        1389208        ----a-w-        c:\windows\system32\icardagt.exe
2014-08-17 11:19 . 2014-03-09 21:47        619672        ----a-w-        c:\windows\SysWow64\icardagt.exe
2014-08-17 11:19 . 2014-06-30 22:24        8856        ----a-w-        c:\windows\system32\icardres.dll
2014-08-17 11:19 . 2014-06-30 22:14        8856        ----a-w-        c:\windows\SysWow64\icardres.dll
2014-08-17 11:18 . 2014-06-06 06:16        35480        ----a-w-        c:\windows\SysWow64\TsWpfWrp.exe
2014-08-17 11:18 . 2014-06-06 06:12        35480        ----a-w-        c:\windows\system32\TsWpfWrp.exe
2014-08-17 08:54 . 2014-07-16 03:23        2048        ----a-w-        c:\windows\system32\tzres.dll
2014-08-17 08:54 . 2014-07-16 02:46        2048        ----a-w-        c:\windows\SysWow64\tzres.dll
2014-08-17 08:54 . 2014-06-03 10:02        3241984        ----a-w-        c:\windows\system32\msi.dll
2014-08-17 08:54 . 2014-06-03 10:02        1941504        ----a-w-        c:\windows\system32\authui.dll
2014-08-17 08:54 . 2014-06-03 09:29        2363392        ----a-w-        c:\windows\SysWow64\msi.dll
2014-08-17 08:54 . 2014-06-03 10:02        112064        ----a-w-        c:\windows\system32\consent.exe
2014-08-17 08:54 . 2014-06-03 10:02        504320        ----a-w-        c:\windows\system32\msihnd.dll
2014-08-17 08:54 . 2014-06-03 09:29        337408        ----a-w-        c:\windows\SysWow64\msihnd.dll
2014-08-17 08:54 . 2014-06-03 09:29        1805824        ----a-w-        c:\windows\SysWow64\authui.dll
2014-08-17 08:51 . 2014-07-14 02:02        1216000        ----a-w-        c:\windows\system32\rpcrt4.dll
2014-08-17 08:51 . 2014-07-14 01:40        664064        ----a-w-        c:\windows\SysWow64\rpcrt4.dll
2014-08-17 08:51 . 2014-08-07 02:06        529920        ----a-w-        c:\windows\system32\aepdu.dll
2014-08-17 08:51 . 2014-08-07 02:01        424448        ----a-w-        c:\windows\system32\aeinv.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-17 22:57 . 2010-07-10 13:49        99218768        ----a-w-        c:\windows\system32\MRT.exe
2014-07-10 20:10 . 2013-11-05 17:41        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-07-10 20:10 . 2011-08-19 11:25        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-06-18 02:18 . 2014-07-10 18:29        692736        ----a-w-        c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-10 18:29        646144        ----a-w-        c:\windows\SysWow64\osk.exe
2014-06-06 10:10 . 2014-07-10 18:29        624128        ----a-w-        c:\windows\system32\qedit.dll
2014-06-06 09:44 . 2014-07-10 18:29        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2014-06-05 14:45 . 2014-07-10 18:28        1460736        ----a-w-        c:\windows\system32\lsasrv.dll
2014-06-05 14:26 . 2014-07-10 18:28        22016        ----a-w-        c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-10 18:28        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}]
2013-01-29 12:28        170840        ----a-w-        c:\program files\Web Assistant\Extension32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 2363392]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-18 20587168]
"shopwit"="c:\users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe" [2014-05-13 510976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-12-01 98304]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"Samsung PanelMgr"="c:\windows\Samsung\panelmgr\SSMMgr.exe" [2013-05-24 698984]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Magic Desktop for HP notification"="c:\programdata\Easybits Magic Desktop for HP\mdhpSUN.exe" [2013-12-10 1243656]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Network PC Fax.lnk - c:\windows\System32\spool\drivers\x64\3\NetFaxTray64.exe [2013-11-24 380976]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)
.
[hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 GamesAppIntegrationService;GamesAppIntegrationService;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [x]
R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech Webcam C210(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 Samsung Network Fax Server;Samsung Network Fax Server;c:\windows\system32\spool\drivers\x64\3\NetFaxServer64.exe;c:\windows\SYSNATIVE\spool\drivers\x64\3\NetFaxServer64.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 tor;Tor Win32 Service;c:\program files (x86)\Tor\tor.exe;c:\program files (x86)\Tor\tor.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S2 Web Assistant;Web Assistant;c:\program files\Web Assistant\ExtensionUpdaterService.exe;c:\program files\Web Assistant\ExtensionUpdaterService.exe [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
ezSharedSvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-05 20:10]
.
2014-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21 16:40]
.
2014-08-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21 16:40]
.
2010-09-30 c:\windows\Tasks\PCDRScheduledMaintenance.job
- c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-03-11 1271072]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-03-09 462712]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://ixquick.com/deu/
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\
FF - prefs.js: browser.search.selectedEngine - FileConverter 1.3 Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.enhanced-search.com/?affID=119556&tt=gc_&babsrc=HP_ss_mib2&mntrId=D48CF4CE46F0911D
FF - prefs.js: keyword.URL - hxxp://trovi.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN15372992237491412&UM=&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: extensions.incredibar_i.newTab - false
FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6R8yYOecHF&loc=IB_TB&i=26&search=
FF - user.js: extensions.incredibar_i.id - d48ce196000000000000f4ce46f0911d
FF - user.js: extensions.incredibar_i.instlDay - 15535
FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14
FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1418:25
FF - user.js: extensions.incredibar_i.prtnrId - Incredibar
FF - user.js: extensions.incredibar_i.prdct - incredibar
FF - user.js: extensions.incredibar_i.aflt - orgnl
FF - user.js: extensions.incredibar_i.smplGrp - none
FF - user.js: extensions.incredibar_i.tlbrId - base
FF - user.js: extensions.incredibar_i.instlRef -
FF - user.js: extensions.incredibar_i.dfltLng -
FF - user.js: extensions.incredibar_i.excTlbr - false
FF - user.js: extensions.incredibar_i.ms_url_id -
FF - user.js: extensions.incredibar_i.upn2 - 6R8yYOecHF
FF - user.js: extensions.incredibar_i.upn2n - 92824704708612467
FF - user.js: extensions.incredibar_i.productid - 26
FF - user.js: extensions.incredibar_i.installerproductid - 26
FF - user.js: extensions.incredibar_i.did - 10662
FF - user.js: extensions.incredibar_i.ppd -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
Wow6432Node-HKLM-Run-Lwinst Run Profiler - c:\program files (x86)\Logitech\WingMan Profiler\Lwtest.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe
AddRemove-Logitech WingMan Software - c:\windows\IsUn0407.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.14"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\program files (x86)\CDBurnerXP\NMSAccessU.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-08-29  00:00:55 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-08-28 22:00
.
Vor Suchlauf: 11 Verzeichnis(se), 398.998.941.696 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 402.111.606.784 Bytes frei
.
- - End Of File - - A701DDF9AE3C7D182F8F55C19C5BF279
556C9DE6F106EC9DD34F3E93499D3331
Ich bin gespannt, was du dazu zu sagen hast. Jetzt geht's für mich aber erstmal ab in die Heia! ;)

schrauber 29.08.2014 12:42
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

Nameegal 29.08.2014 21:31
Bitteschön! :)

MBAM:

Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 29.08.2014
Suchlauf-Zeit: 19:03:08
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.08.29.05
Rootkit Datenbank: v2014.08.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: ****

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 317228
Verstrichene Zeit: 20 Min, 16 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.SweetPacks.A, C:\Program Files\Web Assistant\ExtensionUpdaterService.exe, 2148, Löschen bei Neustart, [c6931dafaecdbd799a1df91a2ad7da26]
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, 4040, Löschen bei Neustart, [4415765697e4c670f43213003bcac23e]

Module: 1
PUP.Optional.ClientConnect, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee}\Plugins\npFirefoxPlugin.dll, Löschen bei Neustart, [06538b412b50b2846517ecc0d42dcd33],

Registrierungsschlüssel: 21
PUP.Optional.SweetPacks.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Web Assistant, In Quarantäne, [c6931dafaecdbd799a1df91a2ad7da26],
PUP.Optional.PayByAds.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\shopwit, In Quarantäne, [4415765697e4c670f43213003bcac23e],
PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [a2b74b8102791a1cf48cc0ef639f01ff],
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [a2b74b8102791a1cf48cc0ef639f01ff],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{336D0C35-8A85-403A-B9D2-65C292C39087}, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93],
PUP.Optional.StartPage.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{336D0C35-8A85-403A-B9D2-65C292C39087}, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93],
PUP.Optional.StartPage.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{336D0C35-8A85-403A-B9D2-65C292C39087}, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93],
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}, In Quarantäne, [84d598348cef2610509f7f3355ad6c94],
PUP.Optional.FrostwireTB.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{D4027C7F-154A-4066-A1AD-4243D8127440}, In Quarantäne, [84d598348cef2610509f7f3355ad6c94],
PUP.Optional.FrostwireTB.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{D4027C7F-154A-4066-A1AD-4243D8127440}, In Quarantäne, [84d598348cef2610509f7f3355ad6c94],
PUP.Optional.Babylon.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [2831f4d8eb90f83e020c88ee19e9e41c],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, In Quarantäne, [b8a1d3f9e7949b9be4b2cc3dba49ee12],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, In Quarantäne, [7edb616bd3a83cfae34615ea61a13ec2],
PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, In Quarantäne, [0e4bd1fb502bd5616234c0493fc409f7],
PUP.Optional.BabylonToolBar.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BabylonToolbar, In Quarantäne, [3227bd0f91eaf83e21d4072edc28b749],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [12479933186382b454d3d9594fb51ae6],
PUP.Optional.Conduit.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\FF, In Quarantäne, [5108e5e70675b4829b29f047857f38c8],
PUP.Optional.ValueApps.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\CONDUIT\ValueApps, In Quarantäne, [66f3923a394278be22470f0d8380c63a],
PUP.Optional.BProtector.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\bProtectSettings, In Quarantäne, [1841d9f3a2d958deea8f91a48b791ae6],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [9abfc804ceadaa8c1bfc7497b64d59a7],

Registrierungswerte: 9
PUP.Optional.PayByAds.A, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|shopwit, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, In Quarantäne, [4415765697e4c670f43213003bcac23e]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93]
PUP.Optional.StartPage.A, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [57026666e09ba1955a577df81de5f50b],
PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, In Quarantäne, [5ffab21ab1ca2a0c159c591c31d1d32d],
PUP.Optional.Incredibar, HKLM\SOFTWARE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [b3a6884487f4dd59d5e968d5b74dbd43]
PUP.Optional.Incredibar, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}, C:\Program Files\Web Assistant\Firefox, In Quarantäne, [b9a009c36e0da294556952ebf212f808]
PUP.BProtector, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|bProtector Start Page, hxxp://www1.delta-search.com/?affID=119556&tt=gc_&babsrc=HP_ss&mntrId=D48CF4CE46F0911D, In Quarantäne, [0a4fc9036813d95d41e8fa38fb096997]
PUP.BProtector, HKU\S-1-5-21-3228486621-4223541548-3929983969-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|bProtectorDefaultScope, {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [9bbe15b77407b086d2580d2502024eb2]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 12
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps\CT3241949, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Yontoo.A, C:\Program Files (x86)\Yontoo, In Quarantäne, [2435715bc3b80d2918af17bb38ca21df],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit, Löschen bei Neustart, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit, Löschen bei Neustart, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10, Löschen bei Neustart, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\LocalLow\Incredibar.com, In Quarantäne, [41182ca0c9b2da5cccf1cf102ad80df3],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\LocalLow\Incredibar.com\incredibar, In Quarantäne, [41182ca0c9b2da5cccf1cf102ad80df3],

Dateien: 127
PUP.Optional.SweetPacks.A, C:\Program Files\Web Assistant\ExtensionUpdaterService.exe, Löschen bei Neustart, [c6931dafaecdbd799a1df91a2ad7da26],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\shopwit.exe, Löschen bei Neustart, [4415765697e4c670f43213003bcac23e],
PUP.Optional.ClientConnect, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee}\Plugins\npFirefoxPlugin.dll, Löschen bei Neustart, [06538b412b50b2846517ecc0d42dcd33],
PUP.Optional.StartPage.A, C:\Program Files\Web Assistant\Extension32.dll, In Quarantäne, [0e4b1cb085f644f2cfe2d89de0226d93],
PUP.AdBundler, C:\Users\****\Downloads\PDFCreator.exe, In Quarantäne, [1c3d8745ed8e84b2a174f3b0ef11f808],
PUP.OfferBundler.ST, C:\Users\****\Downloads\SoftonicDownloader_pour_swf-opener.exe, In Quarantäne, [1940f2da314a68ce716eedaace3260a0],
PUP.Optional.Conduit.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\fileconverter-13-customized-web-search.xml, In Quarantäne, [e772e3e992e9c5711a6384776e94b54b],
PUP.Optional.MyStartSearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\MyStart Search.xml, In Quarantäne, [a3b6418ba3d8a492710a927d7b88659b],
PUP.Optional.Babylon.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\babylon.xml, In Quarantäne, [e1783795accf4beb40d269a821e2c838],
PUP.Optional.BProtector.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\bProtector_extensions.sqlite, In Quarantäne, [2633d1fbabd0999d23fb2fe283804bb5],
PUP.Optional.BProtector.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\bprotector_prefs.js, In Quarantäne, [8bce9438adce4fe7100f3cd5669dbd43],
PUP.Optional.Conduit.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\conduit.xml, In Quarantäne, [93c6e5e7027913230336af62d1322bd5],
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps\CT3241949\mam_gk_appsConfig.txt, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps\CT3241949\mam_gk_eventsCache.txt, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps\CT3241949\mam_gk_localization.txt, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.ValueApps.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\valueApps\CT3241949\mam_gk_settings1.13.0.17.txt, In Quarantäne, [2e2be9e35b2092a47050ddebe71b32ce],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\chrome.manifest, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\install.rdf, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\incredibar.css, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\incredibar.xul, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\mtstart.js, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\tmplt.js, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\arwDwn.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\help_16.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\home.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\logo.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\privecy_16_hot.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\specialoffer.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\tellafriend.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\uninstall.gif, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ae.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\bg.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ch.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\cn.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\cz.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\de.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\eg.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\en.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\es.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\fr.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\gr.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\he.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\il.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\it.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ja.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\jp.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\nl.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\no.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\pl.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\pt.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ro.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ru.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\sa.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\se.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\sv.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\tr.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\ua.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs\us.png, In Quarantäne, [93c65f6d007bf640e9f005c60df5cd33],
PUP.Optional.Yontoo.A, C:\Program Files (x86)\Yontoo\YontooIEClient.dll, In Quarantäne, [2435715bc3b80d2918af17bb38ca21df],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\app.ini, In Quarantäne, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\chrmXtn.dll, In Quarantäne, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.PayByAds.A, C:\Users\****\AppData\Local\shopwit\shopwit\1.3.6.10\ffxtn.dll, In Quarantäne, [99c0567691ea22145f9c57838d7505fb],
PUP.Optional.Trovi.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("keyword.URL", "hxxp://trovi.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN15372992237491412&UM=&q=");), Ersetzt,[fa5fb11b8fecba7ce24a3cda12f3a759]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.actvtyRptTime", "1367243034605");), Ersetzt,[510833999edd82b4108dec2a40c5e31d]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.admin", false);), Ersetzt,[1a3f6468b3c8ca6c8617b0669d68e41c]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.aflt", "orgnl");), Ersetzt,[80d95775ea91171f633af22445c0e917]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.afterInstallRpt", "sent");), Ersetzt,[b0a97359f5867eb846578096877ec040]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.cntry", "DE");), Ersetzt,[392012bacfac3cfa891440d6788db749]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltlng", "EN");), Ersetzt,[e475c507bdbe3df9f4a94acc3dc8ae52]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.dfltsrch", "false");), Ersetzt,[f564f4d81467e74f9b02a571689d30d0]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.did", "10662");), Ersetzt,[71e879539edd280e1e7fa27449bcfa06]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.envrmnt", "production");), Ersetzt,[84d5f5d7afcca294702d9680ff06f40c]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.excTlbr", false);), Ersetzt,[60f94389cfaca88e7a230412ef1649b7]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hdrMd5", "FADD26C3B0357BD83A409E9AAECC8670");), Ersetzt,[5504fece601b47ef3f5ed4423bca936d]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hmpg", false);), Ersetzt,[0257953797e44beb6538ef2746bf728e]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.hrdid", "d48ce196000000000000f4ce46f0911d");), Ersetzt,[8acfdfeda6d5a492c8d570a6d530f010]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.id", "d48ce196000000000000f4ce46f0911d");), Ersetzt,[b8a12aa2423942f4e5b861b55da845bb]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.installerproductid", "26");), Ersetzt,[f564a5273348d363603d67afe5204fb1]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlday", "15535");), Ersetzt,[78e1a626e695fd39405db85e54b15ba5]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.instlref", "");), Ersetzt,[84d597358af1b086524bf52145c06c94]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.isdcmntcmplt", "false");), Ersetzt,[90c926a6f5863cfaa7f6af6760a5a759]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.keywordurl", "");), Ersetzt,[89d07c508cef42f4c3da04127f86e917]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1418:25:46");), Ersetzt,[e871a4283f3c79bd5d4035e11bea23dd]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.mntrvrsn", "1.2.0");), Ersetzt,[a9b0933996e5ec4a5647bd598c79f20e]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtab", "false");), Ersetzt,[95c4efdd186304322d709482996cf907]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.newtaburl", "");), Ersetzt,[88d1b814fb8022140c910f0713f225db]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.noFFXTlbr", false);), Ersetzt,[b3a60dbf86f5b77f5b42c056f60ff907]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.ppd", "");), Ersetzt,[24354884cbb060d6623b54c2b3526898]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prdct", "incredibar");), Ersetzt,[b4a59636413aea4c4c51b85e30d5b24e]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.productid", "26");), Ersetzt,[adacfbd18eed8aac623b8195a0657b85]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.prtnrid", "Incredibar");), Ersetzt,[7adfa824c4b73ff77f1e57bfc63f9e62]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.sg", "none");), Ersetzt,[b9a0f7d5423996a0e4b9061008fd9868]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.smplgrp", "none");), Ersetzt,[16435a728bf0d0666a33ff17f70e59a7]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srch", "");), Ersetzt,[1e3bdbf1ef8c24122b72fc1aaa5b25db]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.srchprvdr", "");), Ersetzt,[9ebbf5d77efd5cdac8d502149d688e72]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrid", "base");), Ersetzt,[86d3f7d55c1f072facf163b3d035cf31]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8yYOecHF&loc=IB_TB&i=26&search=");), Ersetzt,[6aef17b5572468cefda017ff5da85ca4]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2", "6R8yYOecHF");), Ersetzt,[a8b15f6d7b0004328b124bcbdf2660a0]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.upn2n", "92824704708612467");), Ersetzt,[76e3f3d991ea7bbbabf2be58ae5726da]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsn", "1.5.11.14");), Ersetzt,[83d64e7eef8c36004f4e8d89d82d02fe]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsni", "1.5.11.14");), Ersetzt,[f4658a4297e43ff74e4f35e19d68817f]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar.vrsnts", "1.5.11.1418:25:46");), Ersetzt,[7adf8b418bf05dd90499a076ed18fa06]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.aflt", "orgnl");), Ersetzt,[7ddc3b9192e93cfa089535e126df23dd]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.dfltLng", "");), Ersetzt,[f762cb017308d4620b92d73f82834bb5]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.did", "10662");), Ersetzt,[68f1f0dc63188fa70a9320f6f411e917]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.excTlbr", false);), Ersetzt,[d683f1db4635ba7cfca16caaf411e51b]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.id", "d48ce196000000000000f4ce46f0911d");), Ersetzt,[96c34a82651645f1f5a8c84eec195aa6]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.installerproductid", "26");), Ersetzt,[8ecbba124f2cbd797f1ee03651b4da26]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlDay", "15535");), Ersetzt,[70e9b01c671483b3732aee28b4510000]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.instlRef", "");), Ersetzt,[b8a18a42205b9b9b831a26f045c0d62a]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ms_url_id", "");), Ersetzt,[d089cefe215a2a0c1a834fc762a360a0]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.newTab", false);), Ersetzt,[0950626ac5b6a88ea4f9f422f015d927]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.ppd", "");), Ersetzt,[9ebb34984437ed49e5b88f87d43111ef]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prdct", "incredibar");), Ersetzt,[99c0ad1f3c3f63d3c3dae0368e77b050]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.productid", "26");), Ersetzt,[eb6e2e9e2952b680039ac74f6f9642be]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.prtnrId", "Incredibar");), Ersetzt,[4415399356258caa316c0412b550d729]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.smplGrp", "none");), Ersetzt,[a0b9923ab0cbf640f7a6130374911ce4]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrId", "base");), Ersetzt,[283123a9e299a492ecb1d83e679ef010]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8yYOecHF&loc=IB_TB&i=26&search=");), Ersetzt,[451421abdd9e81b5dac3ec2aa85d32ce]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2", "6R8yYOecHF");), Ersetzt,[f564b01c5229f83e3c6150c6ab5a738d]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.upn2n", "92824704708612467");), Ersetzt,[e0791eae116ad95dafeea4725ca9758b]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");), Ersetzt,[bf9a7458aad13ef8f0ad24f2e61f7b85]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1418:25:46");), Ersetzt,[d1882d9f3348af87cbd21bfb9e67916f]
PUP.Optional.Incredibar.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");), Ersetzt,[92c7ece02c4fbe78ecb17e98f510d927]
PUP.Optional.Conduit.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("CT3241949.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=");), Ersetzt,[f861f2daccafdf57f806a373d5302fd1]
PUP.Optional.Conduit.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("CT3241949.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?gd=&ctid=CT3241949&octid=CT3241949&ISID=ISID_ID&SearchSource=15&CUI=UN15372992237491412&Lay=1&UM=\"}");), Ersetzt,[3920ece0552681b5838afd1ab055dd23]
PUP.Optional.EnhancedSearch.A, C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js, Gut: (), Schlecht: (user_pref("browser.startup.homepage", "hxxp://www.enhanced-search.com/?affID=119556&tt=gc_&babsrc=HP_ss_mib2&mntrId=D48CF4CE46F0911D");), Ersetzt,[87d245876a112214f9421ff9bb4ac739]

Physische Sektoren: 0
(No malicious items detected)


(end)
AdwCleaner:

Code:
# AdwCleaner v3.308 - Bericht erstellt am 29/08/2014 um 21:53:58
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : **** - ****-PC
# Gestartet von : C:\Users\****\Desktop\adwcleaner_3.308.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files\Web Assistant
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\****\AppData\Roaming\BrowserCompanion
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Smartbar
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\ValueApps
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\CT3241949
Ordner Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee}
Datei Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Extension.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConfigTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConfigTask_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKCU\Software\f2d68ae13de547
Schlüssel Gelöscht : HKLM\SOFTWARE\f2d68ae13de547
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_swf-opener_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_pour_swf-opener_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B302A1BD-0157-49FA-90F1-4E94F22C7B4B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{C424171E-592A-415A-9EB1-DFD6D95D3530}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\Blabbers     
Schlüssel Gelöscht : HKCU\Software\Blabbers
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Productivity_2.2
Schlüssel Gelöscht : HKLM\SOFTWARE\Web Assistant
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Web Assistant
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17239

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v13.0.1 (de)

[ Datei : C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\prefs.js ]

Zeile gelöscht : user_pref("CT3241949.1000082.isPlayDisplay", "true");
Zeile gelöscht : user_pref("CT3241949.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock\",\"url\":\"hxxp://feedlive.net/california.asx\"}");
Zeile gelöscht : user_pref("CT3241949.1000234.TWC_TMP_city", "NUREMBERG");
Zeile gelöscht : user_pref("CT3241949.1000234.TWC_TMP_country", "DE");
Zeile gelöscht : user_pref("CT3241949.1000515.APP_WIN_FEATURES", "resizable=0,hscroll=0,vscroll=0,titlebar=1,closebutton=1,saveresizedsize=0,openposition=alignment:(B;L),savelocation=0,closeonexternalclick=0");
Zeile gelöscht : user_pref("CT3241949.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.Facebook_Mode", "2");
Zeile gelöscht : user_pref("CT3241949.Facebook_User_Locale", "de");
Zeile gelöscht : user_pref("CT3241949.FirstTime", "true");
Zeile gelöscht : user_pref("CT3241949.FirstTimeFF3", "true");
Zeile gelöscht : user_pref("CT3241949.RestartDialogFirstTime", "false");
Zeile gelöscht : user_pref("CT3241949.RestartDialogShouldDisplay", "false");
Zeile gelöscht : user_pref("CT3241949.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=");
Zeile gelöscht : user_pref("CT3241949.UserID", "UN15372992237491412");
Zeile gelöscht : user_pref("CT3241949.addressBarTakeOverEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT3241949.browser.search.defaultthis.engineName", true);
Zeile gelöscht : user_pref("CT3241949.countryCode", "DE");
Zeile gelöscht : user_pref("CT3241949.enableAlerts", "always");
Zeile gelöscht : user_pref("CT3241949.enableFix404ByUser", "FALSE");
Zeile gelöscht : user_pref("CT3241949.event_data", "%5B%5D");
Zeile gelöscht : user_pref("CT3241949.fired_events", "");
Zeile gelöscht : user_pref("CT3241949.firstTimeDialogOpened", "true");
Zeile gelöscht : user_pref("CT3241949.fixPageNotFoundErrorByUser", "TRUE");
Zeile gelöscht : user_pref("CT3241949.fixPageNotFoundErrorInHidden", "true");
Zeile gelöscht : user_pref("CT3241949.fixUrls", true);
Zeile gelöscht : user_pref("CT3241949.fullUserID", "UN15372992237491412.UP.202501230433");
Zeile gelöscht : user_pref("CT3241949.isCheckedStartAsHidden", true);
Zeile gelöscht : user_pref("CT3241949.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.isFirstTimeToolbarLoading", "false");
Zeile gelöscht : user_pref("CT3241949.isNewTabEnabled", true);
Zeile gelöscht : user_pref("CT3241949.isPerformedSmartBarTransition", "true");
Zeile gelöscht : user_pref("CT3241949.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");
Zeile gelöscht : user_pref("CT3241949.isWelcomPage", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.key_date", "29");
Zeile gelöscht : user_pref("CT3241949.keyword", true);
Zeile gelöscht : user_pref("CT3241949.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?gd=&ctid=CT3241949&octid=CT3241949&ISID=ISID_ID&SearchSource=15&CUI=UN15372992237491412&Lay=1&[...]
Zeile gelöscht : user_pref("CT3241949.lastVersion", "10.33.0.517");
Zeile gelöscht : user_pref("CT3241949.migrateAppsAndComponents", true);
Zeile gelöscht : user_pref("CT3241949.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fwww.trojaner-board.de%2Flogin.php%3Fdo%3Dlogout%26logouthash%3D1409334264-48b4fc220128092911143e0ee79825914bd665bf\"[...]
Zeile gelöscht : user_pref("CT3241949.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3241949&SearchSource=13");
Zeile gelöscht : user_pref("CT3241949.originalSearchAddressUrl", "chrome://unitedtb/content/search/keywordURL.xul?q=");
Zeile gelöscht : user_pref("CT3241949.performedDomainChangesMigration", "true");
Zeile gelöscht : user_pref("CT3241949.personalApps", "{\"dataType\":\"object\",\"data\":\"[\\\"BROWSER_COMPONENT\\\"]\"}");
Zeile gelöscht : user_pref("CT3241949.search.searchAppId", "129887071061272563");
Zeile gelöscht : user_pref("CT3241949.search.searchCount", "2");
Zeile gelöscht : user_pref("CT3241949.searchInNewTabEnabledByUser", "true");
Zeile gelöscht : user_pref("CT3241949.searchInNewTabEnabledInHidden", "true");
Zeile gelöscht : user_pref("CT3241949.searchSuggestEnabledByUser", "True");
Zeile gelöscht : user_pref("CT3241949.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3241949\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://FileConverter13.OurToolbar.com//xpi\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"FileConverter 1.3 \"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_Configuration_lastUpdate", "1409331320021");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1367243121588");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_appsMetadata_lastUpdate", "1367243154989");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1367243121271");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_location_lastUpdate", "1372524222617");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.10.27.6_lastUpdate", "1367244444675");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.15.2.523_lastUpdate", "1372524222907");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.23.0.822_lastUpdate", "1393148020378");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.33.0.505_lastUpdate", "1409331318734");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_login_10.33.0.517_lastUpdate", "1409334225874");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_menu_769c590835a76d075fe33b9a87a87786_lastUpdate", "1367243155461");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_menu_d32f45618f5a02bd965c56155a643855_lastUpdate", "1367243155430");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_optimizer_lastUpdate", "1346319168031");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1367243121506");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_searchAPI_lastUpdate", "1409331319840");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_serviceMap_lastUpdate", "1409331319202");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_toolbarContextMenu_lastUpdate", "1367243121429");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_toolbarSettings_lastUpdate", "1409331319803");
Zeile gelöscht : user_pref("CT3241949.serviceLayer_services_translation_lastUpdate", "1409331319304");
Zeile gelöscht : user_pref("CT3241949.settingsINI", true);
Zeile gelöscht : user_pref("CT3241949.showToolbarPermission", "false");
Zeile gelöscht : user_pref("CT3241949.smartbar.CTID", "CT3241949");
Zeile gelöscht : user_pref("CT3241949.smartbar.Uninstall", "0");
Zeile gelöscht : user_pref("CT3241949.smartbar.homepage", true);
Zeile gelöscht : user_pref("CT3241949.smartbar.isHidden", true);
Zeile gelöscht : user_pref("CT3241949.smartbar.toolbarName", "FileConverter 1.3 ");
Zeile gelöscht : user_pref("CT3241949.toolbarBornServerTime", "21-8-2012");
Zeile gelöscht : user_pref("CT3241949.toolbarCurrentServerTime", "29-8-2014");
Zeile gelöscht : user_pref("CT3241949.toolbarLoginClientTime", "Mon Apr 29 2013 16:12:22 GMT+0200");
Zeile gelöscht : user_pref("CT3241949.upgradeFromClearSBVersion", true);
Zeile gelöscht : user_pref("CT3241949_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1409334222412,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]");
Zeile gelöscht : user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?CUI=UN15372992237491412&ctid=CT3241949&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchEngineList", "FileConverter 1.3 Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://mystart.incredibar.com/mb164/?loc=IB_DS&a=6R8yYOecHF&&i=26&search=");
Zeile gelöscht : user_pref("Smartbar.TBHomepagesList", "hxxp://search.conduit.com/?CUI=UN15372992237491412&ctid=CT3241949&SearchSource=13");
Zeile gelöscht : user_pref("Smartbar.TBSearchEngineList", "FileConverter 1.3 Customized Web Search");
Zeile gelöscht : user_pref("Smartbar.TBSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=");
Zeile gelöscht : user_pref("Smartbar.keywordURLSelectedCTID", "CT3241949");
Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.defaultenginename", "FileConverter 1.3 Customized Web Search");
Zeile gelöscht : user_pref("browser.search.order.1", "Delta Search");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "FileConverter 1.3 Customized Web Search");
Zeile gelöscht : user_pref("extensions.incredibar.actvtyRptTime", "1367243034605");
Zeile gelöscht : user_pref("extensions.incredibar.admin", false);
Zeile gelöscht : user_pref("extensions.incredibar.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar.afterInstallRpt", "sent");
Zeile gelöscht : user_pref("extensions.incredibar.cntry", "DE");
Zeile gelöscht : user_pref("extensions.incredibar.dfltlng", "EN");
Zeile gelöscht : user_pref("extensions.incredibar.dfltsrch", "false");
Zeile gelöscht : user_pref("extensions.incredibar.did", "10662");
Zeile gelöscht : user_pref("extensions.incredibar.envrmnt", "production");
Zeile gelöscht : user_pref("extensions.incredibar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.hdrMd5", "FADD26C3B0357BD83A409E9AAECC8670");
Zeile gelöscht : user_pref("extensions.incredibar.hmpg", false);
Zeile gelöscht : user_pref("extensions.incredibar.hrdid", "d48ce196000000000000f4ce46f0911d");
Zeile gelöscht : user_pref("extensions.incredibar.id", "d48ce196000000000000f4ce46f0911d");
Zeile gelöscht : user_pref("extensions.incredibar.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.instlday", "15535");
Zeile gelöscht : user_pref("extensions.incredibar.instlref", "");
Zeile gelöscht : user_pref("extensions.incredibar.isdcmntcmplt", "false");
Zeile gelöscht : user_pref("extensions.incredibar.keywordurl", "");
Zeile gelöscht : user_pref("extensions.incredibar.lastVrsnTs", "1.5.11.1418:25:46");
Zeile gelöscht : user_pref("extensions.incredibar.mntrvrsn", "1.2.0");
Zeile gelöscht : user_pref("extensions.incredibar.newtab", "false");
Zeile gelöscht : user_pref("extensions.incredibar.newtaburl", "");
Zeile gelöscht : user_pref("extensions.incredibar.noFFXTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar.ppd", "");
Zeile gelöscht : user_pref("extensions.incredibar.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar.prtnrid", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar.sg", "none");
Zeile gelöscht : user_pref("extensions.incredibar.smplgrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar.srch", "");
Zeile gelöscht : user_pref("extensions.incredibar.srchprvdr", "");
Zeile gelöscht : user_pref("extensions.incredibar.tlbrid", "base");
Zeile gelöscht : user_pref("extensions.incredibar.tlbrsrchurl", "hxxp://mystart.Incredibar.com/?a=6R8yYOecHF&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar.upn2", "6R8yYOecHF");
Zeile gelöscht : user_pref("extensions.incredibar.upn2n", "92824704708612467");
Zeile gelöscht : user_pref("extensions.incredibar.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar.vrsnts", "1.5.11.1418:25:46");
Zeile gelöscht : user_pref("extensions.incredibar_i.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.incredibar_i.dfltLng", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.did", "10662");
Zeile gelöscht : user_pref("extensions.incredibar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.id", "d48ce196000000000000f4ce46f0911d");
Zeile gelöscht : user_pref("extensions.incredibar_i.installerproductid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlDay", "15535");
Zeile gelöscht : user_pref("extensions.incredibar_i.instlRef", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.ms_url_id", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.incredibar_i.ppd", "");
Zeile gelöscht : user_pref("extensions.incredibar_i.prdct", "incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.productid", "26");
Zeile gelöscht : user_pref("extensions.incredibar_i.prtnrId", "Incredibar");
Zeile gelöscht : user_pref("extensions.incredibar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.incredibar_i.tlbrSrchUrl", "hxxp://mystart.Incredibar.com/?a=6R8yYOecHF&loc=IB_TB&i=26&search=");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2", "6R8yYOecHF");
Zeile gelöscht : user_pref("extensions.incredibar_i.upn2n", "92824704708612467");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsn", "1.5.11.14");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsnTs", "1.5.11.1418:25:46");
Zeile gelöscht : user_pref("extensions.incredibar_i.vrsni", "1.5.11.14");
Zeile gelöscht : user_pref("keyword.URL", "hxxp://trovi.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN15372992237491412&UM=&q=");
Zeile gelöscht : user_pref("plugin.state.npconduitfirefoxplugin", 2);
Zeile gelöscht : user_pref("smartbar.addressBarOwnerCTID", "CT3241949");
Zeile gelöscht : user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3241949&SearchSource=13,hxxp://search.conduit.com/?CUI=UN15372992237491412&ctid=CT3241949&SearchSource=13");
Zeile gelöscht : user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=,hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CU[...]
Zeile gelöscht : user_pref("smartbar.defaultSearchOwnerCTID", "CT3241949");
Zeile gelöscht : user_pref("smartbar.homePageOwnerCTID", "CT3241949");
Zeile gelöscht : user_pref("smartbar.homepageList", "hxxp://search.conduit.com/?ctid=CT3241949&SearchSource=13,hxxp://search.conduit.com/?CUI=UN15372992237491412&ctid=CT3241949&SearchSource=13");
Zeile gelöscht : user_pref("smartbar.machineId", "PQUMFTJ/VQM9JLZIPHR/8U5RXKXTWYNBOKWF5JDOCXVMSTSULM7ICSCR1GAR11LHJI/2Y/AY+UVW69E955X6DQ");
Zeile gelöscht : user_pref("smartbar.originalHomepage", "hxxp://www1.delta-search.com/?affID=119556&tt=gc_&babsrc=HP_ss&mntrId=D48CF4CE46F0911D");
Zeile gelöscht : user_pref("smartbar.originalSearchAddressUrl", "chrome://unitedtb/content/search/keywordURL.xul?q=");
Zeile gelöscht : user_pref("smartbar.originalSearchEngine", "Ask.com");
Zeile gelöscht : user_pref("smartbar.searchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&q=,hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3241949&SearchSource=2&CUI=UN153[...]
Zeile gelöscht : user_pref("valueApps.CT3241949._key_cl_active", "39313861326561632D656339642D346436372D616134342D313030656562623539303062");
Zeile gelöscht : user_pref("valueApps.CT3241949._key_cl_active.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appStateReportTime", "31343039333331333232363630");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appStateReportTime.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Clarity_Active", "6F6E");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Clarity_Active.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_CouponBuddy", "6F6666");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_CouponBuddy.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Easytobook", "6F6666");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Easytobook.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Easytobook_targeted", "6F6666");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_Easytobook_targeted.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_PriceGong", "6F6666");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_PriceGong.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_WindowShopper", "6F6666");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appState_WindowShopper.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appsConfig.storedInFile", true);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appsDefaultEnabled", "6E756C6C");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_appsDefaultEnabled.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_calledSetupService", "31");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_calledSetupService.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_currentVersion", "312E31332E302E3137");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_currentVersion.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_existingUsersRecoveryDone", "31");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_existingUsersRecoveryDone.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_first_time", "31");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_first_time.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_lastLoginTime", "31343039333331333235353435");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_lastLoginTime.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_localization.storedInFile", true);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_mamEnabled", "66616C7365");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_mamEnabled.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_migrated_from_ls", "31");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_migrated_from_ls.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_new_welcome_experience", "31");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_new_welcome_experience.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_settings1.13.0.17.storedInFile", true);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_showWelcomeGadget", "66616C7365");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_showWelcomeGadget.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_stamp", "313130315F30");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_stamp.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_userBornDate", "4E2F41");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_userBornDate.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_userId", "33343734333036652D393665612D346338302D613761312D656261393333646262346636");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_userId.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_user_approval_interacted", "30");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_user_approval_interacted.storedInFile", false);
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_welcomeDialogMode", "30");
Zeile gelöscht : user_pref("valueApps.CT3241949.mam_gk_welcomeDialogMode.storedInFile", false);

*************************

AdwCleaner[R0].txt - [27847 octets] - [29/08/2014 21:50:22]
AdwCleaner[R1].txt - [27908 octets] - [29/08/2014 21:52:52]
AdwCleaner[S0].txt - [27299 octets] - [29/08/2014 21:53:58]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [27360 octets] ##########
JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by **** on 29.08.2014 at 22:05:16,96
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3228486621-4223541548-3929983969-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3228486621-4223541548-3929983969-1001\Software\web assistant
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B73C62F9-0383-4AFA-87A4-1D889C7B0B4D}



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\sho17C5.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho27DF.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho29CE.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho2D4.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho42BB.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho44A0.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho4947.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5742.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho5EF5.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho826A.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho8A50.tmp
Successfully deleted: [File] C:\Windows\syswow64\sho9920.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoA557.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoAD7D.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB346.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoB720.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoBB67.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoDD14.tmp
Successfully deleted: [File] C:\Windows\syswow64\shoFD36.tmp



~~~ Folders



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted the following from C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\ilgkx50a.default\prefs.js

user_pref("browser.startup.homepage", "hxxp://www.enhanced-search.com/?affID=119556&tt=gc_&babsrc=HP_ss_mib2&mntrId=D48CF4CE46F0911D");
Emptied folder: C:\Users\****\AppData\Roaming\mozilla\firefox\profiles\ilgkx50a.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29.08.2014 at 22:20:26,54
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-08-2014
Ran by **** (administrator) on ****-PC on 29-08-2014 22:22:17
Running from C:\Users\****\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\Tor\tor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\panelmgr\SSMMgr.exe [698984 2013-05-24] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-11] (Easybits)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-08-20] (Hewlett-Packard Company)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKCU - {55390F36-4471-4935-89A5-F40C3DEC5F90} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKCU - {D157F501-BD1E-4ECE-B34F-A1133BB42765} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin
SearchScopes: HKCU - {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: WEB.DE Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-03-23] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\1und1-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\mailcom-search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: preisspion.de - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\finder@meingutscheincode.de.xpi [2011-08-03]
FF Extension: WEB.DE MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\toolbar@web.de.xpi [2011-05-15]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2011-11-16]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NMSAccess; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [508464 2013-05-23] (Samsung Electronics Co., Ltd.)
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-08-27] () [File not signed]
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-02-23] (Samsung Electronics)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] () [File not signed]
S3 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [7168 2009-11-12] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-29 22:22 - 2014-08-29 22:22 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-08-29 22:20 - 2014-08-29 22:20 - 00002785 _____ () C:\Users\****\Desktop\JRT.txt
2014-08-29 22:05 - 2014-08-29 22:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-29 22:02 - 2014-08-29 22:03 - 01016261 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-08-29 21:50 - 2014-08-29 21:54 - 00000000 ____D () C:\AdwCleaner
2014-08-29 21:48 - 2014-08-29 21:48 - 01364531 _____ () C:\Users\****\Desktop\adwcleaner_3.308.exe
2014-08-29 19:45 - 2014-08-29 19:45 - 00038232 _____ () C:\Users\****\Desktop\mbam.txt
2014-08-29 19:02 - 2014-08-29 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-29 19:01 - 2014-08-29 19:01 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-29 19:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-29 19:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-29 18:59 - 2014-08-29 19:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-29 00:00 - 2014-08-29 00:00 - 00021146 _____ () C:\ComboFix.txt
2014-08-28 22:37 - 2014-08-29 00:01 - 00000000 ____D () C:\Qoobox
2014-08-28 22:37 - 2014-08-28 23:59 - 00000000 ____D () C:\Windows\erdnt
2014-08-28 22:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-28 22:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-28 22:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-28 22:35 - 2014-08-28 22:35 - 05574834 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2014-08-28 22:20 - 2014-08-28 22:20 - 00001234 _____ () C:\Users\****\Desktop\Revo Uninstaller.lnk
2014-08-28 22:20 - 2014-08-28 22:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-28 22:19 - 2014-08-28 22:19 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\****\Desktop\revosetup95.exe
2014-08-28 17:21 - 2014-08-28 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-28 17:21 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-28 17:21 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-28 17:21 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-28 17:21 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-28 17:20 - 2014-08-28 17:21 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-28 17:08 - 2014-08-28 17:08 - 00005895 _____ () C:\Users\****\Desktop\gmer.txt
2014-08-28 16:12 - 2014-08-28 16:12 - 533492102 _____ () C:\Windows\MEMORY.DMP
2014-08-28 16:12 - 2014-08-28 16:12 - 00276424 _____ () C:\Windows\Minidump\082814-19032-01.dmp
2014-08-28 16:12 - 2014-08-28 16:12 - 00000000 ____D () C:\Windows\Minidump
2014-08-28 16:01 - 2014-08-28 16:01 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-08-28 15:57 - 2014-08-28 15:59 - 00040298 _____ () C:\Users\****\Desktop\Addition.txt
2014-08-28 15:55 - 2014-08-29 22:22 - 00016633 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-28 15:55 - 2014-08-29 22:22 - 00000000 ____D () C:\FRST
2014-08-28 15:54 - 2014-08-29 22:22 - 02103808 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-28 15:49 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 15:49 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 15:49 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-23 12:30 - 2014-08-23 12:51 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-17 13:19 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-17 13:19 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-17 13:19 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-17 13:19 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-17 13:18 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-17 13:18 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-17 10:54 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-17 10:54 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-17 10:54 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-17 10:53 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-17 10:53 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-17 10:53 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-17 10:53 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-17 10:53 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-17 10:53 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-17 10:53 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-17 10:53 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-17 10:53 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-17 10:53 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-17 10:53 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-17 10:53 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-17 10:53 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-17 10:53 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-17 10:53 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-17 10:53 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-17 10:53 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-17 10:53 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-17 10:53 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-17 10:53 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-17 10:53 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-17 10:53 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-17 10:53 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-17 10:51 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-17 10:51 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-17 10:51 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-17 10:51 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 00:33 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 00:33 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 00:33 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 00:33 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 00:33 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-29 22:24 - 2014-08-28 15:55 - 00016633 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-29 22:22 - 2014-08-29 22:22 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-08-29 22:22 - 2014-08-28 15:55 - 00000000 ____D () C:\FRST
2014-08-29 22:22 - 2014-08-28 15:54 - 02103808 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-29 22:21 - 2010-07-08 21:02 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C520D87-8FBF-4B53-930F-24CA574869F3}
2014-08-29 22:20 - 2014-08-29 22:20 - 00002785 _____ () C:\Users\****\Desktop\JRT.txt
2014-08-29 22:18 - 2010-03-23 14:28 - 02088449 _____ () C:\Windows\WindowsUpdate.log
2014-08-29 22:10 - 2013-11-05 19:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-29 22:07 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-29 22:07 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-29 22:05 - 2014-08-29 22:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-29 22:03 - 2014-08-29 22:02 - 01016261 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-08-29 22:00 - 2011-03-21 18:42 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-29 22:00 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-29 21:59 - 2009-07-14 06:51 - 00135473 _____ () C:\Windows\setupact.log
2014-08-29 21:55 - 2010-03-23 18:04 - 00462254 _____ () C:\Windows\PFRO.log
2014-08-29 21:54 - 2014-08-29 21:50 - 00000000 ____D () C:\AdwCleaner
2014-08-29 21:48 - 2014-08-29 21:48 - 01364531 _____ () C:\Users\****\Desktop\adwcleaner_3.308.exe
2014-08-29 21:48 - 2011-12-27 15:18 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-08-29 21:48 - 2011-03-21 18:42 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-29 19:45 - 2014-08-29 19:45 - 00038232 _____ () C:\Users\****\Desktop\mbam.txt
2014-08-29 19:42 - 2013-11-05 19:41 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-29 19:42 - 2013-11-05 19:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-29 19:42 - 2011-08-19 13:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-29 19:40 - 2014-08-29 19:02 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-29 19:16 - 2010-07-08 14:00 - 00177152 ___SH () C:\Users\****\Thumbs.db
2014-08-29 19:01 - 2014-08-29 19:01 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-29 19:00 - 2014-08-29 18:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-29 00:01 - 2014-08-28 22:37 - 00000000 ____D () C:\Qoobox
2014-08-29 00:00 - 2014-08-29 00:00 - 00021146 _____ () C:\ComboFix.txt
2014-08-28 23:59 - 2014-08-28 22:37 - 00000000 ____D () C:\Windows\erdnt
2014-08-28 23:54 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-28 23:53 - 2009-07-14 04:34 - 73138176 _____ () C:\Windows\system32\config\software.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 14680064 _____ () C:\Windows\system32\config\system.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-08-28 23:52 - 2010-07-06 11:28 - 00000000 ____D () C:\Users\****
2014-08-28 22:35 - 2014-08-28 22:35 - 05574834 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2014-08-28 22:27 - 2010-07-13 16:31 - 00000000 ____D () C:\Users\****\AppData\Local\CrashDumps
2014-08-28 22:20 - 2014-08-28 22:20 - 00001234 _____ () C:\Users\****\Desktop\Revo Uninstaller.lnk
2014-08-28 22:20 - 2014-08-28 22:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-28 22:19 - 2014-08-28 22:19 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\****\Desktop\revosetup95.exe
2014-08-28 22:15 - 2009-07-14 06:45 - 00371136 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 17:22 - 2013-10-29 09:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-28 17:21 - 2014-08-28 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-28 17:21 - 2014-08-28 17:20 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-28 17:21 - 2013-07-05 21:45 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-28 17:08 - 2014-08-28 17:08 - 00005895 _____ () C:\Users\****\Desktop\gmer.txt
2014-08-28 16:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-28 16:12 - 2014-08-28 16:12 - 533492102 _____ () C:\Windows\MEMORY.DMP
2014-08-28 16:12 - 2014-08-28 16:12 - 00276424 _____ () C:\Windows\Minidump\082814-19032-01.dmp
2014-08-28 16:12 - 2014-08-28 16:12 - 00000000 ____D () C:\Windows\Minidump
2014-08-28 16:01 - 2014-08-28 16:01 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-08-28 15:59 - 2014-08-28 15:57 - 00040298 _____ () C:\Users\****\Desktop\Addition.txt
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-27 19:10 - 2011-11-15 16:52 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-08-27 19:10 - 2010-10-06 18:43 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-08-23 18:57 - 2013-05-14 17:55 - 00000099 _____ () C:\Users\Public\LMDebug.log
2014-08-23 13:04 - 2014-03-04 13:32 - 00000000 ____D () C:\Users\****\Desktop\Risszeichnungen
2014-08-23 13:04 - 2013-09-28 11:55 - 00000000 ____D () C:\Users\****\Desktop\RHODAN
2014-08-23 13:01 - 2013-11-24 20:42 - 00000000 ____D () C:\Users\****\Desktop\SCANNER
2014-08-23 12:51 - 2014-08-23 12:30 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-23 12:31 - 2013-05-28 21:04 - 00000000 ____D () C:\Users\****\Desktop\TECHNICAL CUTAWAYS
2014-08-23 04:07 - 2014-08-28 15:49 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 15:49 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 15:49 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-21 21:35 - 2012-02-11 12:39 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2014-08-21 21:35 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-21 20:28 - 2013-05-27 22:01 - 00000000 ___RD () C:\Users\****\Desktop\VATI
2014-08-18 01:00 - 2013-08-14 23:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-18 00:57 - 2010-07-10 15:49 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-17 22:44 - 2010-03-24 02:56 - 00699884 _____ () C:\Windows\system32\perfh007.dat
2014-08-17 22:44 - 2010-03-24 02:56 - 00149766 _____ () C:\Windows\system32\perfc007.dat
2014-08-17 22:44 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-17 21:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-17 18:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-17 13:18 - 2014-05-06 21:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-17 13:17 - 2011-11-26 11:39 - 00000000 ____D () C:\Users\****\AppData\Roaming\SoftGrid Client
2014-08-07 22:18 - 2011-12-27 15:18 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-07 22:18 - 2011-04-02 11:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-07 04:06 - 2014-08-17 10:51 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-17 10:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-17 10:53 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-17 10:53 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

Files to move or delete:
====================
C:\Users\****\mseinstall.exe


Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-17 21:11

==================== End Of Log ============================
--- --- ---

schrauber 30.08.2014 07:23

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Nameegal 31.08.2014 09:36
Done.

ESET:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=4383a81ea63c2d4093d31406fb2d6d63
# engine=19918
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-08-30 10:52:17
# local_time=2014-08-31 12:52:17 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 12739069 50752453 0 0
# scanned=100111
# found=9
# cleaned=0
# scan_time=22011
sh=B63DF79D0FEEFCF492C31D62FFC2F74466D1A149 ft=1 fh=99d7ddb65e37fad9 vn="Variante von Win32/Toolbar.BitCocktail.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\InstallerHelper.dll.vir"
sh=0B2BAB24A0AE630E6802A54F8A03DE1CA2A659E6 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\source.crx.vir"
sh=50FE7F379E00797C34CBE973A8DCD8C96612CE8D ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\Firefox\chrome\content\main.js.vir"
sh=8C4EBEFA00C5146974AFA68BE39D3923D8453C20 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\Firefox\chrome\content\resources\localscript.js.vir"
sh=8C4EBEFA00C5146974AFA68BE39D3923D8453C20 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Perion.E evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Web Assistant\resources\localscript.js.vir"
sh=108A500E4A188882CBA720723607F417A6501924 ft=1 fh=5c9da47200740b7c vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee}\ctypes\FirefoxCtype.dll.vir"
sh=C015E890715621E6FF97D3BF893BC75E8E27DE77 ft=1 fh=3ad6b33bccff1099 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\{78e516ef-11de-47a1-8364-a99b917ec5ee}\Plugins\npFirefoxPlugin.dll.vir"
sh=B27AA1F8303815E20CE148744957CB3726BCDE96 ft=1 fh=e7bb97c341e31fcc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Config.Msi\236eb.rbf"
sh=B219AEE99BA9F9EB0BCB767ACA44F8D297DD31D3 ft=1 fh=4cbf94f0439649e0 vn="Variante von Win64/Toolbar.Perion.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files\Web Assistant\ExTEnsion64.dll.vir"
SecurityCheck:

Code:
Results of screen317's Security Check version 0.99.87 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java 7 Update 67 
 Adobe Flash Player 14.0.0.179 
 Adobe Reader XI 
 Mozilla Firefox (31.0)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
FRST:

Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-08-2014
Ran by **** (administrator) on ****-PC on 31-08-2014 10:09:35
Running from C:\Users\****\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
() C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\Tor\tor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
(Easybits) C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [PC-Doctor for Windows localizer] => C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-12-01] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\panelmgr\SSMMgr.exe [698984 2013-05-24] ()
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1243656 2013-12-11] (Easybits)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-08-20] (Hewlett-Packard Company)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3228486621-4223541548-3929983969-1001\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {09038620-190C-402B-A92F-18864E6AB22F} URL = hxxp://go.1und1.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {40064957-18EB-412d-9146-3F57E8D92EEC} URL = hxxp://go.web.de/br/ie9_search_pic/?su={searchTerms}
SearchScopes: HKCU - {55390F36-4471-4935-89A5-F40C3DEC5F90} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {5A817CF6-92D5-4DE5-AC38-82DF8A73EF28} URL = hxxp://go.gmx.net/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {6B1D1FB7-7233-4F7C-802C-21A1DDB12754} URL = hxxp://go.web.de/br/ie9_search_web/?su={searchTerms}
SearchScopes: HKCU - {8D27B32E-89EE-460e-82D2-5FC354078EAD} URL = hxxp://go.web.de/br/ie9_search_produkte/?su={searchTerms}
SearchScopes: HKCU - {D157F501-BD1E-4ECE-B34F-A1133BB42765} URL = hxxp://suche.web.de/search/web/?su={searchTerms}&origin=searchplugin
SearchScopes: HKCU - {DCE59F23-A446-45a5-9459-E68FDC0DE38D} URL = hxxp://go.web.de/br/ie9_search_maps/?su={searchTerms}
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: WEB.DE Konfiguration -> {17166733-40EA-4432-A85C-AE672FF0E236} -> C:\ProgramData\1und1InternetExplorerAddon\BHOXML.dll (1&1 Mail & Media GmbH)
BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} ->  No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-03-23] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper -> C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\1und1-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\mailcom-search.xml
FF SearchPlugin: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WEB.DE MailCheck - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\toolbar@web.de [2014-08-29]
FF Extension: preisspion.de - C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\ilgkx50a.default\Extensions\finder@meingutscheincode.de.xpi [2011-08-03]
FF Extension: Modul zur Link-Untersuchung - C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2 [2011-11-16]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezsvc7.dll [129584 2009-02-22] (EasyBits Sofware AS) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-08-20] (Hewlett-Packard Company) [File not signed]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 NMSAccess; C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [508464 2013-05-23] (Samsung Electronics Co., Ltd.)
R2 tor; C:\Program Files (x86)\Tor\tor.exe [3233806 2013-08-27] () [File not signed]
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-02-23] (Samsung Electronics)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [5504 2009-11-12] () [File not signed]
S3 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [7168 2009-11-12] () [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-31 09:52 - 2014-08-31 09:52 - 00854417 _____ () C:\Users\****\Desktop\SecurityCheck.exe
2014-08-29 22:42 - 2014-08-29 22:42 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-29 22:38 - 2014-08-29 22:39 - 32657592 _____ () C:\Users\****\Downloads\WEB.DE_Firefox_Setup(3).exe
2014-08-29 22:35 - 2014-08-29 22:37 - 00000193 _____ () C:\Windows\WORDPAD.INI
2014-08-29 22:22 - 2014-08-29 22:22 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-08-29 22:20 - 2014-08-29 22:20 - 00002785 _____ () C:\Users\****\Desktop\JRT.txt
2014-08-29 22:05 - 2014-08-29 22:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-29 22:02 - 2014-08-29 22:03 - 01016261 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-08-29 21:50 - 2014-08-29 21:54 - 00000000 ____D () C:\AdwCleaner
2014-08-29 21:48 - 2014-08-29 21:48 - 01364531 _____ () C:\Users\****\Desktop\adwcleaner_3.308.exe
2014-08-29 19:45 - 2014-08-29 19:45 - 00038232 _____ () C:\Users\****\Desktop\mbam.txt
2014-08-29 19:02 - 2014-08-29 19:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-29 19:01 - 2014-08-29 19:01 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-29 19:01 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-29 19:01 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-29 18:59 - 2014-08-29 19:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-29 00:00 - 2014-08-29 00:00 - 00021146 _____ () C:\ComboFix.txt
2014-08-28 22:37 - 2014-08-29 00:01 - 00000000 ____D () C:\Qoobox
2014-08-28 22:37 - 2014-08-28 23:59 - 00000000 ____D () C:\Windows\erdnt
2014-08-28 22:37 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-28 22:37 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-28 22:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-28 22:37 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-28 22:35 - 2014-08-28 22:35 - 05574834 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2014-08-28 22:20 - 2014-08-28 22:20 - 00001234 _____ () C:\Users\****\Desktop\Revo Uninstaller.lnk
2014-08-28 22:20 - 2014-08-28 22:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-28 22:19 - 2014-08-28 22:19 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\****\Desktop\revosetup95.exe
2014-08-28 17:21 - 2014-08-28 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-28 17:21 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-08-28 17:21 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-08-28 17:21 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-08-28 17:21 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-08-28 17:20 - 2014-08-28 17:21 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-28 17:08 - 2014-08-28 17:08 - 00005895 _____ () C:\Users\****\Desktop\gmer.txt
2014-08-28 16:12 - 2014-08-28 16:12 - 533492102 _____ () C:\Windows\MEMORY.DMP
2014-08-28 16:12 - 2014-08-28 16:12 - 00276424 _____ () C:\Windows\Minidump\082814-19032-01.dmp
2014-08-28 16:12 - 2014-08-28 16:12 - 00000000 ____D () C:\Windows\Minidump
2014-08-28 16:01 - 2014-08-28 16:01 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-08-28 15:57 - 2014-08-28 15:59 - 00040298 _____ () C:\Users\****\Desktop\Addition.txt
2014-08-28 15:55 - 2014-08-31 10:09 - 00016661 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-28 15:55 - 2014-08-31 10:09 - 00000000 ____D () C:\FRST
2014-08-28 15:54 - 2014-08-29 22:22 - 02103808 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-28 15:49 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 15:49 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 15:49 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-23 12:30 - 2014-08-23 12:51 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-17 13:19 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-17 13:19 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-17 13:19 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-17 13:19 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-17 13:19 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-17 13:18 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-17 13:18 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-17 10:54 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-17 10:54 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-17 10:54 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-17 10:54 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-17 10:54 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-17 10:53 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-17 10:53 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-17 10:53 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-17 10:53 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-17 10:53 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-17 10:53 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-17 10:53 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-17 10:53 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-17 10:53 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-17 10:53 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-17 10:53 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-17 10:53 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-17 10:53 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-17 10:53 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-17 10:53 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-17 10:53 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-17 10:53 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-17 10:53 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-17 10:53 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-17 10:53 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-17 10:53 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-17 10:53 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-17 10:53 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-17 10:53 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-17 10:53 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-17 10:53 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-17 10:53 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-17 10:53 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-17 10:53 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-17 10:53 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-17 10:53 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-17 10:53 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-17 10:53 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-17 10:53 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-17 10:53 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-17 10:53 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-17 10:53 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-17 10:53 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-17 10:53 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-17 10:53 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-17 10:51 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-17 10:51 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-17 10:51 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-17 10:51 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 00:33 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 00:33 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 00:33 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 00:33 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 00:33 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 00:33 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 00:33 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-31 10:10 - 2014-08-28 15:55 - 00016661 _____ () C:\Users\****\Desktop\FRST.txt
2014-08-31 10:10 - 2013-11-05 19:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-08-31 10:09 - 2014-08-28 15:55 - 00000000 ____D () C:\FRST
2014-08-31 09:56 - 2010-03-23 14:28 - 01145854 _____ () C:\Windows\WindowsUpdate.log
2014-08-31 09:52 - 2014-08-31 09:52 - 00854417 _____ () C:\Users\****\Desktop\SecurityCheck.exe
2014-08-31 09:44 - 2010-07-06 11:38 - 00000544 _____ () C:\Windows\Tasks\PCDRScheduledMaintenance.job
2014-08-31 09:43 - 2011-03-21 18:42 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-31 08:46 - 2011-12-27 15:18 - 00000000 ____D () C:\Users\****\AppData\Roaming\Skype
2014-08-31 08:32 - 2010-07-08 21:02 - 00003978 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{4C520D87-8FBF-4B53-930F-24CA574869F3}
2014-08-30 18:38 - 2011-03-21 18:42 - 00001116 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-30 18:38 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-30 18:38 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-30 18:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-30 18:30 - 2009-07-14 06:51 - 00135585 _____ () C:\Windows\setupact.log
2014-08-30 09:04 - 2012-04-28 12:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-08-29 22:42 - 2014-08-29 22:42 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-08-29 22:42 - 2011-04-02 11:29 - 00000000 ____D () C:\Users\****\AppData\Local\Mozilla
2014-08-29 22:42 - 2011-04-02 11:28 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-08-29 22:41 - 2011-04-02 11:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-08-29 22:39 - 2014-08-29 22:38 - 32657592 _____ () C:\Users\****\Downloads\WEB.DE_Firefox_Setup(3).exe
2014-08-29 22:37 - 2014-08-29 22:35 - 00000193 _____ () C:\Windows\WORDPAD.INI
2014-08-29 22:22 - 2014-08-29 22:22 - 00000000 ____D () C:\Users\****\Desktop\FRST-OlderVersion
2014-08-29 22:22 - 2014-08-28 15:54 - 02103808 _____ (Farbar) C:\Users\****\Desktop\FRST64.exe
2014-08-29 22:20 - 2014-08-29 22:20 - 00002785 _____ () C:\Users\****\Desktop\JRT.txt
2014-08-29 22:05 - 2014-08-29 22:05 - 00000000 ____D () C:\Windows\ERUNT
2014-08-29 22:03 - 2014-08-29 22:02 - 01016261 _____ (Thisisu) C:\Users\****\Desktop\JRT.exe
2014-08-29 21:55 - 2010-03-23 18:04 - 00462254 _____ () C:\Windows\PFRO.log
2014-08-29 21:54 - 2014-08-29 21:50 - 00000000 ____D () C:\AdwCleaner
2014-08-29 21:48 - 2014-08-29 21:48 - 01364531 _____ () C:\Users\****\Desktop\adwcleaner_3.308.exe
2014-08-29 19:45 - 2014-08-29 19:45 - 00038232 _____ () C:\Users\****\Desktop\mbam.txt
2014-08-29 19:42 - 2013-11-05 19:41 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-08-29 19:42 - 2013-11-05 19:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-08-29 19:42 - 2011-08-19 13:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-08-29 19:40 - 2014-08-29 19:02 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-29 19:16 - 2010-07-08 14:00 - 00177152 ___SH () C:\Users\****\Thumbs.db
2014-08-29 19:01 - 2014-08-29 19:01 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-29 19:01 - 2014-08-29 19:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-29 19:00 - 2014-08-29 18:59 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\****\Desktop\mbam-setup-2.0.2.1012.exe
2014-08-29 00:01 - 2014-08-28 22:37 - 00000000 ____D () C:\Qoobox
2014-08-29 00:00 - 2014-08-29 00:00 - 00021146 _____ () C:\ComboFix.txt
2014-08-28 23:59 - 2014-08-28 22:37 - 00000000 ____D () C:\Windows\erdnt
2014-08-28 23:54 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-28 23:53 - 2009-07-14 04:34 - 73138176 _____ () C:\Windows\system32\config\software.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 14680064 _____ () C:\Windows\system32\config\system.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00524288 _____ () C:\Windows\system32\config\default.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak
2014-08-28 23:53 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak
2014-08-28 23:52 - 2010-07-06 11:28 - 00000000 ____D () C:\Users\****
2014-08-28 22:35 - 2014-08-28 22:35 - 05574834 ____R (Swearware) C:\Users\****\Desktop\ComboFix.exe
2014-08-28 22:27 - 2010-07-13 16:31 - 00000000 ____D () C:\Users\****\AppData\Local\CrashDumps
2014-08-28 22:20 - 2014-08-28 22:20 - 00001234 _____ () C:\Users\****\Desktop\Revo Uninstaller.lnk
2014-08-28 22:20 - 2014-08-28 22:20 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-08-28 22:19 - 2014-08-28 22:19 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\****\Desktop\revosetup95.exe
2014-08-28 22:15 - 2009-07-14 06:45 - 00371136 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 17:22 - 2013-10-29 09:37 - 00000000 ____D () C:\ProgramData\Oracle
2014-08-28 17:21 - 2014-08-28 17:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-08-28 17:21 - 2014-08-28 17:20 - 00004623 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-08-28 17:21 - 2013-07-05 21:45 - 00000000 ____D () C:\Program Files (x86)\Java
2014-08-28 17:08 - 2014-08-28 17:08 - 00005895 _____ () C:\Users\****\Desktop\gmer.txt
2014-08-28 16:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-28 16:12 - 2014-08-28 16:12 - 533492102 _____ () C:\Windows\MEMORY.DMP
2014-08-28 16:12 - 2014-08-28 16:12 - 00276424 _____ () C:\Windows\Minidump\082814-19032-01.dmp
2014-08-28 16:12 - 2014-08-28 16:12 - 00000000 ____D () C:\Windows\Minidump
2014-08-28 16:01 - 2014-08-28 16:01 - 00380416 _____ () C:\Users\****\Desktop\Gmer-19357.exe
2014-08-28 15:59 - 2014-08-28 15:57 - 00040298 _____ () C:\Users\****\Desktop\Addition.txt
2014-08-28 15:53 - 2014-08-28 15:53 - 00000484 _____ () C:\Users\****\Desktop\defogger_disable.log
2014-08-28 15:53 - 2014-08-28 15:53 - 00000000 _____ () C:\Users\****\defogger_reenable
2014-08-28 15:52 - 2014-08-28 15:52 - 00050477 _____ () C:\Users\****\Desktop\Defogger.exe
2014-08-27 19:10 - 2011-11-15 16:52 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-08-27 19:10 - 2010-10-06 18:43 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-08-23 18:57 - 2013-05-14 17:55 - 00000099 _____ () C:\Users\Public\LMDebug.log
2014-08-23 13:04 - 2014-03-04 13:32 - 00000000 ____D () C:\Users\****\Desktop\Risszeichnungen
2014-08-23 13:04 - 2013-09-28 11:55 - 00000000 ____D () C:\Users\****\Desktop\RHODAN
2014-08-23 13:01 - 2013-11-24 20:42 - 00000000 ____D () C:\Users\****\Desktop\SCANNER
2014-08-23 12:51 - 2014-08-23 12:30 - 00000000 ____D () C:\Users\****\Desktop\SF-CUTAWAYS
2014-08-23 12:31 - 2013-05-28 21:04 - 00000000 ____D () C:\Users\****\Desktop\TECHNICAL CUTAWAYS
2014-08-23 04:07 - 2014-08-28 15:49 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-23 03:45 - 2014-08-28 15:49 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-23 02:59 - 2014-08-28 15:49 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-21 21:35 - 2014-08-21 21:35 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-08-21 21:35 - 2012-02-11 12:39 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2014-08-21 21:35 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-08-21 20:28 - 2013-05-27 22:01 - 00000000 ___RD () C:\Users\****\Desktop\VATI
2014-08-18 01:00 - 2013-08-14 23:33 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-18 00:57 - 2010-07-10 15:49 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-17 22:44 - 2010-03-24 02:56 - 00699884 _____ () C:\Windows\system32\perfh007.dat
2014-08-17 22:44 - 2010-03-24 02:56 - 00149766 _____ () C:\Windows\system32\perfc007.dat
2014-08-17 22:44 - 2009-07-14 07:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-17 21:19 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-08-17 18:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-17 13:18 - 2014-05-06 21:39 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-17 13:17 - 2011-11-26 11:39 - 00000000 ____D () C:\Users\****\AppData\Roaming\SoftGrid Client
2014-08-07 22:18 - 2011-12-27 15:18 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-07 04:06 - 2014-08-17 10:51 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-17 10:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-01 01:41 - 2014-08-17 10:53 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-17 10:53 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

Files to move or delete:
====================
C:\Users\****\mseinstall.exe


Some content of TEMP:
====================
C:\Users\****\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-17 21:11
Jetzt läuft alles schon viel besser, die Webseiten öffnen sich viel schneller und die Popups Verlinkungen & Co. sind auch weg.
Eine Frage hätte ich aber noch: In den letzten Tagen (seit ich die Scanprogramme habe durchlaufen lassen) habe ich mehr Firefox als Internet Explorer verwendet, weil ich gehört habe, dass das sicherer sei. Wenn ich jetzt wieder auf Internet Explorer gehe, sehe ich erstens nicht mehr die Google-Suchleiste auf der Startseite (obwohl in der Adresszeile "www.google.com" steht) und zweitens erscheint, wenn ich auf meine Favoriten klicke, in den meisten Fällen nur "The object has moved to here." ("here" verlinkt). Wenn ich dann auf "here" klicke, passiert nichts. Hat das was mit den Scans zu tun, mit Firefox oder ist das ein Internet-Explorer-interner Fehler? Und hast du eine Idee, wie man das wieder so einstellen kann wie davor? Da ich auf Firefox keine "Favoriten" finde, würde ich für den Fall dann doch lieber Internet Explorer weiterverwenden.
Ansonsten bin ich aber schon hochzufrieden mit den Ergebnissen der Scanprogramme. Vielen Dank schonmal bis hierhin! :) Ich hoffe, es gibt nicht mehr viel, was noch gescannt werden muss.

schrauber 31.08.2014 17:02
Setze folgendermassen den Internet Explorer zurück:
  • Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
  • Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
  • Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.
(Hier findest du die bebilderte Anleitung.)

Nameegal 31.08.2014 19:52
Super, hat geklappt! :) Sind wir damit fertig oder gibt's noch was zu tun von wegen Scans oder so?

schrauber 01.09.2014 12:36
Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Nameegal 01.09.2014 16:53
:dankeschoen:
Alles erledigt und problemlos über die Bühne gegangen! Ich bin wunschlos glücklich! :) Vielen herzlichen Dank für deine tatkräftige Unterstützung! Ich bin froh, dass es Leute wie euch gibt. :) Wenn ich mal wieder Probleme mit der Kiste haben sollte, weiß ich auf jeden Fall, wo ich mir Hilfe hole, hoffe allerdings, das wird nicht so bald wieder nötig sein. ;)
Dir und euch allen alles Gute weiterhin und macht weiter so! :)

schrauber 02.09.2014 11:52
Gern Geschehen :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:07 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55