maxwell0901 | 24.09.2014 17:27 | Hi,
vielen Dank für die schnelle Antwort.
Anbei die txt Dateien:
mbam.txt Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlauf Datum: 24.09.2014
Suchlauf-Zeit: 17:17:45
Logdatei: mbam.txt
Administrator: Ja
Version: 2.00.2.1012
Malware Datenbank: v2014.09.24.07
Rootkit Datenbank: v2014.09.19.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert
Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Maxi
Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 338623
Verstrichene Zeit: 20 Min, 18 Sek
Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registrierungsschlüssel: 14
PUP.Optional.Delta.A, HKLM\SOFTWARE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [750200f1bebd77bf682cae1850b20bf5],
PUP.Optional.Delta.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\APPID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}, In Quarantäne, [750200f1bebd77bf682cae1850b20bf5],
PUP.Optional.Babylon.A, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}, In Quarantäne, [1265e50c582357dfbc6af7963cc603fd],
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [c8afd120c5b6bb7b4581312e9470d729],
PUP.Optional.DataMangr.A, HKLM\SOFTWARE\WOW6432NODE\DataMngr, In Quarantäne, [b9bef0013447a096808f978a39cafa06],
PUP.Optional.qvo6.A, HKLM\SOFTWARE\WOW6432NODE\qvo6Software, In Quarantäne, [a8cf757ccdaebf7733434412c73d7987],
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [1661a24fbcbfe056ffc78bd4b74d05fb],
PUP.Optional.RegCleanPro.A, HKLM\SOFTWARE\WOW6432NODE\SYSTWEAK\RegClean Pro, In Quarantäne, [76012bc683f8290d5fc84bcdbb4842be],
PUP.Optional.BundleInstaller.A, HKLM\SOFTWARE\WOW6432NODE\VITTALIA\AxtanInstaller, In Quarantäne, [185fe60bf98260d6c09bae8de61d21df],
PUP.Optional.DataMngr.A, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\DataMngr_Toolbar, In Quarantäne, [651230c1c9b2b383db2cb3a138ccb24e],
PUP.Optional.PriceGong.A, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\PriceGong, In Quarantäne, [5c1b14dda3d85adca4a1c57320e3cc34],
PUP.Optional.DVDVideoSoftTB.A, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\nikpibnbobmbdbheedjfogjlikpgpnhp, In Quarantäne, [adca975a1e5d03332120749559aace32],
PUP.Optional.Qone8, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, In Quarantäne, [87f01ed36d0e7eb8b80d4d12a460857b],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3194724861-4292890466-1671743591-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\SOFTONIC\Universal Downloader, In Quarantäne, [ee89f8f9e8935dd9e4184ede2bd89e62],
Registrierungswerte: 0
(No malicious items detected)
Registrierungsdaten: 2
PUP.Optional.Qone8, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[3a3da64baad171c54cf721ebc3427b85]
PUP.Optional.Qone8, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES|DefaultScope, {33BB0A4E-99AF-4226-BDF6-49120163DE86}, Gut: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}), Schlecht: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}),Ersetzt,[90e747aa49320c2a9ea564a8ce3719e7]
Ordner: 18
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log, In Quarantäne, [0770e40d0873171fd446e05a41c2fb05],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\1, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\3, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\35, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\36, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\39, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\4, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\41, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\42, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\sysicons, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.OPtional.Dealply.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly, In Quarantäne, [3740628f9dde2511c9b6d67db74dee12],
Dateien: 89
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Omiga Plus\wallpaper_components.exe, In Quarantäne, [403717da6e0db0862e2d66ccbb4a38c8],
PUP.Optional.Conduit.A, C:\Users\Maxi\AppData\Local\Conduit\CT2319825\WinloadAutoUpdateHelper.exe, In Quarantäne, [7106bd34512a49ed600856c853ad51af],
PUP.Optional.DealPly.A, C:\Windows\System32\Tasks\DealPly, In Quarantäne, [da9ddf12691244f2a56f37e46b98f907],
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log\eGdpSvc.LOG, In Quarantäne, [0770e40d0873171fd446e05a41c2fb05],
PUP.Optional.eSafe.A, C:\ProgramData\eSafe\log\eSafeSvc.LOG, In Quarantäne, [0770e40d0873171fd446e05a41c2fb05],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote.xml, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\accelerate, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg_list.xml, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_list.xml, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_settings.ini, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\firstrun, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\process_mgr.xml, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\1\angrybirds.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\1\angrybirds.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\3\BigFarm.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\3\BigFarm.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\35\Gmail.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\35\Gmail.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\36\Outlook.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\36\Outlook.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\39\ESPN.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\39\ESPN.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\4\Empire.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\4\Empire.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\41\gcalendar.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\41\gcalendar.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\42\pulse.db, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\app\config\42\pulse.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_1.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_2.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_3.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_4.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_5.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\desk_bkg\desk_bkg_default.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\337_7c9140b13c049fd26989f7fa25b77cb1_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\angrybirds_00ff92c12703baaf0130d6aec427d047_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Barbie_00a67ff4ef657679a6c88553135d62ad_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\BigFarm_de933b0e5218a4db24bebe3d55ed3558_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\chrome_86ad215464f8170bde87d3ce425ea7c6.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\chrome_86ad215464f8170bde87d3ce425ea7c6_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Empire_22b42f57d1c467841280810e218d5510_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\ESPN_a7b078f5f5f5b87efcef66ab5783cf9d_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Facebook_aab07bc79cf599b25c0110f32d46a3ef_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\gcalendar_50b3e3c5fc202f0cfcae8032b2465c1b_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Gmail_731b6d011bd9f67463a916a496775935_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Google_60d75cb277f0c452fa60dba8350caf65_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\iexplore_d961e92e13d8a8cf69b4ca0a867c77bd.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\iexplore_d961e92e13d8a8cf69b4ca0a867c77bd_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Mario_52934d81761dc31187a93a3a0be7fecc_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Outlook_6f817b67fa6af1a9c8abfa3813a8595c_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\pulse_b5a242da04cc06eacd02b1ca41e3583c_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\sys_computer_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\sys_control_panel_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\sys_my_documents_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\icons\Youtube_bf18fdfc4aefd6417a8bacae4be5b415_48_48.png, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\337.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\337_7c9140b13c049fd26989f7fa25b77cb1.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\barbie.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Barbie_00a67ff4ef657679a6c88553135d62ad.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\facebook.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Facebook_aab07bc79cf599b25c0110f32d46a3ef.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\GameCenter.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\google.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Google_60d75cb277f0c452fa60dba8350caf65.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\mario.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Mario_52934d81761dc31187a93a3a0be7fecc.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\twitter.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Twitter_ebddd85ec04b7b94a2b2e97b73a90a4a.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\v9.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\youtube.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\promote\Youtube_bf18fdfc4aefd6417a8bacae4be5b415.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\sysicons\imageres.dll_104.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\sysicons\imageres.dll_107.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\sysicons\shell32.dll_21.ico, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r0.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r1.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r2.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r3.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r4.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r5.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r6.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r7.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r8.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.Optional.Desk365.A, C:\Users\Maxi\AppData\Roaming\Desk 365\wp\r9.jpg, In Quarantäne, [ef88df12ccafdb5b0af5ff52956f1ee2],
PUP.OPtional.Dealply.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly\Uninstall DealPly.lnk, In Quarantäne, [3740628f9dde2511c9b6d67db74dee12],
PUP.OPtional.Dealply.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly\DealPly Help.lnk, In Quarantäne, [3740628f9dde2511c9b6d67db74dee12],
PUP.OPtional.Dealply.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly\DealPly.lnk, In Quarantäne, [3740628f9dde2511c9b6d67db74dee12],
PUP.Optional.BrowserDefender.A, C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage, In Quarantäne, [4f28b140d2a90333d386ce8935cffb05],
Physische Sektoren: 0
(No malicious items detected)
(end) Adwcleaner.txt Code:
# AdwCleaner v3.310 - Bericht erstellt am 24/09/2014 um 18:04:19
# Aktualisiert 12/09/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Maxi - MAXI-PC
# Gestartet von : C:\Users\Maxi\Downloads\AdwCleaner_3.310.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\DeviceVM
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files (x86)\Winload
Ordner Gelöscht : C:\Users\Maxi\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Maxi\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Maxi\AppData\LocalLow\Winload
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\DeviceVM
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\eIntaller
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\Omiga Plus
Ordner Gelöscht : C:\Users\Maxi\AppData\Roaming\WinZipper
***** [ Tasks ] *****
Task Gelöscht : Dealply
Task Gelöscht : Desk 365 RunAsStdUser
Task Gelöscht : Omiga Plus RunAsStdUser
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Maxi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Maxi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Maxi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\omigaplussvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2319825
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_replay-music_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_replay-music_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_super_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_super_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4D494D9D-1436-41D8-AC95-35AA4F4AEFAF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D494D9D-1436-41D8-AC95-35AA4F4AEFAF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4D494D9D-1436-41D8-AC95-35AA4F4AEFAF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8AA0B768-2F14-46C3-BF84-02B194BD2697}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{96BAAAB8-9506-4799-B62E-DB2FA2172208}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{40C3CC16-7269-4B32-9531-17F2950FB06F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{40C3CC16-7269-4B32-9531-17F2950FB06F}]
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\winload
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\winload
Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit
Schlüssel Gelöscht : HKLM\SOFTWARE\Desksvc
Schlüssel Gelöscht : HKLM\SOFTWARE\hdcode
Schlüssel Gelöscht : HKLM\SOFTWARE\omigaplusSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\SoftwareUpdater
Schlüssel Gelöscht : HKLM\SOFTWARE\Solvusoft
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Vittalia
Schlüssel Gelöscht : HKLM\SOFTWARE\winload
Schlüssel Gelöscht : HKLM\SOFTWARE\winzipersvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Winload Toolbar
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17280
-\\ Mozilla Firefox v32.0.2 (x86 de)
[ Datei : C:\Users\Maxi\AppData\Roaming\Mozilla\Firefox\Profiles\2gs3k6tl.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht [Extension] : nikpibnbobmbdbheedjfogjlikpgpnhp
*************************
AdwCleaner[R0].txt - [6577 octets] - [24/09/2014 18:01:23]
AdwCleaner[S0].txt - [5515 octets] - [24/09/2014 18:04:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5575 octets] ########## JRT.txt Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.0 (09.22.2014:1)
OS: Windows 7 Professional x64
Ran by Maxi on 24.09.2014 at 18:10:33.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{116C6F52-A7E4-4ECB-9AFA-5F063E52C0BB}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F81D52BF-F2F1-4F49-BF5F-05664E803039}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F81D52BF-F2F1-4F49-BF5F-05664E803039}
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Maxi\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
~~~ FireFox
Emptied folder: C:\Users\Maxi\AppData\Roaming\mozilla\firefox\profiles\2gs3k6tl.default\minidumps [6 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.09.2014 at 18:13:12.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST.txt
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2014
Ran by Maxi (administrator) on MAXI-PC on 24-09-2014 18:16:07
Running from C:\Users\Maxi\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
( ) C:\Windows\System32\lxbkcoms.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmgr.exe
(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe
(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe
(Lexmark International, Inc.) C:\Program Files (x86)\Lexmark X1100 Series\LXBKbmon.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Maxi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe
() C:\Users\Maxi\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Bitdefender) C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwtxapps.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [lxbkbmgr.exe] => C:\Program Files (x86)\Lexmark X1100 Series\lxbkbmgr.exe [74408 2008-02-28] (Lexmark International, Inc.)
HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-04-16] (Saitek)
HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-04-16] (Saitek)
HKLM\...\Run: [Bdagent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdagent.exe [1580360 2014-08-20] (Bitdefender)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443408 2014-02-07] (BlackBerry Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4493824 2014-05-07] (Research In Motion Limited)
HKU\S-1-5-21-3194724861-4292890466-1671743591-1000\...\Run: [Spotify Web Helper] => C:\Users\Maxi\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-28] (Spotify Ltd)
HKU\S-1-5-21-3194724861-4292890466-1671743591-1000\...\Run: [Bitdefender-Geldbörse-Agent] => C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe [815088 2014-08-14] (Bitdefender)
HKU\S-1-5-21-3194724861-4292890466-1671743591-1000\...\Run: [Amazon Music] => C:\Users\Maxi\AppData\Local\Amazon Music\Amazon Music Helper.exe [6281536 2014-09-06] ()
HKU\S-1-5-21-3194724861-4292890466-1671743591-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKLM - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\pmbxie.dll (Bitdefender)
Toolbar: HKLM-x32 - Bitdefender-Geldbörse - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender 2015\Antispam32\pmbxie.dll (Bitdefender)
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: HKLM-x32 {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Maxi\AppData\Roaming\Mozilla\Firefox\Profiles\2gs3k6tl.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.10.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 -> C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira Browser Safety - C:\Users\Maxi\AppData\Roaming\Mozilla\Firefox\Profiles\2gs3k6tl.default\Extensions\abs@avira.com [2014-09-15]
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
FF Extension: Bitdefender Antispam Toolbar - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext [2014-09-17]
FF HKLM-x32\...\Firefox\Extensions: [bdwteff@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff
FF Extension: Bitdefender Wallet - C:\Program Files\Bitdefender\Bitdefender 2015\antispam32\bdwteff [2014-09-17]
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender 2015\bdtbext
Chrome:
=======
CHR HomePage: Default ->
CHR Profile: C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-11]
CHR Extension: (Google Drive) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-11]
CHR Extension: (YouTube) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-11]
CHR Extension: (Google-Suche) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-11]
CHR Extension: (BB10 / PlayBook App Manager) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmbaalodpmjjhpobkgljnelbpblnikkp [2014-05-26]
CHR Extension: (Google Wallet) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (Google Mail) - C:\Users\Maxi\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-11]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BdDesktopParental; C:\Program Files\Bitdefender\Bitdefender 2015\bdparentalservice.exe [77632 2014-08-08] (Bitdefender)
S4 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [585728 2014-01-21] (BlackBerry Limited) [File not signed]
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S3 GSService; C:\Windows\SysWOW64\GSService.exe [490208 2013-06-17] ()
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxbk_device; C:\Windows\system32\lxbkcoms.exe [565928 2008-02-19] ( )
R2 lxbk_device; C:\Windows\SysWOW64\lxbkcoms.exe [537256 2008-02-19] ( )
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()
S4 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [389632 2014-05-07] (Apple Inc.) [File not signed]
S4 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1324544 2014-05-07] (Research In Motion Limited) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
R2 UPDATESRV; C:\Program Files\Bitdefender\Bitdefender 2015\updatesrv.exe [67320 2014-08-08] (Bitdefender)
R2 VSSERV; C:\Program Files\Bitdefender\Bitdefender 2015\vsserv.exe [1513952 2014-08-11] (Bitdefender)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()
R0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [1260120 2014-05-16] (BitDefender)
R3 avchv; C:\Windows\System32\DRIVERS\avchv.sys [261056 2012-11-02] (BitDefender)
R3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [647752 2014-05-16] (BitDefender)
R1 BdfNdisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [93600 2013-11-13] (BitDefender LLC)
R1 bdfwfpf; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [107080 2012-10-29] (BitDefender LLC)
S3 bdfwfpf_pc; C:\Program Files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf_pc.sys [121928 2013-07-02] (Bitdefender SRL)
S3 BDSandBox; C:\Windows\system32\drivers\bdsandbox.sys [82824 2013-11-04] (BitDefender SRL)
S3 DrmRAudio; C:\Windows\System32\drivers\DrmRAudio.sys [34528 2013-03-28] (Windows (R) Win 7 DDK provider)
R0 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [150256 2013-08-23] (BitDefender LLC)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2013-12-02] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [17920 2014-05-07] (Research in Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
S3 SaiH0C2D; C:\Windows\System32\DRIVERS\SaiH0C2D.sys [176128 2007-07-02] (Saitek)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-04-30] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-04-30] (Saitek)
R0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [419616 2014-07-02] (BitDefender S.R.L.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2014-06-23] (TuneUp Software)
S3 usbrndis6; C:\Windows\System32\DRIVERS\usb80236.sys [19968 2013-02-12] (Microsoft Corporation)
S3 WmaCAudio; C:\Windows\System32\drivers\WmaCAudio.sys [34528 2013-06-17] (Windows (R) Win 7 DDK provider)
S3 BTCFilterService; system32\DRIVERS\motfilt.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 motccgp; system32\DRIVERS\motccgp.sys [X]
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 motmodem; system32\DRIVERS\motmodem.sys [X]
S3 MotoSwitchService; system32\DRIVERS\motswch.sys [X]
S3 Motousbnet; system32\DRIVERS\Motousbnet.sys [X]
S3 motusbdevice; system32\DRIVERS\motusbdevice.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-24 18:16 - 2014-09-24 18:16 - 00014993 _____ () C:\Users\Maxi\Desktop\FRST.txt
2014-09-24 18:15 - 2014-09-24 18:15 - 00000000 ____D () C:\Users\Maxi\Desktop\FRST-OlderVersion
2014-09-24 18:13 - 2014-09-24 18:13 - 00001453 _____ () C:\Users\Maxi\Desktop\JRT.txt
2014-09-24 18:10 - 2014-09-24 18:10 - 00000000 ____D () C:\Windows\ERUNT
2014-09-24 18:08 - 2014-09-24 18:08 - 01024790 _____ (Thisisu) C:\Users\Maxi\Desktop\JRT.exe
2014-09-24 18:07 - 2014-09-24 18:07 - 00005655 _____ () C:\Users\Maxi\Desktop\AdwCleaner[S0].txt
2014-09-24 18:01 - 2014-09-24 18:04 - 00000000 ____D () C:\AdwCleaner
2014-09-24 18:00 - 2014-09-24 18:00 - 01373475 _____ () C:\Users\Maxi\Downloads\AdwCleaner_3.310.exe
2014-09-24 17:39 - 2014-09-24 17:39 - 00019591 _____ () C:\Users\Maxi\Desktop\mbam.txt
2014-09-24 17:16 - 2014-09-24 17:17 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-24 17:16 - 2014-09-24 17:16 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-24 17:16 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-09-24 17:16 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-09-24 17:16 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-09-24 17:15 - 2014-09-24 17:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Maxi\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-23 21:07 - 2014-09-23 21:07 - 00020716 _____ () C:\ComboFix.txt
2014-09-23 20:26 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-09-23 20:26 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-09-23 20:26 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-09-23 20:26 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-09-23 20:26 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-09-23 20:26 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-09-23 20:26 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-09-23 20:26 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-09-23 20:25 - 2014-09-23 21:07 - 00000000 ____D () C:\Qoobox
2014-09-23 20:25 - 2014-09-23 20:42 - 00000000 ____D () C:\Windows\erdnt
2014-09-23 20:22 - 2014-09-23 20:22 - 05579290 ____R (Swearware) C:\Users\Maxi\Desktop\ComboFix.exe
2014-09-23 18:01 - 2014-09-23 18:01 - 03129123 _____ () C:\Users\Maxi\Downloads\Anhänge_20140923.zip
2014-09-22 19:47 - 2014-09-24 18:16 - 00000000 ____D () C:\FRST
2014-09-22 19:47 - 2014-09-24 18:15 - 02106880 _____ (Farbar) C:\Users\Maxi\Desktop\FRST64.exe
2014-09-22 19:47 - 2014-09-22 19:48 - 00018221 _____ () C:\Users\Maxi\Downloads\FRST.txt
2014-09-21 13:46 - 2014-09-21 13:47 - 01307544 _____ () C:\Windows\Minidump\092114-18267-01.dmp
2014-09-21 12:47 - 2014-09-21 12:47 - 00001122 _____ () C:\Users\Maxi\Desktop\Amazon Music.lnk
2014-09-21 12:45 - 2014-09-21 12:46 - 39967720 _____ (Amazon) C:\Users\Maxi\Downloads\AmazonMusicInstaller.exe
2014-09-20 11:00 - 2014-09-20 11:00 - 00262144 ____N () C:\Windows\Minidump\092014-41839-01.dmp
2014-09-20 10:49 - 2014-09-20 10:49 - 00001536 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-09-20 10:49 - 2014-09-20 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-09-20 10:48 - 2014-09-20 10:49 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-09-20 10:46 - 2014-09-20 10:46 - 30419936 _____ (DVDVideoSoft Ltd. ) C:\Users\Maxi\Downloads\FreeYouTubeToMP3Converter3.12.44.908.exe
2014-09-20 10:45 - 2014-09-20 10:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 16:31 - 2014-09-17 16:31 - 00076944 _____ (BitDefender) C:\Windows\system32\Drivers\bdvedisk.sys
2014-09-17 16:31 - 2014-09-17 16:31 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-09-17 16:01 - 2014-09-17 16:01 - 00002126 _____ () C:\Users\Public\Desktop\Bitdefender Internet Security 2015.lnk
2014-09-17 16:01 - 2014-09-17 16:01 - 00000684 ____H () C:\bdr-cf01
2014-09-17 16:01 - 2014-09-17 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2015
2014-09-17 16:00 - 2014-05-16 13:04 - 00647752 _____ (BitDefender) C:\Windows\system32\Drivers\avckf.sys
2014-09-17 16:00 - 2014-05-16 13:01 - 01260120 _____ (BitDefender) C:\Windows\system32\Drivers\avc3.sys
2014-09-17 16:00 - 2013-11-13 15:41 - 00093600 _____ (BitDefender LLC) C:\Windows\system32\Drivers\BdfNdisf6.sys
2014-09-17 16:00 - 2013-11-04 15:47 - 00082824 _____ (BitDefender SRL) C:\Windows\system32\Drivers\bdsandbox.sys
2014-09-17 15:55 - 2014-09-17 16:07 - 00000000 ____D () C:\Users\Maxi\AppData\Roaming\Bitdefender
2014-09-17 15:55 - 2014-09-17 16:01 - 00253404 ____H () C:\bdr-ld01
2014-09-17 15:55 - 2014-09-17 16:01 - 00009216 ____H () C:\bdr-ld01.mbr
2014-09-17 15:55 - 2014-07-04 17:49 - 49563064 ____H () C:\bdr-im01.gz
2014-09-17 15:55 - 2013-08-13 13:38 - 03271472 ____H () C:\bdr-bz01
2014-09-17 15:52 - 2014-07-02 17:47 - 00419616 _____ (BitDefender S.R.L.) C:\Windows\system32\Drivers\trufos.sys
2014-09-17 15:52 - 2013-08-23 13:48 - 00150256 _____ (BitDefender LLC) C:\Windows\system32\Drivers\gzflt.sys
2014-09-16 17:23 - 2013-11-04 15:47 - 00074512 _____ (BitDefender SRL) C:\Windows\SysWOW64\bdsandboxuiskin32.dll
2014-09-16 17:14 - 2014-09-17 15:52 - 00000000 ____D () C:\Program Files\Bitdefender
2014-09-16 17:13 - 2014-09-17 16:01 - 00000000 ____D () C:\ProgramData\Bitdefender
2014-09-16 17:13 - 2013-11-04 15:47 - 00084848 _____ (BitDefender SRL) C:\Windows\system32\BDSandBoxUISkin.dll
2014-09-16 17:13 - 2013-11-04 15:46 - 00034384 _____ (BitDefender SRL) C:\Windows\system32\BDSandBoxUH.dll
2014-09-15 18:11 - 2014-09-15 18:11 - 00262144 ____N () C:\Windows\Minidump\091514-25443-01.dmp
2014-09-15 16:51 - 2014-09-17 16:17 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-15 16:39 - 2014-09-15 16:43 - 149527616 _____ () C:\Users\Maxi\Downloads\avira_free_antivirus_de_14.0.6.570.exe
2014-09-14 14:30 - 2014-09-14 14:30 - 00000052 _____ () C:\Users\Maxi\Desktop\z .txt
2014-09-14 13:53 - 2014-09-14 13:53 - 00915646 _____ () C:\Users\Maxi\Downloads\Anschreibe
2014-09-12 22:09 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 22:09 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-12 22:09 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-12 22:09 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 22:09 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 22:09 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-12 22:09 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 22:09 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 22:09 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-12 22:09 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-12 22:09 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 22:09 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 22:08 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 22:08 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 22:08 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 22:08 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 22:08 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 22:08 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 22:08 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 22:08 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 22:08 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-12 22:08 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 22:08 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 22:08 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-12 22:08 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-12 22:08 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 22:08 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 22:08 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 22:08 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-12 22:08 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 22:08 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-12 22:08 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 22:08 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 22:08 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 22:08 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 22:08 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-12 22:08 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 22:08 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 22:08 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 22:08 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 22:08 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-12 22:08 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-12 22:08 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-12 22:08 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 22:08 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 22:08 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 22:08 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 22:08 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 22:08 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 22:08 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 22:08 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-12 22:08 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 22:08 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 22:08 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 22:08 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-12 22:08 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-12 21:59 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 21:59 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-12 15:19 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-12 15:19 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-12 15:18 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-12 15:18 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-12 15:18 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-12 15:18 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-12 15:18 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-12 15:18 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-12 15:18 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-12 15:18 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-12 15:18 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-08-29 17:05 - 2014-09-21 13:46 - 402282750 _____ () C:\Windows\MEMORY.DMP
2014-08-29 17:05 - 2014-08-29 17:05 - 00786120 _____ () C:\Windows\Minidump\082914-30139-01.dmp
2014-08-28 19:12 - 2014-09-24 18:05 - 00195346 _____ () C:\Windows\PFRO.log
2014-08-28 10:17 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 10:17 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 10:17 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-09-24 18:17 - 2014-09-24 18:16 - 00014993 _____ () C:\Users\Maxi\Desktop\FRST.txt
2014-09-24 18:16 - 2014-09-22 19:47 - 00000000 ____D () C:\FRST
2014-09-24 18:15 - 2014-09-24 18:15 - 00000000 ____D () C:\Users\Maxi\Desktop\FRST-OlderVersion
2014-09-24 18:15 - 2014-09-22 19:47 - 02106880 _____ (Farbar) C:\Users\Maxi\Desktop\FRST64.exe
2014-09-24 18:13 - 2014-09-24 18:13 - 00001453 _____ () C:\Users\Maxi\Desktop\JRT.txt
2014-09-24 18:13 - 2009-07-14 06:45 - 00030560 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-24 18:13 - 2009-07-14 06:45 - 00030560 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-24 18:10 - 2014-09-24 18:10 - 00000000 ____D () C:\Windows\ERUNT
2014-09-24 18:10 - 2011-09-03 14:12 - 01271131 _____ () C:\Windows\WindowsUpdate.log
2014-09-24 18:08 - 2014-09-24 18:08 - 01024790 _____ (Thisisu) C:\Users\Maxi\Desktop\JRT.exe
2014-09-24 18:07 - 2014-09-24 18:07 - 00005655 _____ () C:\Users\Maxi\Desktop\AdwCleaner[S0].txt
2014-09-24 18:06 - 2014-07-27 16:58 - 00003656 _____ () C:\Windows\setupact.log
2014-09-24 18:06 - 2011-11-27 18:55 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-24 18:06 - 2011-11-08 21:53 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2014-09-24 18:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-24 18:05 - 2014-08-28 19:12 - 00195346 _____ () C:\Windows\PFRO.log
2014-09-24 18:04 - 2014-09-24 18:01 - 00000000 ____D () C:\AdwCleaner
2014-09-24 18:04 - 2011-09-03 16:34 - 00000993 _____ () C:\Users\Maxi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-24 18:00 - 2014-09-24 18:00 - 01373475 _____ () C:\Users\Maxi\Downloads\AdwCleaner_3.310.exe
2014-09-24 18:00 - 2013-02-19 22:17 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1ce0ede2304e130.job
2014-09-24 17:39 - 2014-09-24 17:39 - 00019591 _____ () C:\Users\Maxi\Desktop\mbam.txt
2014-09-24 17:18 - 2013-07-10 17:03 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-24 17:17 - 2014-09-24 17:16 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-24 17:16 - 2014-09-24 17:16 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-24 17:16 - 2014-09-24 17:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-24 17:15 - 2014-09-24 17:15 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Maxi\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-23 21:07 - 2014-09-23 21:07 - 00020716 _____ () C:\ComboFix.txt
2014-09-23 21:07 - 2014-09-23 20:25 - 00000000 ____D () C:\Qoobox
2014-09-23 21:03 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-09-23 20:46 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-09-23 20:42 - 2014-09-23 20:25 - 00000000 ____D () C:\Windows\erdnt
2014-09-23 20:22 - 2014-09-23 20:22 - 05579290 ____R (Swearware) C:\Users\Maxi\Desktop\ComboFix.exe
2014-09-23 20:22 - 2013-07-10 17:03 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-23 20:22 - 2012-05-16 22:03 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-23 20:22 - 2011-09-03 17:12 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-23 18:01 - 2014-09-23 18:01 - 03129123 _____ () C:\Users\Maxi\Downloads\Anhänge_20140923.zip
2014-09-22 19:48 - 2014-09-22 19:47 - 00018221 _____ () C:\Users\Maxi\Downloads\FRST.txt
2014-09-22 17:48 - 2011-09-04 00:08 - 00699490 _____ () C:\Windows\system32\perfh007.dat
2014-09-22 17:48 - 2011-09-04 00:08 - 00149630 _____ () C:\Windows\system32\perfc007.dat
2014-09-22 17:48 - 2009-07-14 07:13 - 01620932 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-21 13:47 - 2014-09-21 13:46 - 01307544 _____ () C:\Windows\Minidump\092114-18267-01.dmp
2014-09-21 13:46 - 2014-08-29 17:05 - 402282750 _____ () C:\Windows\MEMORY.DMP
2014-09-21 13:46 - 2014-07-27 17:09 - 00000000 ____D () C:\Windows\Minidump
2014-09-21 12:47 - 2014-09-21 12:47 - 00001122 _____ () C:\Users\Maxi\Desktop\Amazon Music.lnk
2014-09-21 12:46 - 2014-09-21 12:45 - 39967720 _____ (Amazon) C:\Users\Maxi\Downloads\AmazonMusicInstaller.exe
2014-09-21 11:54 - 2014-08-08 10:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-20 11:00 - 2014-09-20 11:00 - 00262144 ____N () C:\Windows\Minidump\092014-41839-01.dmp
2014-09-20 10:49 - 2014-09-20 10:49 - 00001536 _____ () C:\Users\Public\Desktop\Free YouTube to MP3 Converter.lnk
2014-09-20 10:49 - 2014-09-20 10:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-09-20 10:49 - 2014-09-20 10:48 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-09-20 10:49 - 2011-09-29 22:04 - 00000000 ____D () C:\Users\Maxi\AppData\Roaming\DVDVideoSoft
2014-09-20 10:46 - 2014-09-20 10:46 - 30419936 _____ (DVDVideoSoft Ltd. ) C:\Users\Maxi\Downloads\FreeYouTubeToMP3Converter3.12.44.908.exe
2014-09-20 10:46 - 2014-09-20 10:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 18:26 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-17 16:31 - 2014-09-17 16:31 - 00076944 _____ (BitDefender) C:\Windows\system32\Drivers\bdvedisk.sys
2014-09-17 16:31 - 2014-09-17 16:31 - 00074512 _____ (BitDefender SRL) C:\Windows\system32\bdsandboxuiskin32.dll
2014-09-17 16:17 - 2014-09-15 16:51 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-17 16:17 - 2012-02-13 16:43 - 00000000 ____D () C:\ProgramData\Avira
2014-09-17 16:07 - 2014-09-17 15:55 - 00000000 ____D () C:\Users\Maxi\AppData\Roaming\Bitdefender
2014-09-17 16:01 - 2014-09-17 16:01 - 00002126 _____ () C:\Users\Public\Desktop\Bitdefender Internet Security 2015.lnk
2014-09-17 16:01 - 2014-09-17 16:01 - 00000684 ____H () C:\bdr-cf01
2014-09-17 16:01 - 2014-09-17 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender 2015
2014-09-17 16:01 - 2014-09-17 15:55 - 00253404 ____H () C:\bdr-ld01
2014-09-17 16:01 - 2014-09-17 15:55 - 00009216 ____H () C:\bdr-ld01.mbr
2014-09-17 16:01 - 2014-09-16 17:13 - 00000000 ____D () C:\ProgramData\Bitdefender
2014-09-17 15:52 - 2014-09-16 17:14 - 00000000 ____D () C:\Program Files\Bitdefender
2014-09-17 15:52 - 2013-09-15 15:07 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-09-15 21:13 - 2012-08-17 09:45 - 00000000 ____D () C:\Users\Maxi\AppData\Roaming\Spotify
2014-09-15 21:05 - 2012-08-17 09:45 - 00000000 ____D () C:\Users\Maxi\AppData\Local\Spotify
2014-09-15 18:11 - 2014-09-15 18:11 - 00262144 ____N () C:\Windows\Minidump\091514-25443-01.dmp
2014-09-15 16:43 - 2014-09-15 16:39 - 149527616 _____ () C:\Users\Maxi\Downloads\avira_free_antivirus_de_14.0.6.570.exe
2014-09-14 14:30 - 2014-09-14 14:30 - 00000052 _____ () C:\Users\Maxi\Desktop\z .txt
2014-09-14 13:53 - 2014-09-14 13:53 - 00915646 _____ () C:\Users\Maxi\Downloads\Anschreibe
2014-09-14 12:15 - 2013-09-16 17:41 - 00000401 _____ () C:\Windows\system32\checkdnsid.xml
2014-09-12 22:07 - 2012-01-18 18:09 - 01594276 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 22:06 - 2013-08-15 22:38 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 22:00 - 2012-01-21 10:48 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-12 21:59 - 2014-05-06 22:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-05 04:10 - 2014-09-12 15:18 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-05 04:05 - 2014-09-12 15:18 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-29 17:05 - 2014-08-29 17:05 - 00786120 _____ () C:\Windows\Minidump\082914-30139-01.dmp
2014-08-29 15:51 - 2011-10-28 14:41 - 00000000 ____D () C:\Users\Maxi\Documents\Flight Simulator X-Dateien
2014-08-28 19:32 - 2012-07-01 12:22 - 00000000 ____D () C:\Users\Maxi\AppData\Roaming\vlc
2014-08-28 19:13 - 2014-07-27 16:58 - 00342528 _____ () C:\Windows\system32\FNTCACHE.DAT
Some content of TEMP:
====================
C:\Users\Maxi\AppData\Local\Temp\Quarantine.exe
C:\Users\Maxi\AppData\Local\Temp\rtdrvmon.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-17 18:18
==================== End Of Log ============================ --- --- ---
--- --- ---
LG Maxi :) |