| |
| |||||||
Log-Analyse und Auswertung: Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
20.10.2014, 19:59
| #1 |
 |  Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hallo, seit einigen Tagen öffnen sich immer wieder Internetseiten mit Werbung, selbst wenn ich Firefox gar nicht geöffnet habe und die Anzahl der gefundenen Spyware etc. ist rasant angestiegen. Seit einiger Zeit funktioniert meine WLan Verbindung auch nur noch sporadisch, wobei das Problem schon länger besteht und wahrscheinlich nichts damit zu tun hat? Mit GMER hatte ich Probleme bei der Ausführung, habe dann den Haken bei Devices entfernt, dann klappte es. Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-20 19:32:12
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Medion\AppData\Local\Temp\ugriypod.sys
---- System - GMER 2.1 ----
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwClose [0x90B70444]
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwCreateFile [0x90B6FC8A]
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwCreateKey [0x90B6F958]
SSDT 8848F514 ZwCreateMutant
SSDT 88499854 ZwCreateProcess
SSDT 884892E4 ZwCreateProcessEx
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwCreateSection [0x90B71520]
SSDT 8848F4DC ZwCreateSymbolicLinkObject
SSDT 8848F5BC ZwCreateThread
SSDT 8848F584 ZwCreateThreadEx
SSDT 8849F2BC ZwCreateUserProcess
SSDT 8848F38C ZwDebugActiveProcess
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwDeleteKey [0x90B6FA68]
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwDeleteValueKey [0x90B6FB5A]
SSDT 8848F4A4 ZwDuplicateObject
SSDT 8848F434 ZwGetContextThread
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwLoadDriver [0x90B70780]
SSDT 8848F62C ZwMapViewOfSection
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwOpenFile [0x90B6FF9C]
SSDT 884A073C ZwOpenProcess
SSDT 8848F664 ZwOpenSection
SSDT 8849F10C ZwOpenThread
SSDT 88494694 ZwRenameKey
SSDT 8849465C ZwRestoreKey
SSDT 8848F3C4 ZwResumeThread
SSDT 8848F3FC ZwSetContextThread
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwSetInformationFile [0x90B700D2]
SSDT 8848F46C ZwSetSystemInformation
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwSetValueKey [0x90B6F77E]
SSDT 8848F354 ZwSystemDebugControl
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwTerminateProcess [0x90B706C8]
SSDT 884871C4 ZwTerminateThread
SSDT \??\C:\Windows\system32\drivers\sp_rsdrv2.sys ZwWriteFile [0x90B702BC]
SSDT 8848F5F4 ZwWriteVirtualMemory
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 8328DA15 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 832C7212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 116F 832CE504 4 Bytes [44, 04, B7, 90] {INC ESP; ADD AL, 0xb7; NOP }
.text ntkrnlpa.exe!KeRemoveQueueEx + 11AF 832CE544 4 Bytes [8A, FC, B6, 90] {MOV BH, AH; MOV DH, 0x90}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11BF 832CE554 4 Bytes [58, F9, B6, 90] {POP EAX; STC ; MOV DH, 0x90}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 832CE564 4 Bytes [14, F5, 48, 88]
.text ntkrnlpa.exe!KeRemoveQueueEx + 11E3 832CE578 8 Bytes [54, 98, 49, 88, E4, 92, 48, ...]
.text ...
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@C5930859 1851
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@5C7ED759 1843
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@93FF0859 1854
Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{A68A6F46-602D-11E0-871E-806E6F6E6963} 21560373688
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
und die Ergebnisse der letzen Suche meines Antivirenprogramms Trend Micro, sowie die Spyware und Virenfunde der letzten Monate (da es so viel ist, muss ich es leider als Datei anhängen). Ich bedanke mich jetzt schon mal für die Geduld und Hilfe von euch  Geändert von Mika_80 (20.10.2014 um 20:22 Uhr) |
|
20.10.2014, 21:15
| #2 |
| /// the machine /// TB-Ausbilder    | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
20.10.2014, 21:31
| #3 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hi Schrauber,
__________________hier die Filelogs vom FRST: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-10-2014
Ran by Miriam II (ATTENTION: The logged in user is not administrator) on MEDION-PC on 20-10-2014 17:04:42
Running from C:\Users\Miriam II\Downloads
Loaded Profile: Miriam II (Available profiles: Medion & Finn & Miriam II)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
() C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-Agent.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
() C:\Program Files\fst_de_76\fst_de_76.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
(1&1 Mail & Media GmbH) C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [Ocs_SM] => C:\Users\Medion\AppData\Roaming\OCS\SM\SearchAnonymizer.exe
HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)
HKLM\...\Run: [fst_de_76] => C:\Program Files\fst_de_76\fst_de_76.exe [3974112 2014-07-01] ()
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-09-22] (APN)
HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\RunOnce: [upfst_de_76.exe] => C:\Users\Medion\AppData\Local\fst_de_76\upfst_de_76.exe [3353080 2014-07-01] ()
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [SpywareTerminatorUpdate] => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [792576 2014-06-04] (1&1 Mail & Media GmbH)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [1und1DispatcherCorp] => C:\Users\Miriam II\AppData\Local\1und1UpdaterCorpE\SchedDispatcher.exe [220808 2013-05-29] (1&1 Mail & Media GmbH)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb65-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb86-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {b636cf64-b326-11e1-b7d9-00262dbfe53b} - F:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Miriam II\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Miriam II\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://medion.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX&q={searchTerms}
SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdjHzygkyNWQHqjF8aaSY_ZQGichEhnzLz-bC0AL9y9ID8zMoHkmqvoqs3uT9BQRQnVIXGBa6ZLqMzq5OBrtaEqnPCo_nY6sCgYm9VQvjlVTfBWjHrbkNQ,,&q={searchTerms}
SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdjHzygkyNWQHqjF8aaSY_ZQGichEhnzLz-bC0AL9y9ID8zMoHkmqvoqs3uT9BQRQnVIXGBa6ZLqMzq5OBrtaEqnPCo_nY6sCgYm9VQvjlVTfBWjHrbkNQ,,&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={8C39A798-654B-4DBB-A405-B51541FC5E32}&mid=7d4b16a558d047d6b19ed16f6b5b0cc8-f2b269effa754ae9f58378cbb5609b05236812b2&lang=de&ds=AVG&pr=fr&d=2012-10-10 18:14:44&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: PriceSparrow -> {3F2DC1E7-A56F-49D8-B0CF-DB2300594497} -> C:\Program Files\PriceSparrow\Internet Explorer\pricesparrow.dll ()
BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: No Name -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} -> No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - No Name - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File
Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {32B29DF0-2237-4370-9A29-37CEBB730E9B} - No File
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563
FF DefaultSearchEngine: Ecosia
FF SelectedSearchEngine: Ecosia
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ask-search.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\Web Search.xml
FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\sweet-page.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\2020Player_IKEA@2020Technologies.com [2014-06-19]
FF Extension: WEB.DE Club MailCheck - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\toolbar@web.de.xpi [2014-05-17]
FF Extension: NoScript - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-17]
FF Extension: Ecosia — The search engine that plants trees! - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2014-10-18]
FF Extension: Adblock Plus - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-17]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]
FF HKLM\...\Firefox\Extensions: [dnshelp@dnshelp.com] - C:\Users\Finn.Medion-PC\AppData\Roaming\Helper
FF Extension: No Name - C:\Users\Finn.Medion-PC\AppData\Roaming\Helper [2014-02-10]
FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\quick_start@gmail.com
FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]
Chrome:
=======
CHR Profile: C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-04]
CHR Extension: (Google Drive) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-04]
CHR Extension: (YouTube) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-04]
CHR Extension: (Google-Suche) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-04]
CHR Extension: (PriceSparrow) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm [2014-10-04]
CHR Extension: (Google Mail) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-04]
CHR HKLM\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\Medion\AppData\Local\funmoods_2.3.1.crx [2014-09-03]
CHR HKLM\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\Medion\AppData\Local\funmoods-speeddial.crx [2014-09-03]
CHR HKLM\...\Chrome\Extension: [kljkanaekoongefljnjbghkgjjocmikm] - C:\Program Files\PriceSparrow\Chrome\pricesparrow-1.4.9.crx [2013-03-11]
CHR HKLM\...\Chrome\Extension: [knkakpihealnpggeceajhaonlmgdkaip] - C:\Users\Medion\AppData\Local\Temp\tbch.crx [2013-03-11]
CHR HKLM\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Medion\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-03-11]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AddonsHelper; C:\Users\Medion\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [896512 2014-02-10] () [File not signed]
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-22] (APN LLC.)
R2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [36936 2014-09-18] (Just Develop It) <==== ATTENTION
S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]
S2 globalUpdate; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-02] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-02] (globalUpdate) [File not signed]
R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 KMService; C:\Windows\system32\srvany.exe [8192 2003-04-18] () [File not signed]
R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NewPlayerUpdaterService; C:\Program Files\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-05-05] () [File not signed]
R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)
R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)
R2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-27] (AVG Secure Search)
S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]
R2 bupService; C:\Users\Medion\AppData\Roaming\BupSystem\bup.exe [X]
S4 LPTSystemUpdater; [X] <==== ATTENTION
R2 SearchAnonymizer; "C:\Users\Medion\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)
S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)
R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)
R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)
R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)
R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
U2 TMAgent; No ImagePath
S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-20 17:04 - 2014-10-20 17:05 - 00030264 _____ () C:\Users\Miriam II\Downloads\FRST.txt
2014-10-20 11:46 - 2014-10-20 17:04 - 00000000 ____D () C:\FRST
2014-10-20 11:44 - 2014-10-20 11:44 - 01102848 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe
2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log
2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable
2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe
2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action
2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim
2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-20 17:04 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-20 17:04 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-20 17:02 - 2014-09-03 17:02 - 00000296 _____ () C:\Windows\Tasks\Funmoods.job
2014-10-20 17:00 - 2011-04-06 10:26 - 01850252 _____ () C:\Windows\WindowsUpdate.log
2014-10-20 16:56 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive
2014-10-20 16:55 - 2014-08-20 19:46 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-10-20 16:55 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub
2014-10-20 16:55 - 2014-07-17 22:09 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-20 16:55 - 2014-07-02 17:54 - 00000876 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2014-10-20 16:54 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-20 16:54 - 2009-07-14 06:39 - 00177123 _____ () C:\Windows\setupact.log
2014-10-20 16:34 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam
2014-10-20 16:32 - 2014-07-17 22:09 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-20 16:32 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-20 16:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion
2014-10-20 11:31 - 2014-05-02 17:31 - 00000000 ____D () C:\Program Files\SupTab
2014-10-20 11:22 - 2014-07-02 17:57 - 00000000 ____D () C:\Program Files\LPT
2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-19 23:41 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans
2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2
2014-10-18 21:45 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-18 16:50 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype
2014-10-18 16:36 - 2014-07-02 17:54 - 00000000 ____D () C:\Users\Medion\AppData\Local\fst_de_76
2014-10-17 17:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe
2014-10-17 16:57 - 2014-07-02 17:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\LPT
2014-10-17 16:47 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-14 00:28 - 2014-05-02 17:19 - 00000000 ____D () C:\Program Files\MyPC Backup
2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-03 06:57 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub
2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment
2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft
2014-09-25 20:21 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-22 07:59 - 2014-09-07 21:20 - 00000000 ____D () C:\FreeOCR
Files to move or delete:
====================
C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
Some content of TEMP:
====================
C:\Users\Medion\AppData\Local\temp\0acncs1a.eea.exe
C:\Users\Medion\AppData\Local\temp\1sv0noim.wxt.exe
C:\Users\Medion\AppData\Local\temp\amazonicon_v4.exe
C:\Users\Medion\AppData\Local\temp\amazoninstallernircmdc.exe
C:\Users\Medion\AppData\Local\temp\APNSetup.exe
C:\Users\Medion\AppData\Local\temp\awtcmhrt.uzg.exe
C:\Users\Medion\AppData\Local\temp\BackupSetup.exe
C:\Users\Medion\AppData\Local\temp\dlLogic.exe
C:\Users\Medion\AppData\Local\temp\dltr.exe
C:\Users\Medion\AppData\Local\temp\erb3vygz.wnz.exe
C:\Users\Medion\AppData\Local\temp\foxy_security_games.exe
C:\Users\Medion\AppData\Local\temp\GCVerifier.dll
C:\Users\Medion\AppData\Local\temp\iodhz2td.rks.exe
C:\Users\Medion\AppData\Local\temp\sdanircmdc.exe
C:\Users\Medion\AppData\Local\temp\sdapskill.exe
C:\Users\Medion\AppData\Local\temp\sdaspwn.exe
C:\Users\Medion\AppData\Local\temp\sdyfmtve.0ap.exe
C:\Users\Medion\AppData\Local\temp\SkypeSetup.exe
C:\Users\Medion\AppData\Local\temp\sweetpage_294wld.exe
C:\Users\Medion\AppData\Local\temp\Uni000.exe
C:\Users\Medion\AppData\Local\temp\vdoiuwkh.d1k.exe
C:\Users\Medion\AppData\Local\temp\verifier.exe
C:\Users\Medion\AppData\Local\temp\vfxpnvpx.lx3.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-10-2014
Ran by Miriam II at 2014-10-20 17:06:25
Running from C:\Users\Miriam II\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Trend Micro Titanium Maximum Security (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Trend Micro Titanium Maximum Security (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1210 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.9.0.1210 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Advanced Disk Recovery (HKLM\...\{2AA44AF4-C116-4219-B800-4573E7E6D421}_is1) (Version: 2.5.500.15827 - Systweak Software)
Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{941B4CE7-3F5D-443E-A8B7-56A420D2EAFD}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version: - )
AudibleManager (HKLM\...\AudibleManager) (Version: 2008373984.48.56.10227058 - Audible, Inc.)
Avidemux 2.5 (HKLM\...\Avidemux 2.5) (Version: 2.5.4.6714 - )
B110 (Version: 140.0.283.000 - Hewlett-Packard) Hidden
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
BF Leselernprogramme 2.0 (HKLM\...\BFLeseDemo) (Version: - )
BF Mathelernprogramme 2.0 (HKLM\...\BFMatheDemo) (Version: - )
BlueStacks App Player (HKLM\...\BlueStacks App Player) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM\...\{FE5ABB0E-EDEA-4023-B0FB-9DEA39A98D76}) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Brick-Force (HKLM\...\Brick-Force) (Version: - Infernum Productions AG)
Browser App (HKLM\...\Browser App) (Version: 1.34.7.1 - app)
BufferChm (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Call of Duty: Ghosts - Multiplayer (HKLM\...\Steam App 209170) (Version: - Infinity Ward)
CHIP Updater (HKLM\...\CHIP Updater_is1) (Version: 2.32 - Abelssoft)
Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2602 - CyberLink Corp.)
CyberLink LabelPrint (Version: 2.5.2602 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (Version: 6.1.3602c - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy (HKLM\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink PowerDVD Copy (Version: 1.5.1306 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2609 - CyberLink Corp.)
CyberLink YouCam (Version: 3.0.2609 - CyberLink Corp.) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - CHIP.de)
Destinations (Version: 140.0.77.000 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Diablo III (HKLM\...\Diablo III) (Version: - Blizzard Entertainment)
Driver Support (HKLM\...\{597FB4A5-DD86-4316-A410-7E8074CC2CCE}) (Version: 8.1 - Driver Support)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
ElsterFormular für Privatanwender (HKLM\...\ElsterFormular für Privatanwender 12.2.1.6570p) (Version: 12.2.1.6570p - Landesfinanzdirektion Thüringen)
Fiesta Online DE (HKCU\...\fiestaonline_de) (Version: - )
Finger Sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.5.4.0 - Sentelic)
Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free Sound Recorder v9.2.7 (HKLM\...\Free Sound Recorder_is1) (Version: - Copyright(C) 2005-2011 FreeSoundRecorder Technologies, Inc.)
Free YouTube to MP3 Converter version 3.11.34.1015 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.34.1015 - DVDVideoSoft Ltd.)
FreeOCR v5.0 (HKLM\...\freeocr_is1) (Version: - )
Funmoods (HKLM\...\funmoods) (Version: - Funmoods) <==== ATTENTION
G DATA Logox4 Speechengine (HKLM\...\lgx4.lgx.server) (Version: - G DATA Software AG)
GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)
Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
Google Drive (HKLM\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)
Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
GPBaseService2 (Version: 140.0.211.000 - Hewlett-Packard) Hidden
Happy Cloud Client (HKCU\...\HappyCloud) (Version: 4.42 - Happy Cloud, Inc.)
Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000 - Hewlett-Packard) Hidden
HotPotatoes v 6.3.0.5 (HKLM\...\hotpot_is1) (Version: - HalfBaked)
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7 (HKLM\...\{59C83C08-63F4-4AEC-81D6-392C5E23B843}) (Version: 14.0 - HP)
HP Product Detection (HKLM\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPAppStudio (Version: 140.0.95.000 - Hewlett-Packard) Hidden
HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden
HPPhotoGadget (Version: 140.0.524.000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 140.0.212.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 140.0.211.000 - Hewlett-Packard) Hidden
HTC Driver Installer (HKLM\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.13.0.003 - HTC Corporation)
HTC Sync Manager (HKLM\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.24.5 - HTC)
HUAWEI DataCard Driver 4.20.12.00 (HKLM\...\HUAWEI DataCard Driver) (Version: 4.20.12.00 - Huawei technologies Co., Ltd.)
iCF Skin Pack (HKLM\...\iCF Skin Pack) (Version: - )
iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)
iColorFolder (HKLM\...\iColorFolder) (Version: - )
IDS Intelligence and Development Scales (HKLM\...\{5093E76B-8BCB-49BA-8AC5-4018D307C771}) (Version: 1.0.0.1 - Verlag Hans Huber, Hogrefe AG, Bern)
IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6208.0 - IDT)
Installer (HKLM\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2302 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)
Intel(R) TV Wizard (HKLM\...\TVWiz) (Version: - Intel Corporation)
IPTInstaller (HKLM\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)
iTunes (HKLM\...\{0A37EE62-9A58-420D-90CC-4E52153112EE}) (Version: 11.3.0.54 - Apple Inc.)
Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden
JMicron Flash Media Controller Driver (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.32.1 - JMicron Technology Corp.)
Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Launch Manager V1.5.0.5 (HKLM\...\{D0846526-66DD-4DC9-A02C-98F9A2806812}) (Version: 1.5.0.5 - Wistron Corp.)
Lesehaus (HKLM\...\InstallShield_{BDADFC84-14B9-4D54-BC34-BD33A7530B00}) (Version: 1.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH)
Lesehaus (Version: 1.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH) Hidden
LPT System Updater Service (Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
Lurs-Minimator (HKLM\...\Lurs-Minimator) (Version: 1.0 - LegaKids)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MarketResearch (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.24.5.3 - Marvell)
Medion Home Cinema (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.1318 - CyberLink Corp.)
Medion Home Cinema (Version: 8.0.1318 - CyberLink Corp.) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Live Add-in 1.4 (HKLM\...\{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}) (Version: 2.0.3008.0 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Facebook 32-bit (HKLM\...\{95140000-007C-0409-0000-0000000FF1CE}) (Version: 14.0.5117.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.40303 - Microsoft Corporation)
Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mobile Connection Manager (HKLM\...\o2DE) (Version: - Mobile Connection Manager)
MobileMe Control Panel (HKLM\...\{5A9AA2C0-972F-4239-AA41-E409434194D5}) (Version: 3.1.8.0 - Apple Inc.)
Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 17.0 (x86 de) (HKLM\...\Mozilla Thunderbird 17.0 (x86 de)) (Version: 17.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPC Backup (HKLM\...\MyPC Backup) (Version: - JDi Backup Ltd) <==== ATTENTION
Network (Version: 140.0.215.000 - Hewlett-Packard) Hidden
NewPlayer (HKLM\...\NewPlayer) (Version: v2.1.1.9 - ) <==== ATTENTION
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Open It! (HKLM\...\OpenIt Open It!) (Version: 1.1.1 - OpenIt)
PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.5.0 - Frank Heindörfer, Philip Chinery)
phase-6 2.3.4 (HKLM\...\phase-6) (Version: 2.3.4 - phase-6)
Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
PriceSparrow (HKLM\...\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}) (Version: 1.4.9 - Ciuvo GmbH) <==== ATTENTION
PS_AIO_07_B110_SW_Min (Version: 140.0.142.000 - Hewlett-Packard) Hidden
QuickTransfer (Version: 140.0.98.000 - Hewlett-Packard) Hidden
REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0148 - REALTEK Semiconductor Corp.)
SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version: - )
Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version: - )
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version: - )
SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)
Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden
ScarletBlade (HKLM\...\ScarletBlade) (Version: - )
SearchAnonymizer (HKLM\...\SearchAnonymizer) (Version: 1.0.1 (de) - )
Secunia PSI (3.0.0.7011) (HKLM\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
Securita Scout (HKLM\...\Securita Scout) (Version: - ) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version: - Microsoft) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
Shopping App by Ask (HKLM\...\{4F524A2D-5354-2D53-5045-A758B70C0F05}) (Version: 12.15.5.31 - APN, LLC)
simfy (HKLM\...\Simfy) (Version: 1.6.10 - simfy AG)
simfy (Version: 1.6.10 - simfy AG) Hidden
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SMART Common Files (HKLM\...\{BBA07B40-F7C6-44F7-BF08-767F8835685F}) (Version: 11.4.194.0 - SMART Technologies ULC)
SMART German Language Pack (HKLM\...\{603E8F13-20D9-4367-81F2-CF6E22D05DA9}) (Version: 11.3.29.0 - SMART Technologies ULC)
SMART Ink (HKLM\...\{5ABC49B5-D0DC-428D-A082-4AEFF6490F04}) (Version: 2.0.720.0 - SMART Technologies ULC)
SMART Notebook (HKLM\...\{E57F6C8B-E159-477E-93BF-764759747BC4}) (Version: 11.3.857.0 - SMART Technologies ULC)
SMART Product Update (HKLM\...\{8D4B716A-0ABE-4238-9090-D208E5F57A5E}) (Version: 5.0.108.0 - SMART Technologies ULC)
SMART Produkttreiber (HKLM\...\{589B09F5-0768-4BE9-B8C0-DD253E6B3643}) (Version: 11.3.550.0 - SMART Technologies ULC)
SmartTools Publishing • Word Falz & Lochmarken-Assistent (HKLM\...\SmartToolsFalz & Lochmarken-Assistentv6.50) (Version: v6.50 - SmartTools Publishing)
SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 140.0.214.000 - Hewlett-Packard) Hidden
Spyware Terminator 2012 (HKLM\...\{56736259-613E-4A3B-B428-6235F2E76F44}_is1) (Version: 3.0.0.82 - Crawler.com)
Status (Version: 140.0.256.000 - Hewlett-Packard) Hidden
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version: - Bethesda Game Studios)
The Sea App (Internet Explorer) (HKLM\...\The Sea App) (Version: - Growth Systems, LLC) <==== ATTENTION
TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Toolbox (Version: 140.0.428.000 - Hewlett-Packard) Hidden
TrayApp (Version: 140.0.212.000 - Hewlett-Packard) Hidden
Trend Micro Titanium (Version: 7.0 - Trend Micro Inc.) Hidden
Trend Micro Titanium Maximum Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 7.0 - Trend Micro Inc.)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
VoiceOver Kit (HKLM\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)
WEB.DE Club SmartFax (HKLM\...\WEB.DE Club SmartFax) (Version: 2.00.223 - WEB.DE GmbH)
WEB.DE Online-Speicher 1.7.3288.0 (HKCU\...\WEB.DE Application {sync-000021}) (Version: 1.7.3288.0 - 1&1 Mail & Media GmbH)
WEB.DE Softwareaktualisierung CE (HKCU\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.1 - 1&1 Mail & Media GmbH)
WebReg (Version: 140.0.212.017 - Hewlett-Packard) Hidden
Winamp (HKLM\...\Winamp) (Version: 5.63 - Nullsoft, Inc)
Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)
WinPatrol (HKLM\...\{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}) (Version: 28.5.2013.0 - BillP Studios)
WinRAR 5.10 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
Yahoo Community Smartbar (HKLM\...\{3BC7022B-CDE0-4664-9AB6-E3EC25CE644A}) (Version: 11.63.66.17714 - Linkury Inc.) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:04 - 2013-07-23 13:41 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\AllmyappsUpdateTask.job => ?
Task: C:\Windows\Tasks\Funmoods.job => ?
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2014-08-06 13:42 - 2014-08-06 13:42 - 00821600 _____ () C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe
2014-05-14 21:58 - 2013-01-16 03:50 - 00039424 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc110-mt-1_49.dll
2014-05-14 21:58 - 2013-01-16 03:55 - 00049152 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc110-mt-1_49.dll
2014-05-15 17:59 - 2013-12-18 15:33 - 00047784 _____ () C:\Program Files\Trend Micro\Titanium\plugin\fcMsgDispatcher.dll
2014-07-02 17:54 - 2014-07-01 13:17 - 03974112 _____ () C:\Program Files\fst_de_76\fst_de_76.exe
2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-08-13 13:30 - 2013-08-29 09:58 - 00882584 _____ () C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\WLMailApiCore.dll
2014-10-20 16:55 - 2014-10-20 16:55 - 00098816 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32api.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00110080 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pywintypes27.dll
2014-10-20 16:55 - 2014-10-20 16:55 - 00364544 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pythoncom27.dll
2014-10-20 16:55 - 2014-10-20 16:55 - 00045568 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_socket.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 01160704 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_ssl.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00320512 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32com.shell.shell.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00713216 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_hashlib.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 01175040 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._core_.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00805888 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._gdi_.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00811008 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._windows_.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 01062400 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._controls_.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00735232 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._misc_.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00128512 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_elementtree.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00127488 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pyexpat.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00557056 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pysqlite2._sqlite.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00007168 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\hashobjs_ext.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00087552 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_ctypes.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00119808 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32file.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00108544 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32security.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00018432 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32event.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00038912 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32inet.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00070656 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._html2.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00167936 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32gui.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00011264 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32crypt.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00027136 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_multiprocessing.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00686080 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\unicodedata.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00122368 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._wizard.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00010240 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\select.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00024064 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32pipe.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00025600 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32pdh.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00525640 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\windows._lib_cacheinvalidation.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00035840 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32process.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00017408 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32profile.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00022528 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32ts.pyd
2014-10-20 16:55 - 2014-10-20 16:55 - 00078336 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._animate.pyd
2014-08-03 21:18 - 2014-09-27 02:23 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-05-14 21:51 - 2013-07-23 17:28 - 00039424 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_date_time-vc110-mt-1_49.dll
2014-05-14 21:51 - 2013-07-23 17:28 - 00049152 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_thread-vc110-mt-1_49.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: CLMLServer => "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: HotkeyApp => "C:\Program Files\Launch Manager\HotkeyApp.exe"
MSCONFIG\startupreg: LMgrVolOSD => "C:\Program Files\Launch Manager\OSD.exe"
MSCONFIG\startupreg: sbsdk-server => "C:\Program Files\SMART Technologies\Education Software\sbsdk-server\NodeLauncher.exe"
MSCONFIG\startupreg: SMART Board Service => "C:\Program Files\SMART Technologies\Education Software\SMARTBoardService.exe" -d
MSCONFIG\startupreg: SMART Floating Tools => "C:\Program Files\SMART Technologies\Education Software\FloatingTools.exe"
MSCONFIG\startupreg: SMART Ink => "C:\Program Files\SMART Technologies\Education Software\SMARTInk.exe" -a
MSCONFIG\startupreg: SMART Tray Tools => "C:\Program Files\SMART Technologies\Education Software\SMARTTrayIcon.exe"
MSCONFIG\startupreg: SMARTNotification => "C:\Program Files\SMART Technologies\Education Software\SMARTNotification.exe"
MSCONFIG\startupreg: Wbutton => "C:\Program Files\Launch Manager\Wbutton.exe"
MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-634998973-2183486359-2024787897-500 - Administrator - Disabled)
Finn (S-1-5-21-634998973-2183486359-2024787897-1003 - Limited - Enabled) => C:\Users\Finn.Medion-PC
Gast (S-1-5-21-634998973-2183486359-2024787897-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-634998973-2183486359-2024787897-1002 - Limited - Enabled)
Medion (S-1-5-21-634998973-2183486359-2024787897-1000 - Administrator - Enabled) => C:\Users\Medion
Miriam II (S-1-5-21-634998973-2183486359-2024787897-1004 - Limited - Enabled) => C:\Users\Miriam II
==================== Faulty Device Manager Devices =============
Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: SMART Virtual TabletPC
Description: SMART Virtual TabletPC
Class Guid: {745a17a0-74d3-11d0-b6fe-00a0c90f57da}
Manufacturer: SMART Technologies ULC
Service: SMARTVTabletPCx86
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Photosmart B110 series
Description: Photosmart B110 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/20/2014 04:55:18 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1192846
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1192846
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 21762
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 21762
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 20733
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 20733
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (10/20/2014 04:55:18 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (10/20/2014 04:54:51 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 20.10.2014 um 16:36:47 unerwartet heruntergefahren.
Error: (10/20/2014 04:32:43 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (10/20/2014 01:14:50 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "O2BOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{1246FD9E-6FC8-4FDD-A385-0B718CE4076E-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (10/20/2014 10:47:25 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (10/20/2014 00:37:39 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (10/19/2014 11:36:44 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Error: (10/19/2014 09:31:13 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "O2BOX",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{1246FD9E-6FC8-4FDD-A385-0B718CE4076E-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (10/19/2014 08:30:33 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "Windows Search" wurde nicht richtig gestartet.
Error: (10/19/2014 08:25:29 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet:
%%1064
Microsoft Office Sessions:
=========================
Error: (10/20/2014 04:55:18 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )
Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service. Service did not stop gracefully the last time it was run.
bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)
bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1192846
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1192846
Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 21762
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 21762
Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 20733
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 20733
Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
CodeIntegrity Errors:
===================================
Date: 2013-07-08 01:02:14.997
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:14.717
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:14.447
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:14.177
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:13.907
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:13.637
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:13.367
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:02:13.097
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:00:30.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2013-07-08 01:00:30.181
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz
Percentage of memory in use: 44%
Total physical RAM: 3004.87 MB
Available physical RAM: 1661.01 MB
Total Pagefile: 6008.03 MB
Available Pagefile: 4169.45 MB
Total Virtual: 2047.88 MB
Available Virtual: 1915.38 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:266.99 GB) (Free:59.04 GB) NTFS
Drive d: (Recover) (Fixed) (Total:30 GB) (Free:22.44 GB) NTFS
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.26.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.17358 Miriam II :: MEDION-PC [limited] 18.10.2014 21:30:00 mbam-log-2014-10-18 (21-30-00).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 257259 Time elapsed: 32 minute(s), 7 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 32 HKCR\f (PUP.Funmoods) -> No action taken. HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> No action taken. HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> No action taken. HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> No action taken. HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> No action taken. HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> No action taken. HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\funmoods.funmoodsHlpr.1 (PUP.Funmoods) -> Delete on reboot. HKCR\funmoods.funmoodsHlpr (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.Funmoods) -> Delete on reboot. HKCR\esrv.funmoodsESrvc.1 (PUP.Funmoods) -> Delete on reboot. HKCR\esrv.funmoodsESrvc (PUP.Funmoods) -> Delete on reboot. HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Delete on reboot. HKCR\escort.escortIEPane (PUP.Funmoods) -> Delete on reboot. HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Funmoods) -> Delete on reboot. HKCR\funmoods.dskBnd.1 (PUP.Funmoods) -> Delete on reboot. HKCR\funmoods.dskBnd (PUP.Funmoods) -> Delete on reboot. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Quarantined and deleted successfully. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Delete on reboot. HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Delete on reboot. HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Delete on reboot. HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Quarantined and deleted successfully. Registry Values Detected: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> No action taken. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> No action taken. Files Detected: 12 C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.Funmoods) -> No action taken. C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> No action taken. C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> No action taken. C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.Funmoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.Funmoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.Funmoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.Funmoods) -> Delete on reboot. c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot. (end) Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.26.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.17358 Miriam II :: MEDION-PC [limited] 18.10.2014 22:38:18 mbam-log-2014-10-18 (22-38-18).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 256097 Time elapsed: 26 minute(s), 11 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 11 HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot. HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot. Registry Values Detected: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot. Files Detected: 12 C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully. c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot. C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> Quarantined and deleted successfully. C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot. (end) Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.26.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.17358 Miriam II :: MEDION-PC [limited] 19.10.2014 21:24:22 mbam-log-2014-10-19 (21-24-22).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 256171 Time elapsed: 29 minute(s), 46 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 11 HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot. HKCR\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1} (PUP.Funmoods) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot. Registry Values Detected: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot. Files Detected: 10 c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot. (end) Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.26.05 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 11.0.9600.17358 Miriam II :: MEDION-PC [limited] 20.10.2014 00:08:00 mbam-log-2014-10-20 (00-08-00).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 256683 Time elapsed: 25 minute(s), 47 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 11 HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot. HKCR\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1} (PUP.Funmoods) -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot. HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot. HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot. Registry Values Detected: 3 HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: -> Quarantined and deleted successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot. HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot. Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 4 c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot. Files Detected: 10 c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot. C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot. (end) |
|
20.10.2014, 21:39
| #4 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Und last but not least Trend Micro: Letzte Suche: Code:
ATTFilter Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von
20.10.2014 11:19,ADW_LINKY,Spyware,C:\Program Files\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:19,ADW_LINKY,Spyware,C:\Program Files\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange
20.10.2014 11:31,ADW_SIDETAB,Spyware,C:\Program Files\SupTab\DpInterface32.dll,Entfernt,Echtzeitsuche
Code:
ATTFilter Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von,Von,An,Betreff,Protokoll
24.07.2014 17:22,HEU_AEGISCS010,Bedrohung,C:\Windows\Temp\_E8F7.exe,Entfernt,Echtzeitsuche,
24.07.2014 17:22,HEU_AEGISCS010,Bedrohung,c:\windows\system32\dlprotectsvc.exe,Entfernt,Echtzeitsuche,
25.07.2014 22:02,TROJ_GEN.R0CCC0OGO14,Malware,C:\Program Files\LPT\srptsl.exe,Entfernt,Echtzeitsuche,
03.08.2014 20:28,HEU_AEGISCS010,Bedrohung,C:\Windows\Temp\_65D3.exe,Entfernt,Echtzeitsuche,
03.08.2014 20:28,HEU_AEGISCS010,Bedrohung,c:\windows\system32\dlprotectsvc.exe,Entfernt,Echtzeitsuche,
20.08.2014 11:14,TROJ_GEN.R0C1C0OHH14,Malware,C:\program files\lpt\smartbar.monetization.proxy.proxyremover.exe,Entfernt,Echtzeitsuche,
21.08.2014 20:42,JS_URYLINK.A,Bedrohung,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\chrome\FirefoxExtensionMain.js,Entfernt,Echtzeitsuche,
22.08.2014 15:57,TROJ_GEN.R0C1C0OHH14,Malware,C:\program files\lpt\Smartbar.Monetization.Proxy.ProxyRemover.exe,Entfernt,Suchauftrag in Warteschlange,
14.10.2014 00:27,TROJ_SPNR.0CJA14,Bedrohung,C:\program files\mypc backup\MyPC Backup.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:09,TROJ_SPNR.25IN14,Bedrohung,C:\Users\Medion\AppData\Local\Temp\is-RIGBI.tmp\InstallManager.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:10,TROJ_SPNR.25IN14,Bedrohung,C:\Users\Medion\AppData\Local\Temp\is-RIGBI.tmp\InstallManagerNS.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\JS\ta.js,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:13,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\bg.js,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:14,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\chrome\FirefoxExtensionMain.js,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 13:41,TROJ_GEN.R047C0VJ814,Malware,C:\Users\Medion\AppData\Local\fst_de_76\Download\setup_recover_fst_de_173.exe,Entfernt,Suchauftrag in Warteschlange,
Code:
ATTFilter Datum/Uhrzeit,Name der Bedrohung,Infizierte Datei,Maßnahme,Entdeckt von,Von,An,Betreff,Protokoll
21.08.2014 20:39,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.DLL,Entfernt,Echtzeitsuche,
21.08.2014 20:39,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.DLL,Entfernt,Echtzeitsuche,
21.08.2014 20:42,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.exe,Entfernt,Echtzeitsuche,
21.08.2014 20:42,ADW_LINKY,S-1-5-21-634998973-2183486359-2024787897-1000\Software\Microsoft\Windows\CurrentVersion\Run,Entfernt,Echtzeitsuche,
21.08.2014 20:42,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_28.dll,Entfernt,Echtzeitsuche,
21.08.2014 20:43,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_29.dll,Entfernt,Echtzeitsuche,
21.08.2014 20:43,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_30.dll,Entfernt,Echtzeitsuche,
22.08.2014 15:57,ADW_LINKY,C:\program files\lpt\linmsl.exe,Entfernt,Suchauftrag in Warteschlange,
22.08.2014 16:00,ADW_LINKY,C:\program files\lpt\srptm.exe,Entfernt,Suchauftrag in Warteschlange,
22.08.2014 16:01,ADW_LINKY,C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll,Entfernt,Suchauftrag in Warteschlange,
27.08.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_26.dll,Entfernt,Echtzeitsuche,
27.08.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_27.dll,Entfernt,Echtzeitsuche,
03.09.2014 17:02,ADW_INSTALLCORE,C:\Users\Finn.Medion-PC\AppData\Local\temp\is1275519350\uninstaller.exe,Entfernt,Echtzeitsuche,
03.09.2014 17:02,ADW_INSTALLCORE,C:\Users\Finn.Medion-PC\AppData\Local\temp\is1275519350\uninstaller.exe,Entfernt,Echtzeitsuche,
06.09.2014 10:28,ADW_EOREZO,C:\program files\fst_de_76\unins000.exe,Entfernt,Suchauftrag in Warteschlange,
06.09.2014 10:28,ADW_EOREZO,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyRemover.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\linmsl.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptm.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptsl.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\BrowserHelper.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ChromeHost.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Lrcnta.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\MACTrackBarLib.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\NDde.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:02,ADW_URYLINK,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\JS\documentEvents.js,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_30.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sgml.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smta.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spsm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spusm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srau.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbhu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbs.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sreu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srgu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srns.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srom.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srprl.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srpu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsbs.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsbsau.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsl.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sruhs.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srus.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srut.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.DMP.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:08,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\spup.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:09,ADW_ELEX,C:\Users\Medion\AppData\Local\Temp\fullpackage_temp1399044609\tmp\wpm.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\lrcnt.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sidb.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\siem.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sipb.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sismlp.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smti.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smtu.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:17,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spbe.dll,Entfernt,Suchauftrag in Warteschlange,
17.10.2014 17:17,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spbl.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:19,ADW_LINKY,C:\Program Files\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:19,ADW_LINKY,C:\Program Files\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange,
20.10.2014 11:31,ADW_SIDETAB,C:\Program Files\SupTab\DpInterface32.dll,Entfernt,Echtzeitsuche,
ich dachte SMARTBAR hätte ich am 17.10.14 deinstalliert (weiß nicht, ob das relevant ist). |
|
21.10.2014, 18:21
| #5 |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Unsere Tools brauchen immer Adminrechte. Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.10.2014, 09:42
| #6 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hallo Schrauber, hier die Logfile von Adwcleaner: Code:
ATTFilter # AdwCleaner v4.001 - Bericht erstellt am 21/10/2014 um 22:56:21
# DB v2014-10-21.1
# Aktualisiert 20/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzername : Medion - MEDION-PC
# Gestartet von : C:\Users\Medion\Downloads\AdwCleaner_4.001.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : AddonsHelper
[#] Dienst Gelöscht : globalUpdate
[#] Dienst Gelöscht : globalUpdatem
Dienst Gelöscht : SearchAnonymizer
[#] Dienst Gelöscht : KMService
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Allin1Convert_8h
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Program Files\AppGraffiti
Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files\Common Files\AVG Secure Search
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\BabSolution
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Program Files\Browser App
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
Ordner Gelöscht : C:\Users\Mika\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Delta
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\ProgramData\DNSErrorHelper
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DSite
Ordner Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\iw38tv23.default\FoxTab
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FrEeSoFtOdAy
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\FromDocToPDF_65
Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Funmoods
[!] Ordner Gelöscht : C:\Program Files\globalUpdate
Ordner Gelöscht : C:\Users\Medion\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Windows\system32\config\systemprofile\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\HPAppData
Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\Users\Miriam II\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\ProgramData\IePluginService
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\iLivid
Ordner Gelöscht : C:\Program Files\Inbox Toolbar
Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Inbox Toolbar
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\Inbox Toolbar
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\InetStat
Ordner Gelöscht : C:\Program Files\LPT
Ordner Gelöscht : C:\Users\Medion\AppData\Local\LPT
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\mt_ffx
Ordner Gelöscht : C:\Program Files\MyPC Backup
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\OCS
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!
Ordner Gelöscht : C:\Program Files\openit
Ordner Gelöscht : C:\Users\Mika\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\Miriam II\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RebateInformer
[#] Ordner Gelöscht : C:\Program Files\RebateInformer
Ordner Gelöscht : C:\Program Files\RegClean Pro
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\Security Systems
Ordner Gelöscht : C:\Program Files\SiteRanker
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\LocalLow\SiteRanker
Ordner Gelöscht : C:\Users\Miriam II\AppData\LocalLow\SiteRanker
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Program Files\SupTab
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Miriam II\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\torch
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\torch
Ordner Gelöscht : C:\ProgramData\torchcrashhandler
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Zwinky_5q
Ordner Gelöscht : C:\ProgramData\Allmyapps
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Allmyapps
Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Allmyapps
Ordner Gelöscht : C:\Program Files\fst_de_76
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\fst_de_76
Ordner Gelöscht : C:\Users\Medion\AppData\Local\fst_de_76
Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\fst_de_76
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\5qffxtbr@Zwinky_5q.com
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\65ffxtbr@FromDocToPDF_65.com
Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\8hffxtbr@Allin1Convert_8h.com
Ordner Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\iw38tv23.default\Extensions\isreaditlater@ideashower.com
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm
Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm
Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Datei Gelöscht : C:\Users\Medion\AppData\Local\CRE\plmlpkfpkijnlijgalnjaacllnjmoamo.crx
Datei Gelöscht : C:\Users\Finn.Medion-PC\iLivid.lnk
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\iLivid.lnk
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qtrax Player.lnk
Datei Gelöscht : C:\Windows\system32\roboot.exe
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Torch.lnk
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torch.lnk
Datei Gelöscht : C:\Windows\system32\srvany.exe
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\bprotector_prefs.js
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\invalidprefs.js
Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\11-suche.xml
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ask-search.xml
Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\searchplugins\ask-web-search.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml
Datei Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\y50zck82.default\searchplugins\Conduit.xml
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\funmoods.xml
Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\sweet-page.xml
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\user.js
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage
Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\user data\default\bprotector web data
***** [ Tasks ] *****
Task Gelöscht : Dealply
Task Gelöscht : DSite
Task Gelöscht : Funmoods
Task Gelöscht : globalUpdateUpdateTaskMachineCore
Task Gelöscht : RunAsStdUser Task
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\Desktop\Search.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk
Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
***** [ Registrierungsdatenbank ] *****
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\knkakpihealnpggeceajhaonlmgdkaip
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [InetStat]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NTRedirect]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [qtraxnotification]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Ocs_SM]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [fst_de_76]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_icolorfolder_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_icolorfolder_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vuescan_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vuescan_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9B6B03F1-16CF-4491-BBBB-E872802DD717}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B424109-6F99-4306-8F2B-0B2BB1C8C415}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C0EB0A9-265F-4D9D-AF96-0EF2403A73E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9DF046E1-80F7-43E0-80C0-0AD696799C8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D0FD0502-5878-441D-A3C0-9A4531C526CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3E46008-1902-41A7-91C7-26EC6E0B66D2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\BABSOLUTION
Schlüssel Gelöscht : HKCU\Software\Ciuvo
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\FreeSoftToday
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\InetStat
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\qtrax
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKCU\Software\TutoTag
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Plus-HD-2.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Driver-Soft
Schlüssel Gelöscht : HKLM\SOFTWARE\FrEeSoFtOdAy
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\Plus-HD-2.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab
Schlüssel Gelöscht : HKLM\SOFTWARE\supWPM
Schlüssel Gelöscht : HKLM\SOFTWARE\sweet-pageSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : HKLM\SOFTWARE\Wpm
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DSite
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Opener Packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2AA44AF4-C116-4219-B800-4573E7E6D421}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser App
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\openit open it!
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2E0D3DD9E5E4B74CA43BCE77815E287
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17344
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v32.0.3 (x86 de)
-\\ Google Chrome v38.0.2125.104
*************************
AdwCleaner[R0].txt - [32736 octets] - [21/10/2014 22:50:00]
AdwCleaner[S0].txt - [30986 octets] - [21/10/2014 22:56:21]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [31047 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Home Premium x86
Ran by Medion on 21.10.2014 at 23:06:16,80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
~~~ Files
Successfully deleted: [File] "C:\Users\Medion\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"
Successfully deleted: [File] C:\Windows\prefetch\DRIVERSUPPORT.EXE-42650329.pf
Successfully deleted: [File] "C:\Windows\wininit.ini"
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Medion\AppData\Roaming\zip opener packages"
Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"
~~~ FireFox
Successfully deleted the following from C:\Users\Medion\AppData\Roaming\mozilla\firefox\profiles\q5jk1lre.default\prefs.js
user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdj
user_pref("extensions.ORJ-SPE.previous-keyword-url", "\"hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-Br
user_pref("extensions.delta.admin", false);
user_pref("extensions.delta.aflt", "babsst");
user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");
user_pref("extensions.delta.autoRvrt", "false");
user_pref("extensions.delta.dfltLng", "de");
user_pref("extensions.delta.excTlbr", false);
user_pref("extensions.delta.ffxUnstlRst", true);
user_pref("extensions.delta.id", "c6f9f0ad0000000000000025d32f37e3");
user_pref("extensions.delta.instlDay", "15914");
user_pref("extensions.delta.instlRef", "sst");
user_pref("extensions.delta.newTab", false);
user_pref("extensions.delta.prdct", "delta");
user_pref("extensions.delta.prtnrId", "delta");
user_pref("extensions.delta.rvrt", "false");
user_pref("extensions.delta.smplGrp", "none");
user_pref("extensions.delta.tlbrId", "base");
user_pref("extensions.delta.tlbrSrchUrl", "");
user_pref("extensions.delta.vrsn", "1.8.22.0");
user_pref("extensions.delta.vrsnTs", "1.8.22.012:20:08");
user_pref("extensions.delta.vrsni", "1.8.22.0");
user_pref("extensions.delta_i.babExt", "");
user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=4957");
user_pref("extensions.delta_i.srcExt", "ss");
user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true);
user_pref("extensions.ffxtlbr@funmoods.com.install-event-fired", true);
user_pref("extensions.funmoods.aflt", "ironpubd");
user_pref("extensions.funmoods.appId", "{EA28B360-05E0-4F93-8150-02891F1D8D3C}");
user_pref("extensions.funmoods.cd", "2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q");
user_pref("extensions.funmoods.cr", "494165744");
user_pref("extensions.funmoods.dfltLng", "");
user_pref("extensions.funmoods.dfltSrch", true);
user_pref("extensions.funmoods.dnsErr", true);
user_pref("extensions.funmoods.excTlbr", false);
user_pref("extensions.funmoods.hmpg", true);
user_pref("extensions.funmoods.hmpgUrl", "hxxp://searchfunmoods.com/?f=1&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtC
user_pref("extensions.funmoods.id", "00262DBFE53BF0AD");
user_pref("extensions.funmoods.instlDay", "16316");
user_pref("extensions.funmoods.instlRef", "");
user_pref("extensions.funmoods.newTabUrl", "hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtF
user_pref("extensions.funmoods.prdct", "funmoods");
user_pref("extensions.funmoods.prtnrId", "funmoods");
user_pref("extensions.funmoods.srchPrvdr", "Funmoods");
user_pref("extensions.funmoods.tlbrId", "base");
user_pref("extensions.funmoods.tlbrSrchUrl", "hxxp://searchfunmoods.com/?f=3&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyE
user_pref("extensions.funmoods.vrsn", "1.8.27.0");
user_pref("extensions.funmoods.vrsni", "1.8.27.0");
user_pref("extensions.funmoods_i.hmpg", true);
user_pref("extensions.funmoods_i.newTab", false);
user_pref("extensions.funmoods_i.smplGrp", "none");
user_pref("extensions.funmoods_i.vrsnTs", "1.8.27.017:1:16");
user_pref("extensions.helperbar.SmartbarDisabled", false);
user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\",\\\".search.yahoo.com\\\\\\/yhs\\\\\\/search?hspart=lk
user_pref("extensions.inboxcomtoolbar@inbox.com.install-event-fired", true);
user_pref("extensions.toolbar_ORJ-SPE@apn.ask.com.install-event-fired", true);
user_pref("extensions.toolbar_ORJ-ST-SPE@apn.ask.com.install-event-fired", true);
Emptied folder: C:\Users\Medion\AppData\Roaming\mozilla\firefox\profiles\q5jk1lre.default\minidumps [14 files]
~~~ Chrome
Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh
Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj
Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm
Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.10.2014 at 23:08:19,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-10-2014
Ran by Medion (administrator) on MEDION-PC on 21-10-2014 23:11:55
Running from C:\Users\Miriam II\Downloads
Loaded Profile: Medion (Available profiles: Medion & Finn & Miriam II)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-UpdaterService.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Nero AG) C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe
(Crawler.com) C:\Program Files\Spyware Terminator\st_rsser.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
() C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-Agent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [436800 2013-07-15] (BillP Studios)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps] => "C:\Users\Medion\AppData\Roaming\Allmyapps\Allmyapps.exe" startup
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps Update] => "C:\Users\Medion\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk
ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
Startup: C:\Users\Miriam II\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Miriam II\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1003\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default
FF NewTab: chrome://quick_start/content/index.html
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]
FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]
CHR Extension: (Google Docs) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-19]
CHR Extension: (Google Drive) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-20]
CHR Extension: (YouTube) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-19]
CHR Extension: (Google-Suche) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-19]
CHR Extension: (Google Tabellen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]
CHR Extension: (Google Wallet) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-19]
CHR Extension: (Google Mail) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-19]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]
R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)
R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)
S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]
S2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)
S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)
R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)
R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)
R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)
R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
U2 TMAgent; No ImagePath
S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-21 23:11 - 2014-10-21 23:11 - 00000000 ____D () C:\Users\Miriam II\Downloads\FRST-OlderVersion
2014-10-21 23:08 - 2014-10-21 23:08 - 00006213 _____ () C:\Users\Medion\Desktop\JRT.txt
2014-10-21 23:05 - 2014-10-21 23:05 - 01706144 _____ (Thisisu) C:\Users\Medion\Downloads\JRT.exe
2014-10-21 23:01 - 2014-10-21 23:01 - 00031128 _____ () C:\Users\Medion\Desktop\AdwCleaner[S0].txt
2014-10-21 22:48 - 2014-10-21 22:57 - 00000000 ____D () C:\AdwCleaner
2014-10-21 22:47 - 2014-10-21 22:47 - 01962496 _____ () C:\Users\Medion\Downloads\AdwCleaner_4.001.exe
2014-10-21 21:41 - 2014-10-21 21:41 - 00000048 _____ () C:\Users\Public\Documents\_rgpl
2014-10-21 21:35 - 2014-10-21 21:35 - 00000420 _____ () C:\Users\Medion\Desktop\Letzte Suche.csv
2014-10-21 20:31 - 2014-10-21 20:31 - 00001226 _____ () C:\Users\Medion\Desktop\Revo Uninstaller.lnk
2014-10-21 20:31 - 2014-10-21 20:31 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-10-21 20:29 - 2014-10-21 20:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Medion\Downloads\revosetup95.exe
2014-10-20 21:21 - 2014-10-20 21:21 - 00000000 ____D () C:\Users\Medion\AppData\Local\com
2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-10-20 21:14 - 2014-10-20 21:15 - 01209696 _____ () C:\Users\Medion\Downloads\Player_Setup.exe
2014-10-20 20:44 - 2014-10-20 20:44 - 00007805 _____ () C:\Users\Miriam II\Desktop\GMER.txt
2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\Program Files\7-Zip
2014-10-20 20:34 - 2014-10-20 20:35 - 01110476 _____ () C:\Users\Miriam II\Downloads\7z920.exe
2014-10-20 19:32 - 2014-10-20 19:32 - 00007805 _____ () C:\Users\Medion\Desktop\gmer.txt
2014-10-20 19:11 - 2014-10-20 19:30 - 00007805 _____ () C:\Users\Medion\Desktop\gmer.log
2014-10-20 17:30 - 2014-10-20 17:30 - 00146376 _____ () C:\Windows\Minidump\102014-18891-01.dmp
2014-10-20 17:15 - 2014-10-20 17:16 - 00380416 _____ () C:\Users\Miriam II\Downloads\Gmer-19357.exe
2014-10-20 17:06 - 2014-10-20 17:07 - 00043008 _____ () C:\Users\Miriam II\Downloads\Addition.txt
2014-10-20 17:04 - 2014-10-21 23:11 - 00025145 _____ () C:\Users\Miriam II\Downloads\FRST.txt
2014-10-20 11:46 - 2014-10-21 23:11 - 00000000 ____D () C:\FRST
2014-10-20 11:44 - 2014-10-21 23:11 - 01102336 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe
2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log
2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable
2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe
2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action
2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim
2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-21 23:09 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-21 23:09 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-21 23:02 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype
2014-10-21 23:01 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub
2014-10-21 22:59 - 2014-08-20 19:46 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-10-21 22:59 - 2014-07-17 22:09 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-21 22:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-21 22:59 - 2009-07-14 06:39 - 00177515 _____ () C:\Windows\setupact.log
2014-10-21 22:59 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-10-21 22:58 - 2011-04-06 10:26 - 01945789 _____ () C:\Windows\WindowsUpdate.log
2014-10-21 22:58 - 2010-05-05 19:37 - 00340790 _____ () C:\Windows\PFRO.log
2014-10-21 22:57 - 2014-07-02 17:57 - 00001041 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-21 22:57 - 2014-07-02 17:57 - 00001011 _____ () C:\Users\Medion\Desktop\Search.lnk
2014-10-21 22:57 - 2013-07-26 12:24 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-21 22:57 - 2013-07-26 12:24 - 00001011 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-21 22:57 - 2012-05-13 12:57 - 00000000 ____D () C:\Users\Medion\AppData\Local\CRE
2014-10-21 22:57 - 2011-04-19 18:23 - 00000000 ____D () C:\Users\Finn.Medion-PC
2014-10-21 22:57 - 2011-04-06 10:28 - 00001154 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-21 22:18 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-21 22:14 - 2014-07-17 22:09 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-21 22:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-21 22:03 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam
2014-10-21 22:02 - 2011-11-28 14:24 - 00000000 ____D () C:\Program Files\BFDemos
2014-10-21 21:26 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-21 16:42 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub
2014-10-21 16:42 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive
2014-10-21 16:42 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-10-20 22:24 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-20 21:17 - 2014-03-14 21:14 - 00000000 ___RD () C:\Program Files\Skype
2014-10-20 21:17 - 2011-04-14 21:52 - 00000000 ____D () C:\ProgramData\Skype
2014-10-20 19:11 - 2011-04-14 19:57 - 00144760 _____ () C:\Users\Medion\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-20 17:30 - 2014-05-17 09:08 - 355499801 _____ () C:\Windows\MEMORY.DMP
2014-10-20 17:30 - 2014-05-17 09:08 - 00000000 ____D () C:\Windows\Minidump
2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion
2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-19 23:41 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans
2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2
2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-18 16:31 - 2014-08-03 20:00 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Local\HTC MediaHub
2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe
2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment
2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft
2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 16:39 - 2011-05-02 16:27 - 00147064 _____ () C:\Users\Finn.Medion-PC\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-22 07:59 - 2014-09-07 21:20 - 00000000 ____D () C:\FreeOCR
Files to move or delete:
====================
C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
Some content of TEMP:
====================
C:\Users\Finn.Medion-PC\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel0.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel1.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel2.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel3.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel4.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel5.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\propsys.dll
C:\Users\Finn.Medion-PC\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\zodr8l3a.dll
C:\Users\Medion\AppData\Local\Temp\0acncs1a.eea.exe
C:\Users\Medion\AppData\Local\Temp\1sv0noim.wxt.exe
C:\Users\Medion\AppData\Local\Temp\27353uninstall.exe
C:\Users\Medion\AppData\Local\Temp\amazonicon_v4.exe
C:\Users\Medion\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Medion\AppData\Local\Temp\APNSetup.exe
C:\Users\Medion\AppData\Local\Temp\awtcmhrt.uzg.exe
C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe
C:\Users\Medion\AppData\Local\Temp\dlLogic.exe
C:\Users\Medion\AppData\Local\Temp\dltr.exe
C:\Users\Medion\AppData\Local\Temp\erb3vygz.wnz.exe
C:\Users\Medion\AppData\Local\Temp\foxy_security_games.exe
C:\Users\Medion\AppData\Local\Temp\GCVerifier.dll
C:\Users\Medion\AppData\Local\Temp\iodhz2td.rks.exe
C:\Users\Medion\AppData\Local\Temp\Quarantine.exe
C:\Users\Medion\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Medion\AppData\Local\Temp\sdapskill.exe
C:\Users\Medion\AppData\Local\Temp\sdaspwn.exe
C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe
C:\Users\Medion\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Medion\AppData\Local\Temp\Sqlite3.dll
C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe
C:\Users\Medion\AppData\Local\Temp\Uni000.exe
C:\Users\Medion\AppData\Local\Temp\vdoiuwkh.d1k.exe
C:\Users\Medion\AppData\Local\Temp\verifier.exe
C:\Users\Medion\AppData\Local\Temp\vfxpnvpx.lx3.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-18 19:03
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Hier auch noch die letzten Funde meines Antivirenprogramms: Code:
ATTFilter Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von
21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srpts.exe,Entfernt,Suchauftrag in Warteschlange
21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srpts.exe\LPT System Updater Service,Entfernt,Suchauftrag in Warteschlange
21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srptsl.exe,Entfernt,Suchauftrag in Warteschlange
Könnte es außerdem sein, dass mein USB Stick irgendwie "infiziert" ist? Wie kann ich das rausfinden? Und danke schonmal für deine Unterstützung!!! |
|
22.10.2014, 19:11
| #7 |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods)ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.10.2014, 13:51
| #8 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hier erst einmal die Datei vom ESET Online Scanner, der Rest folgt später: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=ff641632f80ca14a9b430fec46ce388f
# engine=20732
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-23 08:36:40
# local_time=2014-10-23 10:36:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Trend Micro Titanium Maximum Security'
# compatibility_mode=522 16777213 100 100 13800327 39460085 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 13956156 165684591 0 0
# scanned=381164
# found=143
# cleaned=0
# scan_time=48366
sh=EE244845CFA7A49B0F132DCC445C1242C18D3D62 ft=1 fh=70011a227b9a957f vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$RPQN3C9.exe"
sh=6CB7EDCB0A91B062D58DFE0A29CFC0B4D6183E8B ft=0 fh=0000000000000000 vn="Win32/Toolbar.Inbox.F evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$R00GRG1\inboxcomtoolbar@inbox.com\chrome\ibxcomtb.jar"
sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$R00GRG1\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_25.dll"
sh=2DD5BDE756E0BB974BCCE667F751C23864C8263C ft=1 fh=b3c5f9c4ee1e944b vn="Win32/Systweak.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R1EYK3M.exe"
sh=49AD16EE101B0868E912C0E37FB563EA0223EA93 ft=1 fh=ee0c85606970fc46 vn="Variante von Win32/InstallCore.BY evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7NAJVV.exe"
sh=DA799A2FD66779F06710E32DB8EF47E191B6A49D ft=1 fh=0cf0cf82fa885ec8 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R8J2YQ6.exe"
sh=8504F4DA17CD7655F8810F926E65C17C243775D5 ft=1 fh=c55a7210254106bd vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RDXJAC5.exe"
sh=C8BA34DE7E149E399AE067F0AB7CB32F7B26073B ft=1 fh=88c6f98c6bfe1303 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RPCV5OC.exe"
sh=C59A0F9B108BCEFFA575AB5213C01F017A4E1DB8 ft=1 fh=fdc2ab70d49428dd vn="Variante von Win32/BearShare.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RX0UDA1.exe"
sh=EA60BDF6885668B3850E90C22787F6325E9D5D4F ft=1 fh=b2dc02befa885ec8 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RXRHNQ6.exe"
sh=C2B092661C554CEB9840D7D4ADE57789C34E760B ft=1 fh=4455832a986c7da8 vn="Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\39ffxtbr-bs@MapsGalaxy_39.com\content\MapsGalaxy.exe"
sh=AF4C20715941FB0D57489961D016985F92A85915 ft=1 fh=cf9add68b7bd5237 vn="Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\4zffxtbr-bs@VideoDownloadConverter_4z.com\content\VideoDownloadConvert.exe"
sh=CE952316F32FBFACD185A7FBFB5DD80CF139B588 ft=1 fh=bbdb2b13e6859285 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF10.dll"
sh=76859686AAE43C4936DB38AF5A4CFCEBF1C5D8E7 ft=1 fh=0cdcbca1ef2fa072 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF11.dll"
sh=FD3A3958DD391EB24D798F83E24A20D185C2D104 ft=1 fh=2cd17cb8a2a36929 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF12.dll"
sh=1027184B10A39863C163826BF7D96FAE8E92EA8A ft=1 fh=bebbe8dd24b6a730 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF13.dll"
sh=2B9E55CE81271D2ECEC4C2109F5B37AB27357AB7 ft=1 fh=30d8fb64cac640b4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF14.dll"
sh=3335F080CFC5FFF0F1A29EE16E278B96B0B2C99D ft=1 fh=09616668c2bad301 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF15.dll"
sh=035433E4F356326305847E8042F9A8213667ECE8 ft=1 fh=3f1d11b3fbd30c8f vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF16.dll"
sh=78E1175D3B5FAFE801143F886E99BC4C61B76148 ft=1 fh=f5a2ce90f98a273e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF17.dll"
sh=B2F4EBA790A500E77BC673AF51C1626B2A70D929 ft=1 fh=f6d874e392515f34 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF18.dll"
sh=15BEE16AB7F879A12CB5F170BB3F81E3862CE422 ft=1 fh=0e7e5a9610955a04 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF19.dll"
sh=7011E2D4C12C496987F444DB82C977AB18018F80 ft=1 fh=0b8de1410b750dda vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF2.dll"
sh=54E6A42753E1B9DBC598000135285815C63B4FF8 ft=1 fh=f94c07323e660a05 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF20.dll"
sh=EB3C98B5269DD96862AC70DB18035AAC68C13795 ft=1 fh=42f5374305ec982c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF21.dll"
sh=CE09251CA2CFDC983596143C50AB99A57C29320C ft=1 fh=0f31bd59f6c93aa7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF22.dll"
sh=70086FAF6B55F9DB1F06EF715B46113F3EA946FE ft=1 fh=d98ca3cc50789476 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF23.dll"
sh=D51FD2FBFB7F00DE472801EB3EFF7F3F05C20C60 ft=1 fh=526913395cd65610 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF4.dll"
sh=574F4296E2048CB17BF5CC0A749C0935949DF052 ft=1 fh=469916f870b7eec8 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF5.dll"
sh=A138B3F78FBABBE9409FF4768918C15F91B7F38A ft=1 fh=fa48ffb3cce66494 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF6.dll"
sh=F3913185A15C5A4E74453F48B8A6608C44A569E5 ft=1 fh=cafe2486b0135de4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF7.dll"
sh=F13A94AC388DE6F8DEBE598E34E6C7F2049C2AD0 ft=1 fh=ab73217a39b6db51 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF8.dll"
sh=7020452B6F0452EFFFB982FE3B4ED81599439F65 ft=1 fh=83441fdf9c7a3202 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF9.dll"
sh=2B713A73040F00633A991E136AFF78BABE7CC9BA ft=1 fh=0f6747bf62384b27 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF10.dll"
sh=356BCA5D80A3966EDD5567E20CE36DE8D92BB324 ft=1 fh=393ea35f7a5039cd vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF11.dll"
sh=9E69EA60F131A8C538B6CC8516C61D4417521E78 ft=1 fh=87133386ec2897f0 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF12.dll"
sh=17F82BF6A267935356954B1ACBBBE9137CF02D1B ft=1 fh=8b7dce85d61e459e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF13.dll"
sh=2452843E6738117A5B700C967206BEBA85F80A35 ft=1 fh=a4c9d32b9f1b0681 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF14.dll"
sh=4646E1636B2D34D124ACA040C42D5A714A27E935 ft=1 fh=b9e66c7544aeda25 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF15.dll"
sh=9897AEE786D03739C203095FF638B4C9E3BF70CB ft=1 fh=227385daa4eee916 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF16.dll"
sh=595B61E6508DFD56837758CADD8309B3F3E12B2B ft=1 fh=338bb5c453cd4cc7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF17.dll"
sh=15B0FE06E8A7F70C8ECB9AECAD84A75B495B3F9F ft=1 fh=4215c06544d614ff vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF18.dll"
sh=FD1D2A1DCA5218B6D69448DD2592F6695F6FE53A ft=1 fh=0dd8138c73c31dae vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF19.dll"
sh=E5165D753ECB75CAF5602C975A02B8560F4A357F ft=1 fh=8d53df379ab7d6b3 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF2.dll"
sh=29DF9A2CD0A6EC0C2FD7C23F5EADD76232E1DD5D ft=1 fh=fd57dec1f82049b5 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF20.dll"
sh=607DDFC19A18CD580B64E12549640ACEE127A9CE ft=1 fh=8199e7e1b51562e9 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF21.dll"
sh=1411655FC03ED9BEC5E061FDDB7981E9926DE477 ft=1 fh=23e093a06d2fdbb1 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF22.dll"
sh=9FA61ED37A78F3DB47AF256BF8153F50098E42BE ft=1 fh=e761c91b08df672d vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF23.dll"
sh=338EC4415F8F0EE17406CBE4C6215B9895B0B505 ft=1 fh=085f8d6070140a28 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF4.dll"
sh=9BB9757701322F4653A8EB3BAEDDB0D9ECD402B4 ft=1 fh=3f4d8d96e7c6f404 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF5.dll"
sh=EB85CECA9EEB234E09FB629C1DE3ADC8ABD4FCBE ft=1 fh=08513e6dc8e44648 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF6.dll"
sh=56F53D2002348208DAFDDA5AAB6C8F3958F03248 ft=1 fh=b522cb188b038203 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF7.dll"
sh=C8CCE323F2393437706E8D0B51187C16E5BCD517 ft=1 fh=a17433176ef1c406 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF8.dll"
sh=3023B377F3E647CB7411246B90CDA78D74528317 ft=1 fh=5ed0f826a030ce84 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF9.dll"
sh=02F80A5EFE9C47FFC9688ADD77D038671D09BB8B ft=1 fh=95ad321b505380d3 vn="Variante von Win32/Toolbar.CrossRider.AW evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Browser App\Uninstall.exe.vir"
sh=A850D23AD98C56A2952EE9DDFDFF334FFD82B957 ft=1 fh=599b84254fa99bb8 vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Browser App\utils.exe.vir"
sh=FA82D6954AC54809F67D65FF5A39E9858FBE64C4 ft=1 fh=eea51c81a368967b vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_76\fst_de_76.exe.vir"
sh=524ED1264811258D64BA2BE8B48005C6D1935713 ft=1 fh=19b60c262a337e59 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\DpInterface64.dll.vir"
sh=72971E4B87542575A876B36FB87879B416F4EC88 ft=1 fh=eb8c71c588367618 vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\DpInterfacef32.dll.vir"
sh=01C9B3D0E073B824021B29F1FD957A8643DF6931 ft=1 fh=9d9cb38b273b86fe vn="Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\RSHP.exe.vir"
sh=F34BB16FA7EEF85B106A7C3A3FDEEE95ECF18001 ft=1 fh=7bd5299d4d87abc5 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SearchProtect32.dll.vir"
sh=FB15CD6ADCD9BDFBF68D5DF5EAEA02BF329F8D4F ft=1 fh=dfa2b1c2f56e7303 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SearchProtect64.dll.vir"
sh=B733C40B96BCA6CC139230D0F7C4E51CEC12CF35 ft=1 fh=08ea3c71e6c55c1b vn="Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SpAPPSv32.dll.vir"
sh=D6F9F256C03B81C01D6CFF28D2D966F59F786AC3 ft=1 fh=3a3e287aa52ff7e5 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SpAPPSv64.dll.vir"
sh=BFFE82D82714D7C2C078D7027BA093F66028CD50 ft=1 fh=5663110f243ad63b vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Finn.Medion-PC\AppData\Local\iLivid\Helper.dll.vir"
sh=F1B646921B04861D62E433D00052DABD42BFBBAD ft=1 fh=422c75c0df1448ad vn="Variante von Win32/Toolbar.SearchSuite.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Finn.Medion-PC\AppData\Local\iLivid\Uninstall.exe.vir"
sh=2FBD906A786E4DC8E7FD951493AE469F2E640B24 ft=1 fh=b7fcb82db5407d37 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\upfst_de_76.exe.vir"
sh=C00396DCC821996A03380C91533802882A17A7F1 ft=1 fh=bc33f9dfe31f89e4 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majfst.exe.vir"
sh=C623F54CAB59A739E2DF58905AE44293D62A9E5B ft=1 fh=f9568ab585748cf5 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majfst_gentlede.exe.vir"
sh=4C150C4D71A46B09B13314A284DAF2BFD6E3DAFB ft=1 fh=1ee738fec9d27fa1 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majmp_gentleeu.exe.vir"
sh=2552432501BB1817A86FB4CD141C2AA1B8E34650 ft=1 fh=d4b3877a3411dcbb vn="Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\10806ff987a45c60eaa975e4aab3d1a1\pcspeedup.exe.vir"
sh=E0814D0F17EE1122F6D3507DC676030F8E1CC133 ft=1 fh=0e0f46db8e6ee8c4 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"
sh=BE3A5951F9D566E9C0B10B41781E42A3A8562B12 ft=1 fh=bfe637157b287a9d vn="Variante von Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\BabSolution\Shared\enhancedNT.dll.vir"
sh=BD310B4FE9F62360DF0001FBFE46CAD8225E7DDB ft=1 fh=1f0ad2adf900abdf vn="Variante von Win32/RiskWare.Astori.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\InetStat\inetstat.exe.vir"
sh=EC7EC5D60C5A578BC9953115D368BECD05BA14B2 ft=1 fh=ecbff00cc7dcc0fd vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\SupTab\SupTab.dll.vir"
sh=F3F91E0B76EF58119652FDCD93902F8F295959D5 ft=1 fh=701dd8335a58b5ae vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=D7FD907C3FAD3C161F00D773D199BCD7FDA5D39A ft=1 fh=2633daedce4e79c1 vn="Variante von Win32/Systweak.N evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\ADRHelper.dll"
sh=563D9ADE59AF78202113BA23F3B3B6D55F09FEAC ft=1 fh=5b088e17a69223e2 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\AdvancedDiskRecovery.exe"
sh=CBE99E078C0A7CCA56988F65678A131AE0A88C64 ft=1 fh=80a6e745a93cc281 vn="Variante von Win32/Systweak.M evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\Network.dll"
sh=6506F2C746CB98CC8A93D4466B2DBC0E7502CDAF ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\DealPly10.zip"
sh=6506F2C746CB98CC8A93D4466B2DBC0E7502CDAF ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\DealPly10.zip"
sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\ICReinstall_ZipExtractorSetup.exe"
sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\YfEsob1O.exe.part"
sh=61D62F5BE1FC947C9ACC61F260E2E44A230AA7AF ft=1 fh=049cf51099fb3b2c vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\is1590112554\DeltaTB.exe"
sh=E894D6F9F5A33D186D7759BF61D463975A0C244E ft=1 fh=dafad1154282da69 vn="Variante von Win32/DealPly.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\is1590112554\dp.exe"
sh=9E000F793452E8E9887DA45CA42F87667017553B ft=1 fh=358962b414b27b14 vn="Win32/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nsa1AD2.tmp\Helper.dll"
sh=DC14547C089F47D4A61ECBAB5E1EC36319A58AAD ft=1 fh=1c398b16d35a224b vn="Win32/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nscBEC4.tmp\Helper.dll"
sh=BC99A693F771E64DF87BBA8FA352F94C9E75AE7F ft=1 fh=66a07435c4c1d0a2 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nskD681.tmp\Helper.dll"
sh=BFFE82D82714D7C2C078D7027BA093F66028CD50 ft=1 fh=5663110f243ad63b vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nsw7FDF.tmp\Helper.dll"
sh=D08BD350E0531B2DDDC4E81A69B001B2D0550003 ft=1 fh=f6585e7df79a84bc vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\iLividSetup-r887-n-bf.exe"
sh=C1F9091072EE8DE34FACD06D3CF59E6FFE89D6C1 ft=1 fh=57d847f4c74487d2 vn="Variante von Win32/InstallIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\mediaplayer_d599114.exe"
sh=FF17474D978D3D40B25E55D01B72AF83B803C542 ft=1 fh=432cea435834e99b vn="Variante von Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\Minecraft.exe"
sh=9A34CA7020397481A60785BE69663D99DA890EDB ft=1 fh=fbc1c3de74ac175d vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_fiesta-online(1).exe"
sh=9A34CA7020397481A60785BE69663D99DA890EDB ft=1 fh=fbc1c3de74ac175d vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_fiesta-online.exe"
sh=9DC73A452ED6992EE6ADC285A8E8D97A6DE1B7EA ft=1 fh=92bdd2019f869f39 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_openarena.exe"
sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\ZipExtractorSetup.exe"
sh=0A12774E4D19A9867069C8D3CD3E380D7CB2F59C ft=1 fh=c950eacd9b1cc265 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26X8T3Q5\WajamChecker[1].exe"
sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX4TV03G\sp-downloader[1].exe"
sh=A2853D27C2378B9065DEB3C69C5CF608F7C2EE1D ft=1 fh=620a1940836c8b2c vn="Win32/Wajam.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX4TV03G\wajam_download[1].exe"
sh=9A485800A5B8864DB8B09D1C35F9DCF2C6D24FC9 ft=1 fh=09535bb5f69dbeba vn="JS/Superfish.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RE23NNJI\FastPlayerSetup[1].exe"
sh=A01CAE4A9C48BEB8A490C3E88CB03F9B95C31671 ft=1 fh=5c1219a5576ddaa1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RE23NNJI\sp-downloader[1].exe"
sh=08A0F0FDF49B86F8FD0547594BDC3F7455330836 ft=1 fh=e3ad9ceca28a6528 vn="MSIL/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe"
sh=BD310B4FE9F62360DF0001FBFE46CAD8225E7DDB ft=1 fh=1f0ad2adf900abdf vn="Variante von Win32/RiskWare.Astori.A Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe"
sh=405722F95E77DFD774E00CE3B9ABFA9C5EB2177A ft=1 fh=1a57d4714e847f48 vn="Variante von Win32/ELEX.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe"
sh=405722F95E77DFD774E00CE3B9ABFA9C5EB2177A ft=1 fh=1a57d4714e847f48 vn="Variante von Win32/ELEX.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\29c2217fff8359d2c648e0ce94c6c82b\sweetpage_294wld.exe"
sh=9A485800A5B8864DB8B09D1C35F9DCF2C6D24FC9 ft=1 fh=09535bb5f69dbeba vn="JS/Superfish.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\5F86tmp\fastplayersetup.exe"
sh=A2853D27C2378B9065DEB3C69C5CF608F7C2EE1D ft=1 fh=620a1940836c8b2c vn="Win32/Wajam.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\6082tmp\wajam_download.exe"
sh=1A9C2CE8C1F539AC8546D67C9F924AEA8D2A84C2 ft=1 fh=d348c3328e970e39 vn="Win32/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\9FB0tmp\cloud_backup_setup.exe"
sh=8E7D9F1AEB7A9F9F544CE537DA336E2FD9D8EB89 ft=1 fh=e5f85f840a14464b vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\BExternal.dll"
sh=E2BA5F8A7BD2BAF32FF31730BAD873C8E7957030 ft=1 fh=6e8622963c31f56a vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\BUSolution.dll"
sh=C48D1C278D0434F3BBAF273134265DBA5F720003 ft=1 fh=bedeb8cbd68127e1 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\IEHelper.dll"
sh=BE3A5951F9D566E9C0B10B41781E42A3A8562B12 ft=1 fh=bfe637157b287a9d vn="Variante von Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\busCFD4\enhancedNT.dll"
sh=282501AA2FA177D942282F8E2EB5E1D25CA17AED ft=1 fh=170a29edd91c8b10 vn="Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\fullpackage_temp1399044609\tmp\SupTab.exe"
sh=9B1F0EEE614F804B5F3A5D453E622887561CA67D ft=1 fh=963483e35a072738 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-760M2.tmp\package_secprotwhite_installer_multilang.exe"
sh=78B7784F26F659C15584E94D3AFCA2B9E4713388 ft=1 fh=e00c3651e0f9a968 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-7TC6A.tmp\gentlemjmp_ieu.exe"
sh=FC7EE82134C066AA506993947B136ACCF820AB62 ft=1 fh=680b986437d00b66 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-M4BNK.tmp\gentlemjfst_ide.exe"
sh=04E76210641FD4DD0BDD4740F4CBF4D9CE6CA61F ft=1 fh=7b6578cfa001935f vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-OAJBJ.tmp\gentlemjfst_ide.exe"
sh=B719CF8DFB677DA920526CAAB3969F52614B480A ft=1 fh=a71701400b5f8e85 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-OBUU1.tmp\package_regclean_installer_multilang.exe"
sh=FEC182DA4F4421E2A39C0F61F294FC9BC3120F06 ft=1 fh=ed696abae9df72b1 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-RLD4K.tmp\package_regclean_installer_multilang.exe"
sh=AAB69675FBE99009D8D23FD1F53445314C73CFAC ft=1 fh=a16dc0ffdb2dee5d vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-RLD4K.tmp\package_secprotkeys_installer_multilang.exe"
sh=08D53FE023E306F28F75FF8C47757FF82BDE7E31 ft=1 fh=7f78c331c1ef865d vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-VRLRM.tmp\gentlemjfst_ide.exe"
sh=61D62F5BE1FC947C9ACC61F260E2E44A230AA7AF ft=1 fh=049cf51099fb3b2c vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\DeltaTB.exe"
sh=E894D6F9F5A33D186D7759BF61D463975A0C244E ft=1 fh=dafad1154282da69 vn="Variante von Win32/DealPly.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\dp.exe"
sh=CBA067E7431BD177E93A8D585A5E15DA3E6AEDEE ft=1 fh=de9f46930f8cb608 vn="Win32/WebCake.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\Setup-D502DD2B71B5.exe"
sh=42385D001D8895D030AC6A69777429B38A36EE33 ft=1 fh=f4db516d96fa1fb1 vn="Win32/Packed.VMDetector.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsd8C1A.tmp\nsvmd.dll"
sh=EBA5B4F9BF67F500BDB7D882843F14C1C6DD3748 ft=1 fh=c71c00119068a4e7 vn="Variante von Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsqCBF8.tmp\InstallerUtils.dll"
sh=53E11BE4BAF194722E9B78297134D28A62A929C7 ft=1 fh=5cfe05ba4fa99274 vn="Variante von Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsqCBF8.tmp\InstallerUtils2.dll"
sh=6BAD27D0A44A8B3DB8810E9D058F272D63BF47C5 ft=1 fh=95d748b786eee0d6 vn="Variante von Win32/SoftPulse.O evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\Downloads\Player_Setup.exe"
sh=A6C2FFBE6DC47703332C4CC0B0B633AFB88DFD71 ft=1 fh=d165f6180e2e9d3a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\bsplayer257.1051EN_clip.exe"
sh=563E1B707747F87BD96829B81E92CA1EE04E83FD ft=1 fh=421b349ff9c9cc9b vn="Win32/InstallMonetizer.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeOCR-5.02.exe"
sh=1C72D724B7045DA93AAF595D8BCD0D8D6C396B70 ft=1 fh=1346f15d448954b3 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeSoundRecorder.exe"
sh=8547D1E5EACE099ECFE5EDBF6958FA077650894B ft=1 fh=61435738673b6524 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(1).exe"
sh=07CF040FEFA25DFDA4287BAB632EAB806E294695 ft=1 fh=0db8f293d4a19d8f vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(2).exe"
sh=596D78A7F03D1DAEE86BCCE8DD7713AA60E8F9E4 ft=1 fh=8eaf1d336ac02ccc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(3).exe"
sh=2C4EB8EB07C36FCCEEF9B7947D302110770E283C ft=1 fh=5f86e2b26a146a3a vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter.exe"
sh=BEB2872C5EE9890C656B293C5EFBAD0220B4E538 ft=1 fh=3852d8d68dbe73c3 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter31014.exe"
sh=6CF8A9F031B45F70BE3E66E7ACC7449CDA15FA34 ft=1 fh=2de4b6f517306153 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\PDFCreator-1_2_3_setup.exe"
sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\PDFCreator-1_7_1_setup.exe"
sh=946CFC9752B40BF2554A4B93E485B438DDCCDAA7 ft=1 fh=df61aa7cad693a34 vn="Win32/SoftonicDownloader.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\SoftonicDownloader_fuer_icolorfolder.exe"
sh=723D315206A52C4CE6BE51080EAE93F13ACDBD86 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Dropbox\Desktop\Alte Firefox-Daten\xrnq0niu.default\extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com\extensionData\plugins\194_retargeting_bi_m.js.js"
sh=DEBF208882FC35746679473CE0C804521CEC67CC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Dropbox\Desktop\Alte Firefox-Daten\xrnq0niu.default\extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com\extensionData\plugins\91_monetizationLoader.js.js"
sh=5BA2A1AB903E6B0FAC7FD1B0BC4B4F32262BAC67 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\19c650.msi"
sh=9B57C1B23D98E4E31E8DC947B3ED587A0CA19C39 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\19c656.msi"
Nutze also eigentlich immer den anderen Account (Miriam II). Sollte ich da auch noch Security Check laufen lassen, oder checkt das alle Accounts (sorry, keine Ahnung von Computern  ).Code:
ATTFilter Results of screen317's Security Check version 0.99.89 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Trend Micro Titanium Maximum Security Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spyware Terminator 2012 Secunia PSI (3.0.0.7011) Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 67 Adobe Flash Player 15.0.0.152 Adobe Reader XI Mozilla Firefox 32.0.3 Firefox out of Date! Mozilla Thunderbird (17.0.) Google Chrome 37.0.2062.124 Google Chrome 38.0.2125.104 ````````Process Check: objlist.exe by Laurent```````` WinPatrol winpatrol.exe BillP Studios WinPatrol WinPatrol.exe Trend Micro Titanium plugin TMAS\TMAS_WLM\TMAS_WLMMon.exe Trend Micro AMSP coreServiceShell.exe Trend Micro UniClient UiFrmWrk uiWatchDog.exe Trend Micro AMSP coreFrameworkHost.exe Trend Micro UniClient UiFrmWrk uiSeAgnt.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-10-2014
Ran by Medion (administrator) on MEDION-PC on 23-10-2014 14:42:48
Running from C:\Users\Medion\Downloads
Loaded Profiles: Medion & Miriam II (Available profiles: Medion & Finn & Miriam II)
Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe
(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-UpdaterService.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Nero AG) C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe
() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe
(Secunia) C:\Program Files\Secunia\PSI\psia.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe
(Crawler.com) C:\Program Files\Spyware Terminator\st_rsser.exe
(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe
(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [436800 2013-07-15] (BillP Studios)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps] => "C:\Users\Medion\AppData\Roaming\Allmyapps\Allmyapps.exe" startup
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps Update] => "C:\Users\Medion\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [SpywareTerminatorUpdate] => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [792576 2014-06-04] (1&1 Mail & Media GmbH)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [1und1DispatcherCorp] => C:\Users\Miriam II\AppData\Local\1und1UpdaterCorpE\SchedDispatcher.exe [220808 2013-05-29] (1&1 Mail & Media GmbH)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb65-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb86-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe
HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {b636cf64-b326-11e1-b7d9-00262dbfe53b} - F:\AutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk
ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)
Startup: C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk
ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)
BootExecute: autocheck autochk * sdnclean.exe
GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1003\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default
FF NewTab: chrome://quick_start/content/index.html
FF Keyword.URL: user_pref("keyword.URL", "");
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]
FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]
FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]
FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension
FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]
CHR Extension: (Google Docs) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-19]
CHR Extension: (Google Drive) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-19]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-20]
CHR Extension: (YouTube) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-19]
CHR Extension: (Google-Suche) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-19]
CHR Extension: (Google Tabellen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]
CHR Extension: (Google Wallet) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-19]
CHR Extension: (Google Mail) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-19]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)
R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]
R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]
R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)
R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)
R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)
R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)
S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]
R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]
S4 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)
R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)
R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)
S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)
R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)
S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)
S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)
R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)
R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)
R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)
R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]
U2 TMAgent; No ImagePath
S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]
S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-23 14:42 - 2014-10-23 14:42 - 00000000 ____D () C:\Users\Medion\Downloads\FRST-OlderVersion
2014-10-23 14:25 - 2014-10-23 14:25 - 00854448 _____ () C:\Users\Medion\Desktop\SecurityCheck.exe
2014-10-22 21:01 - 2014-10-22 21:02 - 02347384 _____ (ESET) C:\Users\Medion\Downloads\esetsmartinstaller_deu.exe
2014-10-21 23:25 - 2014-10-22 10:53 - 00000000 ____D () C:\Users\Medion\Desktop\trojaner board II
2014-10-21 23:20 - 2014-10-21 23:21 - 00038166 _____ () C:\Users\Medion\Downloads\Addition.txt
2014-10-21 23:19 - 2014-10-23 14:42 - 00026605 _____ () C:\Users\Medion\Downloads\FRST.txt
2014-10-21 23:18 - 2014-10-23 14:42 - 01103360 _____ (Farbar) C:\Users\Medion\Downloads\FRST.exe
2014-10-21 23:11 - 2014-10-21 23:11 - 00000000 ____D () C:\Users\Miriam II\Downloads\FRST-OlderVersion
2014-10-21 23:05 - 2014-10-21 23:05 - 01706144 _____ (Thisisu) C:\Users\Medion\Downloads\JRT.exe
2014-10-21 22:48 - 2014-10-21 22:57 - 00000000 ____D () C:\AdwCleaner
2014-10-21 22:47 - 2014-10-21 22:47 - 01962496 _____ () C:\Users\Medion\Downloads\AdwCleaner_4.001.exe
2014-10-21 21:41 - 2014-10-21 21:41 - 00000048 _____ () C:\Users\Public\Documents\_rgpl
2014-10-21 20:31 - 2014-10-21 20:31 - 00000000 ____D () C:\Program Files\VS Revo Group
2014-10-21 20:29 - 2014-10-21 20:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Medion\Downloads\revosetup95.exe
2014-10-20 21:21 - 2014-10-20 21:21 - 00000000 ____D () C:\Users\Medion\AppData\Local\com
2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-10-20 21:14 - 2014-10-20 21:15 - 01209696 _____ () C:\Users\Medion\Downloads\Player_Setup.exe
2014-10-20 20:44 - 2014-10-20 20:44 - 00007805 _____ () C:\Users\Miriam II\Desktop\GMER.txt
2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\Program Files\7-Zip
2014-10-20 20:34 - 2014-10-20 20:35 - 01110476 _____ () C:\Users\Miriam II\Downloads\7z920.exe
2014-10-20 17:30 - 2014-10-20 17:30 - 00146376 _____ () C:\Windows\Minidump\102014-18891-01.dmp
2014-10-20 17:15 - 2014-10-20 17:16 - 00380416 _____ () C:\Users\Miriam II\Downloads\Gmer-19357.exe
2014-10-20 17:06 - 2014-10-20 17:07 - 00043008 _____ () C:\Users\Miriam II\Downloads\Addition.txt
2014-10-20 17:04 - 2014-10-21 23:13 - 00044365 _____ () C:\Users\Miriam II\Downloads\FRST.txt
2014-10-20 11:46 - 2014-10-23 14:42 - 00000000 ____D () C:\FRST
2014-10-20 11:44 - 2014-10-21 23:11 - 01102336 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe
2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log
2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable
2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe
2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe
2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action
2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim
2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-23 14:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing
2014-10-23 14:20 - 2014-07-17 22:09 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-23 14:20 - 2014-07-17 22:09 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-23 14:19 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype
2014-10-23 14:18 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-23 14:18 - 2011-04-06 10:26 - 01997620 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 20:52 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-22 17:25 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-10-22 17:24 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub
2014-10-22 17:24 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive
2014-10-22 17:23 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-22 17:23 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-22 17:15 - 2014-08-20 19:46 - 00720896 _____ () C:\Windows\system32\Ikeext.etl
2014-10-22 17:15 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-22 17:15 - 2009-07-14 06:39 - 00177627 _____ () C:\Windows\setupact.log
2014-10-22 10:34 - 2013-04-30 09:27 - 00000000 ____D () C:\Users\Medion\AppData\Local\Deployment
2014-10-22 10:30 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub
2014-10-21 22:58 - 2010-05-05 19:37 - 00340790 _____ () C:\Windows\PFRO.log
2014-10-21 22:57 - 2014-07-02 17:57 - 00001041 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-10-21 22:57 - 2014-07-02 17:57 - 00001011 _____ () C:\Users\Medion\Desktop\Search.lnk
2014-10-21 22:57 - 2013-07-26 12:24 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-21 22:57 - 2013-07-26 12:24 - 00001011 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-10-21 22:57 - 2012-05-13 12:57 - 00000000 ____D () C:\Users\Medion\AppData\Local\CRE
2014-10-21 22:57 - 2011-04-19 18:23 - 00000000 ____D () C:\Users\Finn.Medion-PC
2014-10-21 22:57 - 2011-04-06 10:28 - 00001154 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-21 22:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-10-21 22:03 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam
2014-10-21 22:02 - 2011-11-28 14:24 - 00000000 ____D () C:\Program Files\BFDemos
2014-10-21 21:26 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-10-20 22:24 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-20 21:17 - 2014-03-14 21:14 - 00000000 ___RD () C:\Program Files\Skype
2014-10-20 21:17 - 2011-04-14 21:52 - 00000000 ____D () C:\ProgramData\Skype
2014-10-20 19:11 - 2011-04-14 19:57 - 00144760 _____ () C:\Users\Medion\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-20 17:30 - 2014-05-17 09:08 - 355499801 _____ () C:\Windows\MEMORY.DMP
2014-10-20 17:30 - 2014-05-17 09:08 - 00000000 ____D () C:\Windows\Minidump
2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion
2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans
2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2
2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-10-18 16:31 - 2014-08-03 20:00 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Local\HTC MediaHub
2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe
2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE
2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment
2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam
2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft
2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-09-24 16:39 - 2011-05-02 16:27 - 00147064 _____ () C:\Users\Finn.Medion-PC\AppData\Local\GDIPFONTCACHEV1.DAT
Files to move or delete:
====================
C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
Some content of TEMP:
====================
C:\Users\Finn.Medion-PC\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel0.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel1.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel2.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel3.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel4.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel5.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\propsys.dll
C:\Users\Finn.Medion-PC\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\vlc-2.1.2-win32.exe
C:\Users\Finn.Medion-PC\AppData\Local\Temp\zodr8l3a.dll
C:\Users\Medion\AppData\Local\Temp\0acncs1a.eea.exe
C:\Users\Medion\AppData\Local\Temp\1sv0noim.wxt.exe
C:\Users\Medion\AppData\Local\Temp\27353uninstall.exe
C:\Users\Medion\AppData\Local\Temp\amazonicon_v4.exe
C:\Users\Medion\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Medion\AppData\Local\Temp\APNSetup.exe
C:\Users\Medion\AppData\Local\Temp\awtcmhrt.uzg.exe
C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe
C:\Users\Medion\AppData\Local\Temp\dlLogic.exe
C:\Users\Medion\AppData\Local\Temp\dltr.exe
C:\Users\Medion\AppData\Local\Temp\erb3vygz.wnz.exe
C:\Users\Medion\AppData\Local\Temp\foxy_security_games.exe
C:\Users\Medion\AppData\Local\Temp\GCVerifier.dll
C:\Users\Medion\AppData\Local\Temp\iodhz2td.rks.exe
C:\Users\Medion\AppData\Local\Temp\Quarantine.exe
C:\Users\Medion\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Medion\AppData\Local\Temp\sdapskill.exe
C:\Users\Medion\AppData\Local\Temp\sdaspwn.exe
C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe
C:\Users\Medion\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Medion\AppData\Local\Temp\Sqlite3.dll
C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe
C:\Users\Medion\AppData\Local\Temp\Uni000.exe
C:\Users\Medion\AppData\Local\Temp\vdoiuwkh.d1k.exe
C:\Users\Medion\AppData\Local\Temp\verifier.exe
C:\Users\Medion\AppData\Local\Temp\vfxpnvpx.lx3.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-10-18 19:03
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- Probleme haben nachgelassen, wobei ich das noch nicht mit absoluter Sicherheit sagen kann, bin gerade zu wenig am Computer. Auf jeden Fall will scheinbar eure Seite meine Bankdaten haben (laut Trend Micro). Schau heute Abend nochmal, ob die Probleme wieder auftauchen. Gruß Mika |
|
24.10.2014, 08:04
| #9 | |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods)Zitat:
download ordner in deinem normalen Account leeren. Firefox udpaten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.10.2014, 08:37
| #10 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Wie füge ich den Screenshot denn hier ein? Alles andere habe ich erledigt und es gibt keine unerwünschte Werbung mehr :-) !!! Meine Internetverbindung spinnt immer noch manchmal rum. Gruß Mika |
|
24.10.2014, 17:19
| #11 |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) unten erweitert klicken, dann Anhänge verwalten
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.10.2014, 17:52
| #12 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Hier die Screenshots, ich habe zwei gemacht, weil anscheinend innerhalb ein paar Minuten sehr häufig nach den Bankdaten gefragt wird. Ist auch unabhängig davon, ob noch ein anderes Fenster geöffnet ist. Gruß Mika |
|
25.10.2014, 14:25
| #13 |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Das hat nix mit der Seite zu tun. Das ist ne Meldung von Trend Micro wenn Du einen Browser öffnest. In welchem Browser kommt das?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
25.10.2014, 19:50
| #14 |
| | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Firefox, aber auch nicht bei jdem Account. Habe bei einem Adblocker und Noscript installiert, da passiert das nicht. Muss ich noch irgendetwas tun oder müsste jetzt alles weg sein? Gruß Mika |
|
26.10.2014, 15:07
| #15 |
| /// the machine /// TB-Ausbilder | Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Und ein FRST log aus dem besagten Account bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) |
| conduit.search, conduit.search entfernen, datei anhängen, fehlercode 22, funmoods entfernen, installer entfernen, mypc backup entfernen, newplayer entfernen, pricesparrow entfernen, pup.funmoods, securita scout entfernen, sweetpage entfernen, the sea app entfernen, this device is disabled. (code 22), win32/bearshare.a, win32/downloadsponsor.a, win32/installcore.bn, win32/installcore.by, win32/packed.vmdetector.i, win32/systweak.d, win32/toolbar.crossrider.aw, win32/toolbar.inbox.f, win32/toolbar.linkury.d, win32/toolbar.searchsuite.q, win32/winloadsda.d, yahoo community smartbar entfernen |
dann auf 
und dann auf 
. 
Linear-Darstellung
