Und zum Schluß noch vom dritten Rechner: Code:
# AdwCleaner v3.208 - Bericht erstellt am 14/05/2014 um 11:31:45
# Aktualisiert 11/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Stefan - STEFANHEUSER
# Gestartet von : C:\Users\Stefan\Desktop\3adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\MediaWatchV1
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\VideoPlayerV3
Ordner Gelöscht : C:\Users\Stefan\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\goforfiles
Ordner Gelöscht : C:\Users\Stefan\AppData\Roaming\Systweak
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\invalidprefs.js
Datei Gelöscht : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\user.js
Datei Gelöscht : C:\Windows\Tasks\Digital Sites.job
Datei Gelöscht : C:\Windows\System32\Tasks\Digital Sites
Datei Gelöscht : C:\Windows\System32\Tasks\GoforFilesUpdate
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Updater.AmiUpd
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6DDA37BA-0553-499A-AE0D-BEBA67204548}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{92E5039E-FF1E-4AFB-8F24-87592D20C383}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : HKCU\Software\BabSolution
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\GoforFiles
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\GoforFiles
Schlüssel Gelöscht : HKLM\Software\systweak
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17041
-\\ Mozilla Firefox v29.0.1 (de)
[ Datei : C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.delta.admin", false);
Zeile gelöscht : user_pref("extensions.delta.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
Zeile gelöscht : user_pref("extensions.delta.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.delta.excTlbr", false);
Zeile gelöscht : user_pref("extensions.delta.ffxUnstlRst", true);
Zeile gelöscht : user_pref("extensions.delta.id", "cee0f7ca000000000000506313dedf0f");
Zeile gelöscht : user_pref("extensions.delta.instlDay", "15972");
Zeile gelöscht : user_pref("extensions.delta.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.delta.newTab", false);
Zeile gelöscht : user_pref("extensions.delta.prdct", "delta");
Zeile gelöscht : user_pref("extensions.delta.prtnrId", "delta");
Zeile gelöscht : user_pref("extensions.delta.rvrt", "false");
Zeile gelöscht : user_pref("extensions.delta.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.delta.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.delta.tlbrSrchUrl", "");
Zeile gelöscht : user_pref("extensions.delta.vrsn", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta.vrsnTs", "1.8.24.610:09:15");
Zeile gelöscht : user_pref("extensions.delta.vrsni", "1.8.24.6");
Zeile gelöscht : user_pref("extensions.delta_i.babExt", "");
Zeile gelöscht : user_pref("extensions.delta_i.babTrack", "affID=119357&tt=160913_m3&tsp=5015");
Zeile gelöscht : user_pref("extensions.delta_i.srcExt", "ss");
*************************
AdwCleaner[R0].txt - [6414 octets] - [14/05/2014 11:28:41]
AdwCleaner[R1].txt - [6474 octets] - [14/05/2014 11:30:49]
AdwCleaner[S0].txt - [5936 octets] - [14/05/2014 11:31:45]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5996 octets] ##########
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01
Ran by Stefan (administrator) on STEFANHEUSER on 14-05-2014 11:56:48
Running from C:\Users\Stefan\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ABBYY) C:\Program Files (x86)\convert+share\ABBYY\LicensingService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Scanshare B.V.) C:\Program Files (x86)\convert+share\NetworkService.exe
(Scanshare B.V.) C:\Program Files (x86)\convert+share\OAService.exe
(Scanshare B.V.) C:\Program Files (x86)\convert+share\ProcessService.exe
() C:\Program Files\MFP-Printer Utility\Enterprise Suite\bin\Release\PSESCoreScheduler.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Apache Software Foundation) C:\MagicInfo Lite\tomcat\bin\tomcat6.exe
() C:\MagicInfo Lite\bin\srvany.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\pg_ctl.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\9.2\bin\postgres.exe
() C:\MagicInfo Lite\bin\srvany.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
( ) C:\MagicInfo Lite\bin\distributer.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Spotify Ltd) C:\Users\Stefan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avpui.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(PostgreSQL Global Development Group) C:\Program Files (x86)\PostgreSQL\8.3\bin\postgres.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
() C:\Program Files\MFP-Printer Utility\Enterprise Suite\Plugin\Prof\KmProfService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Samsung Electronics.) C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Java\jre7\bin\jusched.exe"
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [385024 2009-09-05] (shbox.de)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BrStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3697776 2012-06-21] (brother)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-06-20] (Microsoft Corporation)
HKU\S-1-5-21-778539726-1508035087-141682171-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-778539726-1508035087-141682171-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-778539726-1508035087-141682171-1000\...\Run: [Spotify Web Helper] => C:\Users\Stefan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-08] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Program Files (x86)\Samsung Magician\Samsung Magician.exe (Samsung Electronics.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {7CA2114F-56B7-4321-8B1F-37F9B785C178} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC
SearchScopes: HKCU - {8BB7C53E-D0BE-4BC4-9826-9D9CE55D5839} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {D6DDDB5E-7FC1-4783-8529-166343F002F4} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: 卡巴斯基網址顧問 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\url_advisor@kaspersky.com [2014-05-09]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: 虛擬鍵盤 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-05-09]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: 惡意網站攔截器 - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\content_blocker@kaspersky.com [2014-05-09]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\anti_banner@kaspersky.com [2014-05-09]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\FFExt\online_banking@kaspersky.com [2014-05-09]
==================== Services (Whitelisted) =================
R2 ABBYY.Licensing.FineReaderEngine.Windows.10.0; C:\Program Files (x86)\convert+share\ABBYY\LicensingService.exe [1170896 2014-02-05] (ABBYY)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [109056 2009-02-06] (ArcSoft Inc.)
R2 avp; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [214512 2013-10-17] (Kaspersky Lab ZAO)
R2 DVNetwork; C:\Program Files (x86)\convert+share\NetworkService.exe [19456 2014-02-05] (Scanshare B.V.)
R2 DVOAService; C:\Program Files (x86)\convert+share\OAService.exe [18432 2014-02-05] (Scanshare B.V.)
R2 DVProcess; C:\Program Files (x86)\convert+share\ProcessService.exe [18944 2014-02-05] (Scanshare B.V.)
R2 Enterprise Suite Service; C:\Program Files\MFP-Printer Utility\Enterprise Suite\bin\Release\PSESCoreScheduler.exe [51712 2013-05-24] ()
S4 Enterprise Suite Terminal Service; C:\Program Files\MFP-Printer Utility\Enterprise Suite\ESC\bin\wrapper.exe [233984 2011-10-07] (Tanuki Software, Ltd.)
R2 MagicInfoPremium; C:\MagicInfo Lite\tomcat\\bin\tomcat6.exe [57344 2008-07-22] (Apache Software Foundation)
R2 MagicInfoStreamDaemon; C:\MagicInfo Lite\bin\srvany.exe [8464 1998-11-22] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [43028328 2011-09-22] (Microsoft Corporation)
R2 My Panel Manager Service; C:\Program Files\MFP-Printer Utility\Enterprise Suite\Plugin\Prof\KmProfService.exe [8704 2013-02-12] ()
R2 pgsql-8.3; C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [65536 2010-10-04] (PostgreSQL Global Development Group)
S3 Primary Server Monitor; C:\Program Files\MFP-Printer Utility\Enterprise Suite\bin\Release\PSESPrimaryServerMonitor.exe [30720 2013-05-24] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [370024 2011-09-22] (Microsoft Corporation)
R2 UltraVNCRepeater; C:\MagicInfo Lite\bin\srvany.exe [8464 1998-11-22] ()
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1369136 2013-09-25] (Sony Corporation)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)
S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-14] (Microsoft Corporation)
R2 postgresql-9.2; C:/Program Files (x86)/PostgreSQL/9.2/bin/pg_ctl.exe runservice -N "postgresql-9.2" -D "C:/Program Files (x86)/PostgreSQL/9.2/data" -w [X]
==================== Drivers (Whitelisted) ====================
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2014-05-09] (Kaspersky Lab ZAO)
S4 klflt; C:\Windows\System32\DRIVERS\klflt.sys [115296 2014-05-09] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [625248 2014-05-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-10-17] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2014-05-09] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-10-17] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2013-05-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178272 2014-05-09] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-05-14 11:56 - 2014-05-14 11:56 - 02066944 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe
2014-05-14 11:56 - 2014-05-14 11:56 - 00021787 _____ () C:\Users\Stefan\Desktop\FRST.txt
2014-05-14 11:36 - 2014-05-14 11:36 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 11:36 - 2014-05-14 11:35 - 01016261 _____ (Thisisu) C:\Users\Stefan\Desktop\4JRT.exe
2014-05-14 11:28 - 2014-05-14 11:31 - 00000000 ____D () C:\AdwCleaner
2014-05-14 11:27 - 2014-05-14 11:23 - 01325827 _____ () C:\Users\Stefan\Desktop\3adwcleaner.exe
2014-05-14 10:59 - 2014-05-14 11:34 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-14 10:59 - 2014-05-14 10:59 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 10:59 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-05-14 10:59 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-14 10:59 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-05-14 10:46 - 2014-05-14 10:46 - 00001264 _____ () C:\Users\Stefan\Desktop\Revo Uninstaller.lnk
2014-05-14 10:46 - 2014-05-14 10:46 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-14 10:44 - 2014-05-14 10:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Stefan\Downloads\1revosetup95.exe
2014-05-14 09:05 - 2014-05-14 09:05 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-14 08:08 - 2014-05-14 08:08 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Centra
2014-05-13 12:23 - 2014-05-13 12:23 - 00001141 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2014-05-13 12:23 - 2014-05-13 12:23 - 00000092 _____ () C:\__Argon__.tmp
2014-05-13 12:23 - 2014-05-13 12:23 - 00000064 _____ () C:\shutdownprocesses.bat
2014-05-13 12:23 - 2014-05-13 12:23 - 00000032 ____N () C:\_IS6BAT_.TMP
2014-05-13 10:29 - 2014-05-14 11:56 - 00000000 ____D () C:\FRST
2014-05-10 12:03 - 2014-05-10 12:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-09 09:29 - 2014-05-09 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-05-08 10:29 - 2014-05-08 10:29 - 00511642 _____ () C:\Users\Stefan\Downloads\meet_sweetspot_tables_D.zip
2014-05-06 17:28 - 2014-05-06 17:28 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-06 09:35 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-06 09:35 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-05 17:11 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 17:11 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 17:11 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 17:11 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-29 17:31 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-29 17:31 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-29 17:31 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-29 17:31 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-29 17:31 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-29 17:31 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-29 17:31 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-29 17:31 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-29 17:31 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-29 17:31 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-29 17:31 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-29 17:31 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-29 17:31 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-29 17:31 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-29 17:31 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-29 17:31 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-29 17:31 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-29 17:31 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-29 17:31 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-29 17:31 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-29 17:31 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-29 17:31 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-29 17:31 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-29 17:31 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-29 17:31 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-29 17:30 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-29 17:30 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-29 17:30 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-29 17:30 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-29 17:30 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-29 17:30 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-29 17:30 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-29 17:30 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-29 17:30 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-29 17:30 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-29 17:30 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-29 17:30 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-29 17:30 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-29 17:30 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-29 17:30 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-29 17:30 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-29 17:30 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-29 17:30 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-29 17:30 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-28 14:39 - 2014-05-07 15:56 - 00000000 ____D () C:\Users\Stefan\Desktop\BTMV
2014-04-27 18:00 - 2014-04-27 18:00 - 00000000 ____D () C:\Users\Stefan\AppData\Local\.elfohilfe
2014-04-27 17:08 - 2014-04-27 17:09 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\elsterformular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\ProgramData\elsterformular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2014-04-25 16:14 - 2014-04-25 16:14 - 00000000 ___HD () C:\ProgramData\{71298098-1063-493E-A755-4CC7081782D0}
2014-04-25 16:14 - 2014-04-25 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasternGraphics
2014-04-25 16:13 - 2014-04-25 16:13 - 00000000 ____D () C:\Users\Stefan\AppData\Local\III
2014-04-22 16:26 - 2014-04-22 16:30 - 00038429 _____ () C:\Users\Stefan\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2014-04-22 13:14 - 2014-04-22 13:14 - 00000020 ___SH () C:\Users\ASP.NET v4.0 DefaultAppPool\ntuser.ini
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Vorlagen
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Startmenü
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Netzwerkumgebung
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Lokale Einstellungen
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Eigene Dateien
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Druckumgebung
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Documents\Eigene Musik
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Documents\Eigene Bilder
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Local\Verlauf
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Local\Anwendungsdaten
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Anwendungsdaten
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 ____D () C:\Users\ASP.NET v4.0 DefaultAppPool
2014-04-22 13:14 - 2014-04-01 15:18 - 00000000 ____D () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Macromedia
2014-04-22 13:14 - 2013-10-01 13:23 - 00002120 _____ () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2014-04-22 13:14 - 2013-06-18 11:52 - 00000000 ____D () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Local\Microsoft Help
2014-04-22 13:14 - 2009-07-14 06:54 - 00000000 ___RD () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-04-22 13:14 - 2009-07-14 06:49 - 00000000 ___RD () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-04-22 12:57 - 2014-04-22 12:57 - 00000167 _____ () C:\Windows\ODBCINST.INI
2014-04-22 12:55 - 2011-09-25 07:51 - 00050200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.3.5500.0.dll
2014-04-22 12:55 - 2011-09-22 17:18 - 00073064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perf-MSSQL$SQLEXPRESS-sqlctr10.3.5500.0.dll
2014-04-22 12:54 - 2014-04-22 12:55 - 00000000 ____D () C:\Program Files\Microsoft SQL Server
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\SysWOW64\1033
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\SysWOW64\1031
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\system32\1033
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\system32\1031
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 9.0
2014-04-22 12:53 - 2014-04-22 12:55 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server
2014-04-22 12:53 - 2014-04-22 12:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft SQL Server 2008
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\ProgramData\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\Program Files (x86)\Device
2014-04-22 09:36 - 2014-04-22 09:37 - 00000000 ____D () C:\BoxOperator
2014-04-22 09:36 - 2014-04-22 09:36 - 00000000 ____D () C:\ProgramData\MFP-Printer Utility
2014-04-17 13:16 - 2014-04-17 13:16 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Zattoo
2014-04-17 13:16 - 2014-04-17 13:16 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zattoo Europa AG
2014-04-17 13:15 - 2014-04-17 13:16 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Deployment
2014-04-17 13:15 - 2014-04-17 13:15 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Apps\2.0
2014-04-17 13:15 - 2014-04-17 13:15 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-15 10:51 - 2014-04-15 10:52 - 00000000 ____D () C:\Users\Stefan\Desktop\Interstuhl
==================== One Month Modified Files and Folders =======
2014-05-14 11:56 - 2014-05-14 11:56 - 02066944 _____ (Farbar) C:\Users\Stefan\Desktop\FRST64.exe
2014-05-14 11:56 - 2014-05-14 11:56 - 00021787 _____ () C:\Users\Stefan\Desktop\FRST.txt
2014-05-14 11:56 - 2014-05-13 10:29 - 00000000 ____D () C:\FRST
2014-05-14 11:56 - 2014-02-13 11:00 - 02032440 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-05-14 11:56 - 2013-06-13 15:22 - 00000000 ____D () C:\Users\Stefan\AppData\Local\3E865EC9-11FE-4B0A-9567-F702404AE632.aplzod
2014-05-14 11:54 - 2013-06-13 14:57 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2014-05-14 11:53 - 2013-06-13 12:11 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{68CB2F9A-9254-4A7B-A264-A9FC71EF232D}
2014-05-14 11:41 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-14 11:41 - 2009-07-14 06:45 - 00013936 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-14 11:38 - 2013-06-13 12:41 - 00844582 _____ () C:\Windows\system32\perfh007.dat
2014-05-14 11:38 - 2013-06-13 12:41 - 00202474 _____ () C:\Windows\system32\perfc007.dat
2014-05-14 11:38 - 2013-06-13 11:53 - 01362305 _____ () C:\Windows\WindowsUpdate.log
2014-05-14 11:38 - 2009-07-14 07:13 - 02003270 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-14 11:36 - 2014-05-14 11:36 - 00000000 ____D () C:\Windows\ERUNT
2014-05-14 11:35 - 2014-05-14 11:36 - 01016261 _____ (Thisisu) C:\Users\Stefan\Desktop\4JRT.exe
2014-05-14 11:34 - 2014-05-14 10:59 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-14 11:32 - 2009-11-23 23:29 - 00551394 _____ () C:\Windows\PFRO.log
2014-05-14 11:32 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-14 11:32 - 2009-07-14 06:51 - 00070797 _____ () C:\Windows\setupact.log
2014-05-14 11:31 - 2014-05-14 11:28 - 00000000 ____D () C:\AdwCleaner
2014-05-14 11:23 - 2014-05-14 11:27 - 01325827 _____ () C:\Users\Stefan\Desktop\3adwcleaner.exe
2014-05-14 11:15 - 2013-06-26 18:27 - 00000000 ____D () C:\Users\postgres
2014-05-14 11:15 - 2009-07-14 09:45 - 00000000 ____D () C:\Windows\ShellNew
2014-05-14 11:05 - 2013-06-14 08:18 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-14 10:59 - 2014-05-14 10:59 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-14 10:59 - 2014-05-14 10:59 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-14 10:46 - 2014-05-14 10:46 - 00001264 _____ () C:\Users\Stefan\Desktop\Revo Uninstaller.lnk
2014-05-14 10:46 - 2014-05-14 10:46 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-05-14 10:44 - 2014-05-14 10:44 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Stefan\Downloads\1revosetup95.exe
2014-05-14 09:05 - 2014-05-14 09:05 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-14 09:05 - 2013-06-14 08:18 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 09:05 - 2013-06-14 08:18 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 08:09 - 2013-09-24 11:09 - 00000164 _____ () C:\Users\Stefan\AppData\Roaming\WB.CFG
2014-05-14 08:08 - 2014-05-14 08:08 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Centra
2014-05-14 08:05 - 2013-06-14 08:18 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 07:57 - 2013-06-13 12:32 - 00000000 ____D () C:\ProgramData\CSS Group
2014-05-14 07:51 - 2014-01-25 12:59 - 00000000 ____D () C:\Update
2014-05-13 15:38 - 2014-02-25 18:16 - 00000000 ____D () C:\Users\Stefan\Desktop\Bilder_Shooting
2014-05-13 15:38 - 2014-02-13 18:34 - 00000000 ____D () C:\Users\Stefan\Desktop\Develop
2014-05-13 14:02 - 2013-06-13 12:32 - 00000473 _____ () C:\Windows\BRWMARK.INI
2014-05-13 14:02 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-13 12:44 - 2013-06-13 12:49 - 00067320 _____ () C:\fpRedmon.log
2014-05-13 12:44 - 2013-06-13 12:49 - 00000000 ____D () C:\Users\Stefan\AppData\Local\FreePDF_XP
2014-05-13 12:23 - 2014-05-13 12:23 - 00001141 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
2014-05-13 12:23 - 2014-05-13 12:23 - 00000092 _____ () C:\__Argon__.tmp
2014-05-13 12:23 - 2014-05-13 12:23 - 00000064 _____ () C:\shutdownprocesses.bat
2014-05-13 12:23 - 2014-05-13 12:23 - 00000032 ____N () C:\_IS6BAT_.TMP
2014-05-13 12:23 - 2009-11-24 00:46 - 00000000 ____D () C:\ProgramData\Sony Corporation
2014-05-12 11:53 - 2013-06-13 14:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-10 12:48 - 2013-12-02 15:56 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Spotify
2014-05-10 12:03 - 2014-05-10 12:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-09 15:14 - 2013-06-13 15:53 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Paint.NET
2014-05-09 09:40 - 2013-10-17 15:47 - 00625248 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2014-05-09 09:40 - 2013-10-17 15:47 - 00458336 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kl1.sys
2014-05-09 09:40 - 2013-10-17 15:47 - 00029280 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klkbdflt.sys
2014-05-09 09:40 - 2013-06-08 20:18 - 00115296 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2014-05-09 09:40 - 2013-06-06 17:38 - 00178272 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kneps.sys
2014-05-09 09:30 - 2013-06-13 14:57 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab
2014-05-09 09:29 - 2014-05-09 09:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2014-05-08 14:16 - 2013-12-02 15:56 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Spotify
2014-05-08 10:29 - 2014-05-08 10:29 - 00511642 _____ () C:\Users\Stefan\Downloads\meet_sweetspot_tables_D.zip
2014-05-07 15:56 - 2014-04-28 14:39 - 00000000 ____D () C:\Users\Stefan\Desktop\BTMV
2014-05-06 17:28 - 2014-05-06 17:28 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-02 08:01 - 2014-03-23 14:00 - 00000512 __RSH () C:\ProgramData\ntuser.pol
2014-04-30 08:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-30 07:42 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-29 16:01 - 2014-05-05 17:11 - 23547904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-05 17:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-05 17:11 - 17384448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-05 17:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-28 11:22 - 2014-02-11 15:05 - 00000000 ____D () C:\Watchfolder
2014-04-27 18:00 - 2014-04-27 18:00 - 00000000 ____D () C:\Users\Stefan\AppData\Local\.elfohilfe
2014-04-27 17:09 - 2014-04-27 17:08 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\elsterformular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\ProgramData\elsterformular
2014-04-27 17:08 - 2014-04-27 17:08 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2014-04-25 16:14 - 2014-04-25 16:14 - 00000000 ___HD () C:\ProgramData\{71298098-1063-493E-A755-4CC7081782D0}
2014-04-25 16:14 - 2014-04-25 16:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EasternGraphics
2014-04-25 16:14 - 2013-11-19 18:51 - 00000000 ___HD () C:\ProgramData\{2E5F3D11-0155-4860-A4E6-7A8C7E5C8D15}
2014-04-25 16:14 - 2013-06-13 15:05 - 00000000 ____D () C:\ProgramData\EasternGraphics
2014-04-25 16:13 - 2014-04-25 16:13 - 00000000 ____D () C:\Users\Stefan\AppData\Local\III
2014-04-22 16:30 - 2014-04-22 16:26 - 00038429 _____ () C:\Users\Stefan\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
2014-04-22 13:24 - 2009-07-14 06:45 - 00462136 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-04-22 13:14 - 2014-04-22 13:14 - 00000020 ___SH () C:\Users\ASP.NET v4.0 DefaultAppPool\ntuser.ini
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Vorlagen
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Startmenü
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Netzwerkumgebung
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Lokale Einstellungen
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Eigene Dateien
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Druckumgebung
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Documents\Eigene Musik
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Documents\Eigene Bilder
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Local\Verlauf
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\AppData\Local\Anwendungsdaten
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 _SHDL () C:\Users\ASP.NET v4.0 DefaultAppPool\Anwendungsdaten
2014-04-22 13:14 - 2014-04-22 13:14 - 00000000 ____D () C:\Users\ASP.NET v4.0 DefaultAppPool
2014-04-22 13:06 - 2013-06-13 12:07 - 00120968 _____ () C:\Users\Stefan\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-22 12:57 - 2014-04-22 12:57 - 00000167 _____ () C:\Windows\ODBCINST.INI
2014-04-22 12:57 - 2014-04-08 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MFP-Printer Utility
2014-04-22 12:56 - 2014-04-08 17:18 - 00000000 ____D () C:\Program Files\MFP-Printer Utility
2014-04-22 12:55 - 2014-04-22 12:54 - 00000000 ____D () C:\Program Files\Microsoft SQL Server
2014-04-22 12:55 - 2014-04-22 12:53 - 00000000 ____D () C:\Program Files (x86)\Microsoft SQL Server
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\SysWOW64\1033
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\SysWOW64\1031
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\system32\1033
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Windows\system32\1031
2014-04-22 12:54 - 2014-04-22 12:54 - 00000000 ____D () C:\Program Files (x86)\Microsoft Visual Studio 9.0
2014-04-22 12:54 - 2014-04-22 12:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft SQL Server 2008
2014-04-22 12:51 - 2014-04-22 12:51 - 00000000 ____D () C:\ProgramData\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\Users\Stefan\AppData\Local\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MFP Utility
2014-04-22 10:04 - 2014-04-22 10:04 - 00000000 ____D () C:\Program Files (x86)\Device
2014-04-22 09:37 - 2014-04-22 09:36 - 00000000 ____D () C:\BoxOperator
2014-04-22 09:36 - 2014-04-22 09:36 - 00000000 ____D () C:\ProgramData\MFP-Printer Utility
2014-04-17 15:19 - 2013-10-04 12:21 - 00000000 ___RD () C:\Users\Stefan\Desktop\Verknüpfungen
2014-04-17 13:17 - 2013-10-28 14:06 - 00000000 ____D () C:\Program Files (x86)\Zattoo4
2014-04-17 13:16 - 2014-04-17 13:16 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Zattoo
2014-04-17 13:16 - 2014-04-17 13:16 - 00000000 ____D () C:\Users\Stefan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Zattoo Europa AG
2014-04-17 13:16 - 2014-04-17 13:15 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Deployment
2014-04-17 13:15 - 2014-04-17 13:15 - 00000000 ____D () C:\Users\Stefan\AppData\Local\Apps\2.0
2014-04-17 13:15 - 2014-04-17 13:15 - 00000000 ____D () C:\ProgramData\Package Cache
2014-04-17 13:12 - 2013-10-28 14:06 - 00017408 _____ () C:\Users\Stefan\AppData\Local\WebpageIcons.db
2014-04-15 10:52 - 2014-04-15 10:51 - 00000000 ____D () C:\Users\Stefan\Desktop\Interstuhl
2014-04-14 04:24 - 2014-05-06 09:35 - 00465408 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-06 09:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
Some content of TEMP:
====================
C:\Users\Stefan\AppData\Local\Temp\autorun.dll
C:\Users\Stefan\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-05-09 08:36
==================== End Of Log ============================ --- --- ---
--- --- --- Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by Stefan on 14.05.2014 at 11:41:23,49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{10397CF5-8768-4510-8F12-B8D001496C3A}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Stefan\AppData\Roaming\mozilla\firefox\profiles\k67ysfvy.default\minidumps [12 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.05.2014 at 11:53:21,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 14.05.2014
Suchlauf-Zeit: 11:14:54
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.1.1004
Malware Datenbank: v2014.05.14.02
Rootkit Datenbank: v2014.03.27.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Chameleon: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Stefan
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 366195
Verstrichene Zeit: 14 Min, 35 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Shuriken: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 5
PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [ba90064b9cdf78beddeb55061fe340c0],
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [ba90064b9cdf78beddeb55061fe340c0],
PUP.Optional.Babylon.A, HKU\S-1-5-21-778539726-1508035087-141682171-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\BABSOLUTION\Updater, In Quarantäne, [f951292804774de91f491c9325de7888],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-778539726-1508035087-141682171-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, In Quarantäne, [8dbdba977803b08640249efafe04d52b],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-778539726-1508035087-141682171-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, In Quarantäne, [5ceec09185f6a294f0962b834eb5b14f],
Registrierungswerte: 1
PUP.Optional.InstallCore.A, HKU\S-1-5-21-778539726-1508035087-141682171-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0L1N1H2O1S, In Quarantäne, [5ceec09185f6a294f0962b834eb5b14f]
Registrierungsdaten: 1
PUP.Optional.StartPage.A, HKU\S-1-5-21-778539726-1508035087-141682171-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=CEE0506313DEDF0F&affID=119357&tt=160913_m3&tsp=5015, Gut: (hxxp://www.google.com), Schlecht: (hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=CEE0506313DEDF0F&affID=119357&tt=160913_m3&tsp=5015),Ersetzt,[dc6e4f02215abb7bac41281e2fd5c13f]
Ordner: 3
PUP.Optional.OpenCandy, C:\Users\Stefan\AppData\Roaming\OpenCandy, In Quarantäne, [88c27cd50a713ff7b410680628da6b95],
PUP.Optional.OpenCandy, C:\Users\Stefan\AppData\Roaming\OpenCandy\A36957D12FF044AEA1376CF4805A068F, In Quarantäne, [88c27cd50a713ff7b410680628da6b95],
PUP.Optional.ReMarkIt.A, C:\Program Files (x86)\Re-markit, In Quarantäne, [eb5f3021f784ff378595beb70200c040],
Dateien: 29
PUP.Optional.Delta.A, C:\ProgramData\DSearchLink\DSearchLink.exe, In Quarantäne, [50facd8492e9a393ea42828d5aaace32],
PUP.Optional.Amonetize, C:\Users\Stefan\AppData\Local\Temp\nsyB0EB.tmp\aminsis.dll, In Quarantäne, [d773f35e6b10c3736932212901006e92],
PUP.Optional.Amonetize, C:\Users\Stefan\AppData\Local\Temp\~nsu.tmp\Au_.exe, In Quarantäne, [60ea63ee07748caa5942d8726a97b14f],
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot64.exe, In Quarantäne, [19317fd2fd7e85b18aa3bdd522e0e21e],
PUP.Software.Updater, C:\Windows\Tasks\AmiUpdXp.job, In Quarantäne, [2921a7aa87f45dd9bb45851bb34f07f9],
PUP.Optional.OpenCandy, C:\Users\Stefan\AppData\Roaming\OpenCandy\A36957D12FF044AEA1376CF4805A068F\TuneUpUtilities2013-2200218_de-DE.exe, In Quarantäne, [88c27cd50a713ff7b410680628da6b95],
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.admin", false);), Ersetzt,[d179e26f35461125ec82284be81cc937]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.aflt", "babsst");), Ersetzt,[1c2ee26f5328e94d541a7ef531d3e41c]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");), Ersetzt,[79d17dd4cead55e1c9a5551e5ba90ef2]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.autoRvrt", "false");), Ersetzt,[79d161f03249c57145290c6740c4f10f]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.dfltLng", "de");), Ersetzt,[6ae0fd545d1ec274cca292e162a24fb1]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.excTlbr", false);), Ersetzt,[3b0f70e10279bc7a89e5cea52fd518e8]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.ffxUnstlRst", true);), Ersetzt,[67e3470aed8e03338de191e208fc7789]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.id", "cee0f7ca000000000000506313dedf0f");), Ersetzt,[1d2d3120e695bd7996d86112c341dd23]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlDay", "15972");), Ersetzt,[83c7bd94a8d31620c9a55a19848050b0]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.instlRef", "sst");), Ersetzt,[2129fb56255606304925ec879f650000]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.newTab", false);), Ersetzt,[36147ed3ee8dfa3c26484c27e1233dc3]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prdct", "delta");), Ersetzt,[a7a3351c0f6c9a9c0c625e152fd513ed]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.prtnrId", "delta");), Ersetzt,[ea601d340c6f39fde08eadc639cb669a]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.rvrt", "false");), Ersetzt,[b694cd84eb901026e787274cad578878]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.smplGrp", "none");), Ersetzt,[a2a8a9a8552652e4f975155ed82c2dd3]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrId", "base");), Ersetzt,[5dedd47dabd078be89e5fe75cb39a060]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.tlbrSrchUrl", "");), Ersetzt,[23270b46dc9f95a1d5991f54be4610f0]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsn", "1.8.24.6");), Ersetzt,[3d0d2f224d2ee551046a1162dc28f40c]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsnTs", "1.8.24.610:09:15");), Ersetzt,[e46666eb6b107abc47272f44d232f907]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta.vrsni", "1.8.24.6");), Ersetzt,[b29894bd7a013105f777e58ec440c040]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babExt", "");), Ersetzt,[ed5d173a1368171f6509d0a3986cb050]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.babTrack", "affID=119357&tt=160913_m3&tsp=5015");), Ersetzt,[3713cf82a7d4ba7c541a403331d3728e]
PUP.Optional.Delta.A, C:\Users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\k67ysfvy.default\prefs.js, Gut: (), Schlecht: (user_pref("extensions.delta_i.srcExt", "ss");), Ersetzt,[7dcd88c924579d99bcb25320db2942be]
Physische Sektoren: 0
(No malicious items detected)
(end)
Und mal wieder herzlichen Dank!
Ist wirklich ne super schnelle Sache hier :daumenhoc
Habe alles wie beschrieben an allen Rechnern durchgeführt... heute morgen kam schon wieder eine solche Email. Ich poste dir hier mal den Inhalt Code:
This message was created automatically by mail delivery software.
A message that you sent could not be delivered to one or more of
its recipients. This is a permanent error. The following address
failed:
"***@t-online.de":
SMTP error from remote server after transfer of mail text:
host: mx00.t-online.de
5.7.0 Message considered as spam or virus, rejected
5.7.0 Your IP: 212.227.126.130
5.7.0 Mailhost: mailin57.aul.t-online.de
5.7.0 Timestamp: 2014-05-15T06:27:10Z
5.7.0 Expurgate-ID: 149288::1400135230-00001464-9DE68B58/0-12877356342/0-10
5.7.0 Authenticator: 70E542E1C7DBAA2FE89B0A55B90293EEBF513C93BFCC94FA6FE4DD1F29C8FB0227DB1B4D
5.7.0
5.7.0 Your message has been rejected due to spam or virus classification.
5.7.0 If you feel this is inapplicable, please report the above error codes
5.7.0 back to FPR@RX.T-ONLINE.DE to help us fix possible misclassification.
5.7.0 We apologize for any inconvenience and thank you for your assistance!
5.7.0
5.7.0 Die Annahme Ihrer Nachricht wurde abgelehnt, da sie als Spam oder
5.7.0 Virus eingestuft wurde. Sollten Sie dies als unzutreffend ansehen,
5.7.0 senden Sie bitte obige Fehlercodes an FPR@RX.T-ONLINE.DE, damit wir
5.7.0 die Klassifizierung untersuchen können. Wir entschuldigen uns für
5.7.0 etwaige Unannehmlichkeiten und bedanken uns für Ihre Unterstützung!
--- The header of the original message is following. ---
Received: from [212.227.17.191] ([212.227.17.191]) by mx.kundenserver.de
(mxeue002) with ESMTP (Nemesis) id 0MKAJ3-1Wjzmi3h1p-001T9c for
<***@t-online.de>; Thu, 15 May 2014 08:27:10 +0200
Received: from trackclick.co ([207.36.91.105]) by mx.kundenserver.de
(mxeue002) with ESMTP (Nemesis) id 0MhtSd-1WPYz83gqh-00Mq1u for
<info@***.de>; Thu, 15 May 2014 08:27:09 +0200
Date: Thu, 15 May 2014 02:27:07 -0400
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=listclick.co;
s=default; t=1400135227;
bh=YzCAnYQ2RLUIJ9l2GQMbhipEGev7ik3hTwcKOrL9+xk=;
h=From:Subject:To:Reply-To:List-ID:List-Unsubscribe;
b=c0aPrqQrwFosP1zbtVvtx8hAYAvYqEYtaK3k4eUjashhkLRQIEvnpVkQod6J212T2
HxR3WEwN43PGYgG7Tt68u4kNvJdBe6jWwKalfSJB1TdEsIcw6Gfci1RAZolkp6lTK4
UvjLRmcr56YudPPIEspBJrDqSBZLa2ANpUv1dg2w=
From: Ralf Schneider <returntrack@listclick.co>
Subject: So verdienen Affiliates jedes Jahr bis zu 1.237.784 Euro von zu Hause aus..
To: info@***.de
Sender: returntrack@listclick.co
Reply-To: "Ralf Schneider" <rallemeuller72@gmail.com>
Precedence: bulk
Content-Type: multipart/alternative; boundary="_----------=_1400135187115970"
List: Firmen2
MIME-Version: 1.0
X-Mailer: liststream Mailer
List-Track: iulife521400135186
List-Encode: c2z3mjv94s3wh75j5hv9o85jh78j5j5h0hkt5j
List-ID: 338
List-Unsubscribe: <unsubscribe@listclick.co>
X-Bulkmail: 3.12
Message-Id: <20140515062707.E4CEC1B08B9@trackclick.co>
Content-Transfer-Encoding: 7bit Wird die Email über das t-online Konto, oder über die "info@..." Email-Adresse gesendet? Die "info@" ist jedoch kein Postfach, sondern ist einer reine Weiterleitung an die t-online-Adresse... |