| |
| |||||||
Log-Analyse und Auswertung: Windows Vista incredibar-search ASK-Toolbar vermutlich Malware, Rechner sehr langsamWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
20.04.2015, 21:13
| #1 |
 |  Windows Vista incredibar-search ASK-Toolbar vermutlich Malware, Rechner sehr langsam Hallo, Das Notebook meiner Tochter ist extrem langsam. Vielleicht können Sie einen Blick darauf werfen, ob eingefangene Schädlinge dafür verantwortlich sind. Besten Dank, Jan-Hauke defogger: defogger_disable by jpshortstuff (23.02.10.1) Log created at 19:21 on 20/04/2015 (Merle Fuchs) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- FRST: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2015
Ran by Merle Fuchs (administrator) on MERLEFUCHS-HP on 20-04-2015 19:53:12
Running from C:\Users\Merle Fuchs\Desktop
Loaded Profiles: Merle Fuchs (Available profiles: Merle Fuchs & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Advanced Micro Devices) C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
() C:\Windows\System32\dmwu.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
() C:\Windows\SysWOW64\mjcm\dnkt.exe
() C:\Windows\System32\tprb\dnkt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Dropbox, Inc.) C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-x64-V5.23-delta.exe
(Microsoft Corporation) C:\3036dcd5a0443c4fcd\mrtstub.exe
(Microsoft Corporation) C:\Windows\System32\MRT.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-21] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)
HKLM\...\Run: [BCSSync] => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
HKLM-x32\...\Run: [AVG_TRAY] => C:\Program Files (x86)\AVG\AVG2012\avgtray.exe [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3033112 2015-03-17] ()
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Run: [SSync] => C:\Users\Merle Fuchs\AppData\Roaming\SSync\SSync.exe [36864 2013-04-10] ()
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Run: [OMESupervisor] => C:\Users\Merle Fuchs\AppData\Local\omesuperv.exe [2239256 2013-12-24] ()
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Run: [SCheck] => C:\Users\Merle Fuchs\AppData\Roaming\SCheck\SCheck.exe [37376 2013-12-09] ()
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Run: [Snoozer] => C:\Users\Merle Fuchs\AppData\Roaming\Snz\Snz.exe [1209625 2013-12-24] ()
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Run: [Intermediate] => C:\Users\Merle Fuchs\AppData\Roaming\Intermediate\Intermediate.exe [37376 2013-12-09] ()
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Policies\system: [DisableChangePassword] 0
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\MountPoints2: {3d6bd094-281d-11e1-83c7-2c27d70cac6d} - F:\LaunchU3.exe -a
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2014-07-08]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk [2011-05-27]
ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
Startup: C:\Users\Merle Fuchs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-04-18]
ShortcutTarget: Dropbox.lnk -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00Zecter] -> {D25B32FE-CB96-491A-98FF-AD59DA382D69} => C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll [2010-12-11] (Versionate Inc.)
ShellIconOverlayIdentifiers: [01Zecter] -> {EB24CA6D-F315-4A81-AC1A-C79CFD77F3F5} => C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll [2010-12-11] (Versionate Inc.)
ShellIconOverlayIdentifiers: [02Zecter] -> {B3C78E40-6B64-47C3-AE34-60B770881EB8} => C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll [2010-12-11] (Versionate Inc.)
ShellIconOverlayIdentifiers: [03Zecter] -> {622AFE52-33F6-4D9F-9966-E0BC52D7D69D} => C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll [2010-12-11] (Versionate Inc.)
ShellIconOverlayIdentifiers: [04Zecter] -> {855156F0-2A0F-11DE-8C30-0800200C9A66} => C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\ShellExt64.dll [2010-12-11] (Versionate Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
BootExecute: autocheck autochk * C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/CQNOT/4
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={BB6AC6CB-450F-4BB7-ABE8-1D0DEA4E45E9}&mid=bdcee424709047d19695fd6e91e8459e-a1e07841ae5b7696135524136695e0477d50f4ee&lang=en&ds=AVG&coid=avgtbavg&cmpid=0215av&pr=fr&d=2015-03-17 20:40:44&v=4.1.0.411&pid=wtu&sg=&sap=hp
URLSearchHook: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://www.searchqu.com/web?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://www.searchqu.com/web?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://www.searchqu.com/web?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://www.searchqu.com/web?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={BB6AC6CB-450F-4BB7-ABE8-1D0DEA4E45E9}&mid=bdcee424709047d19695fd6e91e8459e-a1e07841ae5b7696135524136695e0477d50f4ee&lang=en&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2015-03-17 20:40:44&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={BB6AC6CB-450F-4BB7-ABE8-1D0DEA4E45E9}&mid=bdcee424709047d19695fd6e91e8459e-a1e07841ae5b7696135524136695e0477d50f4ee&lang=en&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2015-03-17 20:40:44&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://www.searchqu.com/web?src=ieb&appid=0&systemid=413&sr=0&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {AC5B8ED4-C8A1-498C-9F56-198CD6E19564} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=35D0A8DF-8A4D-4D72-81D5-928927A9B6F0&apn_sauid=6CA7E3A2-D116-4BFF-8CD6-669DE1D6A0B2
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CPNTDF
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/?a=6R8SZlXT66&loc=skw&search={searchTerms}&i=26
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox
BHO: AVG Do Not Track -> {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} -> C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll [2012-10-15] (AVG Technologies CZ, s.r.o.)
BHO: IB Updater -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\IB Updater\Extension64.dll [2012-10-23] ()
BHO: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll [2012-10-15] (AVG Technologies CZ, s.r.o.)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL No File
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-26] (Sun Microsystems, Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: AVG Do Not Track -> {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} -> C:\Program Files (x86)\AVG\AVG2012\avgdtiex.dll [2012-10-15] (AVG Technologies CZ, s.r.o.)
BHO-x32: IB Updater -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\IB Updater\Extension32.dll [2012-10-23] ()
BHO-x32: AVG Safe Search -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> C:\Program Files (x86)\AVG\AVG2012\avgssie.dll [2012-10-15] (AVG Technologies CZ, s.r.o.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-07-07] (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.0.411\AVG Web TuneUp.dll [2015-03-17] (AVG)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-05-04] (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-07-07] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll [2012-05-04] (Ask)
Toolbar: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll [2012-03-27] (AVG Technologies CZ, s.r.o.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll [2012-03-27] (AVG Technologies CZ, s.r.o.)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52920 2011-04-26] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default
FF DefaultSearchUrl: hxxp://search.fbdownloader.com/search.php?channel=sfde203fbdgy21&q=
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Search
FF Homepage: hxxp://mystart.incredibar.com/?a=6R8SZlXT66&i=26&did=10963&loc=skw
FF Keyword.URL: hxxp://mystart.incredibar.com/?a=6R8SZlXT66&i=26&did=10963&loc=skw&search=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-18] ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll [2011-04-26] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll [2010-08-18] (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-05-06] ()
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.4.0\\npsitesafety.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-07-07] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-09] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\searchplugins\askcom.xml [2012-10-23]
FF SearchPlugin: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\searchplugins\avg-secure-search.xml [2015-03-17]
FF SearchPlugin: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\searchplugins\fbdownloader_search.xml [2014-01-20]
FF SearchPlugin: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\searchplugins\MyStart Search.xml [2015-02-09]
FF SearchPlugin: C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\searchplugins\search.xml [2015-03-25]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-03-17]
FF Extension: AVG Web TuneUp - C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\Extensions\avg@toolbar [2015-03-17]
FF Extension: Ask Toolbar - C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\Extensions\toolbar@ask.com [2012-10-23]
FF Extension: OfferMosquito - C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\Extensions\om@offermosquito.com.xpi [2013-12-19]
FF Extension: No Name - C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\Extensions\snt@dotlabs.co.xpi [2013-12-16]
FF Extension: No Name - C:\Users\Merle Fuchs\AppData\Roaming\Mozilla\Firefox\Profiles\bz2eowpb.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-03-31]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF Extension: IB Updater - C:\Program Files\IB Updater\Firefox [2012-11-14]
FF HKLM-x32\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files (x86)\AVG\AVG2012\Firefox4
FF Extension: AVG Safe Search - C:\Program Files (x86)\AVG\AVG2012\Firefox4 [2012-01-14]
FF HKLM-x32\...\Firefox\Extensions: [{F53C93F1-07D5-430c-86D4-C9531B27DFAF}] - C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack
FF Extension: AVG Do Not Track - C:\Program Files (x86)\AVG\AVG2012\Firefox\DoNotTrack [2012-09-15]
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2012-12-18]
FF HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2015-03-31] <==== ATTENTION
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "hxxp://search.fbdownloader.com/?channel=sfde203fbdgy21"
CHR DefaultSearchKeyword: Default -> mystart.incredibar.com/
CHR DefaultSearchURL: Default -> hxxp://mystart.incredibar.com/?a=6R8SZlXT66&i=26&did=10963&loc=skw&search={searchTerms}
CHR DefaultSuggestURL: Default ->
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\41.0.2272.101\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.2.183.13\npGoogleOneClick8.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Profile: C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16]
CHR Extension: (McAfee Security Scan+) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\bopakagnckmlgajfccecajhnimjiiedh [2014-03-08]
CHR Extension: (Google Search) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16]
CHR Extension: (IB Updater) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd [2013-03-06]
CHR Extension: (OfferMosquito) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbmdkmlcnbapgegninelmjbfibaghdmk [2013-06-29]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-22]
CHR Extension: (Skype Click to Call) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-01-25]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-03-06]
CHR Extension: (Google Wallet) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-05]
CHR Extension: (SweetPacks Chrome Extension) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj [2014-01-21]
CHR Extension: (Gmail) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16]
CHR Extension: (Simple New Tab) - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\Extensions\pmgkeimkiojpjcoiiipekfjaopchhjga [2014-01-20]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2012-11-14]
CHR HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gbmdkmlcnbapgegninelmjbfibaghdmk] - C:\Users\Merle Fuchs\AppData\Local\Google\Chrome\User Data\Default\ext_offermosquito\ext_offermosquito.crx [2013-12-19]
CHR HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2012-12-18]
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2012-11-14]
CHR HKLM-x32\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files (x86)\AVG\AVG2012\Chrome\safesearch.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\Program Files (x86)\AVG\AVG2012\Chrome\donottrack.crx [2012-04-20]
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\SysWOW64\jmdp\SweetNT.crx [2014-04-06]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [354304 2011-03-04] (Advanced Micro Devices, Inc.) [File not signed]
R2 AMD Reservation Manager; C:\Program Files\ATI Technologies\ATI.ACE\Reservation Manager\AMD Reservation Manager.exe [194496 2010-06-17] (Advanced Micro Devices)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe [5175856 2013-10-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ezSharedSvc; C:\Windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [3039536 2015-01-05] ()
R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [1817088 2010-12-28] (Realsil Microelectronics Inc.) [File not signed]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 vToolbarUpdater18.4.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe [1875480 2015-03-17] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [620056 2015-03-17] ()
S3 Microsoft SharePoint Workspace Audit Service; "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [127328 2012-12-10] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfiltera.sys [29776 2011-12-23] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. )
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [307040 2012-11-08] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [384800 2014-11-04] (AVG Technologies CZ, s.r.o.)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-20 19:53 - 2015-04-20 19:57 - 00035730 _____ () C:\Users\Merle Fuchs\Desktop\FRST.txt
2015-04-20 19:50 - 2015-04-20 19:54 - 00000000 ____D () C:\FRST
2015-04-20 19:44 - 2015-04-20 19:44 - 02099712 _____ (Farbar) C:\Users\Merle Fuchs\Desktop\FRST64.exe
2015-04-20 19:36 - 2015-04-20 19:36 - 01139200 _____ (Farbar) C:\Users\Merle Fuchs\Desktop\FRST.exe
2015-04-20 19:21 - 2015-04-20 19:21 - 00000484 _____ () C:\Users\Merle Fuchs\Desktop\defogger_disable.log
2015-04-20 19:21 - 2015-04-20 19:21 - 00000000 _____ () C:\Users\Merle Fuchs\defogger_reenable
2015-04-20 19:07 - 2015-04-20 19:08 - 00050477 _____ () C:\Users\Merle Fuchs\Desktop\Defogger.exe
2015-04-20 18:39 - 2015-04-20 18:40 - 00000000 ____D () C:\3036dcd5a0443c4fcd
2015-03-31 00:10 - 2015-04-20 19:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-30 20:24 - 2015-03-30 20:25 - 00275152 _____ () C:\Windows\Minidump\033015-82945-01.dmp
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-20 19:55 - 2011-05-27 10:35 - 01059557 _____ () C:\Windows\WindowsUpdate.log
2015-04-20 19:50 - 2013-06-08 22:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-20 19:50 - 2011-12-16 20:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-20 19:21 - 2011-08-21 22:17 - 00000000 ____D () C:\Users\Merle Fuchs
2015-04-20 18:40 - 2013-08-17 11:33 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-20 18:40 - 2011-11-03 21:04 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-20 18:31 - 2011-08-21 22:25 - 00003974 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{AA5C5588-336C-4BA3-A429-34E555B144FB}
2015-04-20 18:05 - 2012-01-14 11:22 - 00000000 ____D () C:\Windows\system32\Drivers\AVG
2015-04-20 18:00 - 2012-07-05 15:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-20 17:36 - 2012-05-08 15:54 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-04-18 23:15 - 2009-07-14 06:51 - 00118335 _____ () C:\Windows\setupact.log
2015-04-18 22:34 - 2011-12-16 20:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-18 21:43 - 2014-10-22 22:12 - 00004168 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2015-04-18 21:30 - 2013-06-29 14:13 - 00000000 ____D () C:\Users\Merle Fuchs\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
2015-04-18 21:29 - 2013-06-08 22:15 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-18 21:29 - 2012-10-14 13:31 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-18 21:29 - 2011-09-05 19:31 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-18 21:19 - 2013-02-14 15:22 - 00000000 ___RD () C:\Users\Merle Fuchs\Dropbox
2015-04-18 21:19 - 2013-02-14 14:56 - 00000000 ____D () C:\Users\Merle Fuchs\AppData\Roaming\Dropbox
2015-04-18 21:11 - 2013-02-14 15:22 - 00001040 _____ () C:\Users\Merle Fuchs\Desktop\Dropbox.lnk
2015-04-18 21:11 - 2013-02-14 15:00 - 00000000 ____D () C:\Users\Merle Fuchs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-18 20:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-04-15 18:36 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-15 18:36 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-15 18:35 - 2011-04-27 00:57 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2015-04-15 18:35 - 2011-04-27 00:57 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2015-04-15 18:35 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-15 18:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-30 20:26 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-30 20:24 - 2014-07-17 18:19 - 273498966 _____ () C:\Windows\MEMORY.DMP
2015-03-30 20:24 - 2014-07-17 18:19 - 00000000 ____D () C:\Windows\Minidump
2015-03-24 22:42 - 2011-09-02 13:15 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-03-22 21:56 - 2009-07-14 06:45 - 00435920 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-22 21:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-22 21:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
==================== Files in the root of some directories =======
2013-07-21 22:20 - 2013-07-21 22:20 - 4188160 _____ () C:\Program Files (x86)\GUT691F.tmp
2013-12-24 23:37 - 2013-12-24 23:37 - 2239256 _____ () C:\Users\Merle Fuchs\AppData\Local\omesuperv.exe
2012-05-08 16:13 - 2012-05-08 16:13 - 0007625 _____ () C:\Users\Merle Fuchs\AppData\Local\Resmon.ResmonCfg
Some content of TEMP:
====================
C:\Users\Merle Fuchs\AppData\Local\Temp\117B125.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\1iQAFBE.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\2PJABA9.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\4XBAEE4.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\525AD5E.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\6P6B99D.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\7a73247.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\8DDC013.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\8DDC782.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\8hzB8E2.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\9O8B1E0.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\9SOB99D.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\APNStub.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\B6B40E6.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\B6BE159.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\bBfB192.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\bmKF0B4.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\bundlesweetimsetup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\ByRB154.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\cUEABB9.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\d29AF41.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\DB4B827.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprm_opl.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\DVUC531.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EAD15F0.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EAD5ADD.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADAE86.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADB402.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADB605.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADB856.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADB901.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBAF5.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBB23.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBC5B.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBCF7.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBDD2.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADBF39.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC0ED.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC293.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC2B2.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC36D.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC495.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC4D4.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC679.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC744.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADC975.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADCADC.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADCCDF.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADCDAA.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADD4EA.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADD622.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADD854.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADDE2D.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADDFD3.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADE07E.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADE59D.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADE6B5.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADEFE9.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\EADFAC2.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\Extract.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\fB6B1B1.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\FVF3E6.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\gM319B7.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\gXFD4FA.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\H0bE474.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\HdZA16C.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\HQBAC16.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\IBNCB69.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\IminentSetup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll158356.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll163411.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll163489.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll163769.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll164035.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll167919.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll170150.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll171039.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll172069.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll172412.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll175813.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll176327.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll180898.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll183410.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll184549.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll193597.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll205094.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll231552.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll233564.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll241068.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installerdll4325689.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\installhelper.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\k8mB125.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\KMMCC33.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\lPDC947.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\M8MACB2.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\MCcCA40.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\MG7BC5B.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\MgEAB7A.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\Mt7CCA1.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\mTFB115.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\MymD335.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\nCvB3D3.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\NNAB8B3.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\NyBB52B.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\OMUAB2C.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\ose00000.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\OU6BBCF.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\PDFCreator-1_3_2_setup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\PJDD5F3.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\PYXAF80.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\Resource.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\rio1k3co.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\RTQ7251.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\Setup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SIuA91A.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP53794.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\sp54373.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\sp54620.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP54714.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP55152.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP56929.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP57049.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\sp58915.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SP59202.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\sp64126.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SQ9AE09.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Merle Fuchs\AppData\Local\Temp\TFD9D67.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\TFlB01C.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\Ur2C6A8.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\V7FA939.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\X2LB885.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\X8SDF17.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\XLBB9FB.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\XqTB8D3.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\zIwABA9.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\ZVFB192.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\ZVwBC4C.exe
C:\Users\Merle Fuchs\AppData\Local\Temp\ZXRBE7D.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-18 22:53
==================== End Of Log ============================
--- --- --- Additiion:FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-04-2015
Ran by Merle Fuchs at 2015-04-20 20:00:35
Running from C:\Users\Merle Fuchs\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.1 64-bit (HKLM\...\{F7ADB493-B913-4D61-9A63-DA736C20C3F2}) (Version: 4.1.2 - Adobe)
Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{3B834B54-EC4B-48E2-BFC6-03FF5DA06F62}) (Version: 11.5.8.612 - Adobe Systems, Inc)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95 - WildTangent) Hidden
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.2.0 - Ask.com) <==== ATTENTION
ATI Catalyst Install Manager (HKLM\...\{E04A3037-2F82-C518-D6CA-A63497D3872F}) (Version: 3.0.808.0 - ATI Technologies, Inc.)
AVG 2012 (HKLM\...\AVG) (Version: 2012.1.2250 - AVG Technologies)
AVG 2012 (Version: 12.0.4311 - AVG Technologies) Hidden
AVG 2012 (Version: 12.1.2250 - AVG Technologies) Hidden
AVG Web TuneUp (HKLM-x32\...\AVG Web TuneUp) (Version: 4.1.0.411 - AVG Technologies)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blasterball 3 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.95 - WildTangent) Hidden
Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cake Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
ccc-core-static (x32 Version: 2011.0304.1135.20703 - Ihr Firmenname) Hidden
chemicus 2 (HKLM-x32\...\{9A294359-0FE9-11D6-83D1-0050BAEB7C9C}) (Version: - )
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Compaq Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.1.13155.3599 - Hewlett-Packard Company)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.2.1.3726 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Die Sims™ 3 (HKLM-x32\...\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}) (Version: 1.26.89 - Electronic Arts)
Die Sims™ 3 Einfach tierisch (HKLM-x32\...\{C12631C6-804D-4B32-B0DD-8A496462F106}) (Version: 10.0.96 - Electronic Arts)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95 - WildTangent) Hidden
Dropbox (HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
EA Download Manager (HKLM-x32\...\EADM) (Version: 5.0.0.255 - Electronic Arts, Inc.)
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.95 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.95 - WildTangent) Hidden
FBDownloader (HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\fbDownloader) (Version: 1.0 - HTTO Group Ltd)
FilesFrog Update Checker (HKLM-x32\...\FilesFrog Update Checker) (Version: - ) <==== ATTENTION
Free FLV Converter V 7.3.0 (HKLM-x32\...\Free FLV Converter_is1) (Version: 7.3.0.0 - Koyote Soft)
Free YouTube to MP3 Converter version 3.11.37.1212 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.37.1212 - DVDVideoSoft Ltd.)
GIMP 2.6.11 (HKLM-x32\...\WinGimp-2.0_is1) (Version: 2.6.11 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP CloudDrive (HKLM-x32\...\ZumoDrive) (Version: - Zecter Inc.)
HP Documentation (HKLM-x32\...\{212A6F92-4871-4BD9-8E4F-F876595DE899}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.1.5 - WildTangent)
HP On Screen Display (HKLM-x32\...\{ED1BD69A-07E3-418C-91F1-D856582581BF}) (Version: 1.3.5 - Hewlett-Packard Company)
HP Power Manager (HKLM-x32\...\{B97E3520-C726-475E-BC0C-7561952633AB}) (Version: 1.2.1 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{53B17A98-5BF0-40BC-AAFF-850A357975AC}) (Version: 2.7.2 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{3B37422F-1A58-4138-AB02-0DD9035C02C6}) (Version: 8.6.4516.3597 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Wireless Assistant (HKLM\...\{9EA86AD9-FB32-4B9E-BD56-3068F9B8031F}) (Version: 4.0.10.0 - Hewlett-Packard)
IB Updater 2.0.0.110 (HKLM\...\{336D0C35-8A85-403a-B9D2-65C292C39087}_is1) (Version: 2.0.0.110 - IncrediBar) <==== ATTENTION
IB Updater Service (HKLM-x32\...\WNLT) (Version: 5.1.5.4 - ) <==== ATTENTION
Insaniquarium Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java(TM) 6 Update 22 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416022FF}) (Version: 6.0.220 - Oracle)
Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
Jewel Quest II (x32 Version: 2.2.0.95 - WildTangent) Hidden
Jewel Quest Solitaire (x32 Version: 2.2.0.95 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Magic Desktop (HKLM-x32\...\EasyBits Magic Desktop) (Version: 3.0 - EasyBits Software AS)
Mathe Coach Klasse 8 (HKLM-x32\...\{B56FC722-BB32-4C16-A16A-B0D96D57F5D0}) (Version: 1.0 - )
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 12.0.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 12.0.1 (x86 de)) (Version: 12.0.1 - Mozilla)
MyPaint 0.9.1 (HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\MyPaint) (Version: 0.9.1 - Martin Renold & MyPaint Development Team)
Nvu 1.0 (HKLM-x32\...\Nvu_is1) (Version: 1.0 - Thorsten Fritz)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
PDFCreator Uninstaller (HKLM-x32\...\bi_uninstaller) (Version: - )
Penguins! (x32 Version: 2.2.0.95 - WildTangent) Hidden
PhotoDose 4.2 (HKLM-x32\...\Photo Dose_is1) (Version: - )
PhotoScape (HKLM-x32\...\PhotoScape) (Version: - )
Picture Collage Maker Free 2.1.2 (HKLM-x32\...\{DEB7295A-D00E-4D45-846C-2947E8C3F080}_is1) (Version: - PearlMountain Soft)
PictureMover (HKLM-x32\...\{264FE20A-757B-492a-B0C3-4009E2997D8A}) (Version: 3.5.0.35 - Hewlett-Packard Company)
Plants vs. Zombies (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.95 - WildTangent) Hidden
Portrait Professional 10.8 Test (HKLM-x32\...\PortraitProfessional10Trial_is1) (Version: 10.8 - Anthropics Technology Ltd.)
QuickTime (HKLM-x32\...\QuickTime) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.42.304.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6287 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7600.77 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0706 - REALTEK Semiconductor Corp.)
Recovery Manager (x32 Version: 1.0.22 - Hewlett-Packard) Hidden
Revo Uninstaller 1.93 (HKLM-x32\...\Revo Uninstaller) (Version: 1.93 - VS Revo Group)
Roll (HKLM-x32\...\RollerCoaster Tycoon Setup) (Version: - )
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Slingo Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Snap (remove only) (HKLM-x32\...\Snap) (Version: - )
Spotify (HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.4.3 - Synaptics Incorporated)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 12.0.2160.11 - TuneUp Software) Hidden
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95 - WildTangent) Hidden
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
Wedding Dash (x32 Version: 2.2.0.95 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3015239711-3654587225-2718622348-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
28-02-2015 12:30:39 Windows Modules Installer
02-03-2015 22:46:43 Windows Update
03-03-2015 17:52:54 Windows Update
10-03-2015 22:45:56 Windows Update
22-03-2015 18:03:08 Windows Update
23-03-2015 23:20:38 Windows Update
25-03-2015 13:38:13 Windows Update
27-03-2015 16:37:58 Windows Update
15-04-2015 18:31:47 Windows Update
20-04-2015 17:28:42 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {05C766DF-442A-4431-B062-71D496ADB6D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-18] (Adobe Systems Incorporated)
Task: {0D95E24C-9074-4DD1-9D5B-37A2D5230368} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2015-01-21] (Hewlett-Packard)
Task: {0E03C30C-17D3-478F-A8C2-4A1AE916141B} - System32\Tasks\ServicePlan => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-12-08] ()
Task: {11B3A631-7DD9-4077-8164-E0801A710F96} - System32\Tasks\{9BAD9DF2-B453-4397-9332-13B7F24EE7BD} => Firefox.exe hxxp://ui.skype.com/ui/0/5.10.0.116/de/abandoninstall?page=tsPlugin
Task: {266839EE-87E4-4B65-B32D-75CA623A3DD1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {2702FAAB-9BBF-4279-A7A0-8DC9E04B5105} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {6E1A54E6-CE06-4343-B295-0C061B346A3A} - System32\Tasks\{6A5F62A1-F0B3-45F5-968B-AEBF258EB69B} => Firefox.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar
Task: {835B243A-40F0-4C46-BF72-02E1D5023BE1} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-12-08] ()
Task: {93AE2A1C-98C4-4219-BFE2-04AD29769A3F} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-05-04] () <==== ATTENTION
Task: {9469C9E1-2477-4079-ABCB-D16781DE381D} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\Merle Fuchs\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\MinibarChrome.exe [2013-06-29] (Sien SA)
Task: {9EC1A54F-6C1E-4DF2-9364-CB0285C42C6E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {A12CD024-DED7-475E-B44B-A1502EDF4E83} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A73241B6-4043-4503-BB12-6ADBDAF0061B} - System32\Tasks\{3806D22D-B521-4322-82C5-5495D558864F} => pcalua.exe -a "C:\Users\Merle Fuchs\Downloads\HiJackThis204.exe" -d "C:\Program Files (x86)\Mozilla Firefox"
Task: {B7FB0B4E-EFC9-4A63-AC2B-027AF734BDEB} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D0CAD85F-2B87-4EA2-8109-FAD4EB4D0FAA} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe [2013-11-04] (Hewlett-Packard Company)
Task: {D3DC8D18-D58A-4C09-A3E0-033B59F60446} - System32\Tasks\ROC_REG_JAN_DELETE => C:\ProgramData\AVG January 2013 Campaign\ROC.exe [2013-01-17] ()
Task: {DC4419C1-51A8-40E5-B834-396DB38934EC} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-02-09] (CyberLink)
Task: {E7569FF8-EAD1-464F-A82A-578C5F66A70F} - System32\Tasks\Hewlett-Packard\HP Assistant\HPSA Upgrade => C:\ProgramData\Hewlett-Packard\HPSAUpgrade3\HpSAUpgrade.exe [2011-08-11] (Hewlett-Packard)
Task: {EBEE4329-FDE4-492B-8A28-475AB0A29BE1} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {FC801FCC-8A15-4DAD-AEA8-41B0002CD834} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\ROC_REG_JAN_DELETE.job => C:\ProgramData\AVG January 2013 Campaign\ROC.exe
==================== Loaded Modules (whitelisted) ==============
2015-03-17 21:33 - 2015-03-17 21:28 - 00620056 ____N () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
2014-02-28 19:11 - 2015-01-05 18:48 - 03039536 _____ () C:\Windows\system32\dmwu.exe
2011-03-04 12:43 - 2011-03-04 12:43 - 00079872 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Services.dll
2011-03-04 12:44 - 2011-03-04 12:44 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2015-03-17 21:39 - 2015-03-17 21:28 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe
2010-07-21 14:33 - 2010-07-21 14:33 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2010-01-30 02:40 - 2010-01-30 02:40 - 04254560 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2015-01-05 18:48 - 2015-01-05 18:48 - 00781616 _____ () C:\Windows\SysWOW64\mjcm\dnkt.exe
2015-01-05 18:48 - 2015-01-05 18:48 - 00921392 _____ () C:\Windows\System32\tprb\dnkt.exe
2015-01-05 18:48 - 2015-01-05 18:48 - 02154288 _____ () C:\Windows\System32\tprb\5154\nsib.dll
2010-07-21 14:33 - 2010-07-21 14:33 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-07-21 14:33 - 2010-07-21 14:33 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2015-03-17 21:37 - 2015-03-17 21:28 - 03033112 _____ () C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
2014-07-31 12:16 - 2014-07-31 12:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 12:16 - 2014-07-31 12:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-03-17 21:39 - 2015-03-17 21:28 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\log4cplusU.dll
2015-01-05 18:48 - 2015-01-05 18:48 - 01710384 _____ () C:\Windows\SysWOW64\mjcm\5154\nsib.dll
2015-03-17 21:36 - 2015-03-17 21:28 - 40630296 _____ () C:\Program Files (x86)\AVG Web TuneUp\libcef.dll
2015-04-18 21:13 - 2015-04-18 21:13 - 00043008 _____ () c:\Users\Merle Fuchs\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprm_opl.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2015-03-17 21:39 - 2015-03-17 21:28 - 01794584 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\ScriptHelperInstaller\18.4.0\avgtbr.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Merle Fuchs\Super Verstecke.eml:OECustomProperty
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3015239711-3654587225-2718622348-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Merle Fuchs\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-3015239711-3654587225-2718622348-500 - Administrator - Disabled)
Gast (S-1-5-21-3015239711-3654587225-2718622348-501 - Limited - Enabled) => C:\Users\Gast
Merle Fuchs (S-1-5-21-3015239711-3654587225-2718622348-1001 - Administrator - Enabled) => C:\Users\Merle Fuchs
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/20/2015 05:59:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 41.0.2272.101 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 16e4
Startzeit: 01d07a0e18ac2b45
Endzeit: 60000
Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Berichts-ID: 133b29ad-e775-11e4-98ce-2c27d70cac6d
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 254485
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 254485
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 253377
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 253377
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 252379
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 252379
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
System errors:
=============
Error: (04/20/2015 07:47:48 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft Office 2010, 64-Bit-Edition (KB2553092)
Error: (04/20/2015 05:40:25 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (04/20/2015 05:24:56 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {CA3A5461-96B5-46DD-9341-5350D3C94615}
Error: (04/20/2015 05:24:52 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Netman erreicht.
Error: (04/18/2015 09:19:52 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Service Pack 2 für Microsoft Office 2010 (KB2687455) 64-Bit-Edition
Error: (04/18/2015 08:30:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft Outlook Social Connector 2010 (KB2553406) 64-Bit-Edition
Error: (04/18/2015 08:30:16 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Office-Dateiüberprüfung 2010, 64-Bit-Edition (KB2553065)
Error: (04/18/2015 08:30:15 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft OneNote 2010 (KB2553290) 64-Bit-Edition
Error: (04/18/2015 08:30:15 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Office 2010 (KB2956207) 64-Bit-Edition
Error: (04/18/2015 08:30:15 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Office 2010 (KB982726) 64-Bit-Edition
Microsoft Office Sessions:
=========================
Error: (04/20/2015 05:59:14 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: chrome.exe41.0.2272.10116e401d07a0e18ac2b4560000C:\Program Files (x86)\Google\Chrome\Application\chrome.exe133b29ad-e775-11e4-98ce-2c27d70cac6d
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 254485
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 254485
Error: (04/20/2015 05:45:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 253377
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 253377
Error: (04/20/2015 05:45:13 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 252379
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 252379
Error: (04/20/2015 05:45:12 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
==================== Memory info ===========================
Processor: AMD C-50 Processor
Percentage of memory in use: 93%
Total physical RAM: 1642.9 MB
Available physical RAM: 101.83 MB
Total Pagefile: 4168.89 MB
Available Pagefile: 1362.8 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:283.08 GB) (Free:173.94 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:14.72 GB) (Free:1.27 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (GOSSIP_GIRL_SEASON_4_DISC_2) (CDROM) (Total:6.69 GB) (Free:0 GB) UDF
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 2AE82D91)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=283.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=14.7 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)
==================== End Of Log ============================
Gmer: GMER Logfile: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-20 22:10:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000064 Hitachi_ rev.ES2O 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\MERLEF~1\AppData\Local\Temp\kxloyfoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076181401 2 bytes JMP 7582b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076181419 2 bytes JMP 7582b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076181431 2 bytes JMP 758a8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007618144a 2 bytes CALL 758048ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000761814dd 2 bytes JMP 758a87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000761814f5 2 bytes JMP 758a8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007618150d 2 bytes JMP 758a8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076181525 2 bytes JMP 758a8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007618153d 2 bytes JMP 7581fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076181555 2 bytes JMP 758268ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007618156d 2 bytes JMP 758a8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076181585 2 bytes JMP 758a8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007618159d 2 bytes JMP 758a865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000761815b5 2 bytes JMP 7581fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000761815cd 2 bytes JMP 7582b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000761816b2 2 bytes JMP 758a8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[2360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000761816bd 2 bytes JMP 758a85f1 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----
Library c:\users\merlef~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmprm_opl.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408](2015-04-18 19:13:03) 0000000002e00000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 000000006ea40000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (ICU I18N DLL/The ICU Project)(2015-03-04 21:45:30) 000000004a900000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (ICU Common DLL/The ICU Project)(2015-03-04 21:45:30) 0000000005a60000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (ICU Data DLL/The ICU Project)(2015-03-04 21:45:30) 000000004ad00000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 000000006bbd0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006d5a0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408](2015-03-04 21:45:30) 000000006ce10000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006cc30000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006abe0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006c710000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000064890000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006ea10000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408](2015-03-04 21:45:30) 0000000075280000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 000000006e850000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006cbf0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006cba0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408](2015-03-04 21:45:30) 00000000647b0000
Library C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Merle Fuchs\AppData\Roaming\Dropbox\bin\Dropbox.exe [4408](2015-03-04 21:45:30) 000000006cb60000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings@StringCacheGeneration 8874
---- EOF - GMER 2.1 ----
Hoffe, dass alles richtig ist.  |
| Themen zu Windows Vista incredibar-search ASK-Toolbar vermutlich Malware, Rechner sehr langsam |
| adobe, adware, avg, bonjour, browser, cid, converter, defender, device driver, firefox, flash player, hijack, hijackthis, home, homepage, incredibar loswerden, langsam, launch, malware, mozilla, mp3, photoshop, realtek, registry, secure search, security, software, vista, vtoolbarupdater, windows |
Baum-Darstellung