|
Log-Analyse und Auswertung: Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastetWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
21.08.2015, 19:56 | #1 |
| Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet. Ich kann den PC überhaupt nicht mehr nutzen. In allen Browsern wurden die Suchmaschinen ausgewechselt. Es haben sich sehr viele Programme neu installiert. Diese Programme habe ich aber nicht selber heruntergeladen zumindest nicht wissentlich. Ich möchte nicht so gerne Windows neu installieren da ich einen originalen Windows 8 Rechner habe und auf Windows 81 zukommen muss ich wieder die große Schleife über Windows 8 machen. Vielen Dank für eure Hilfe |
21.08.2015, 20:30 | #2 |
/// the machine /// TB-Ausbilder | Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke. So funktioniert es: Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
22.08.2015, 09:12 | #3 |
| Frst.txtCode:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:21-08-2015 durchgeführt von VeraHagge (Administrator) auf BINE-VERA (21-08-2015 16:54:15) Gestartet von C:\Users\VeraHagge\Downloads Geladene Profile: VeraHagge & Administrator (Verfügbare Profile: VeraHagge & Administrator) Platform: Windows 8.1 Connected (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: FF) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe () C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\hnspF5E6.tmp () C:\Program Files\shopperz22072015\csrcc.exe () C:\Program Files\shopperz22072015\Jmahzov.exe () C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe () C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\jnszDA4E.tmp (XTab system) C:\Program Files (x86)\MiuiTab\ProtectService.exe () C:\Windows\SysWOW64\nethtsrv.exe (Kromtech) C:\Program Files\Kromtech\PCKAV\PCKAVService.exe () C:\Windows\SysWOW64\netupdsrv.exe () C:\Program Files\shopperz22072015\Jvpmajlij.exe (Search Module Ltd.) C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe (ShopperPro) C:\Program Files\Common Files\ShopperPro\spbiu.exe () C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\knsy42C5.tmp (WS) C:\Program Files (x86)\WordShark_1.10.0.20\Service\wssvc.exe (AMD) C:\Windows\System32\atieclxx.exe (Tuto4PC) C:\Program Files (x86)\DailyPCClean\DPCCSchedule.exe (Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe (Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe (Buca Apps) C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe (SecurityUtility) C:\ProgramData\SecurityUtility\SecurityUtility.exe () C:\Program Files\shopperz22072015\Huyde.exe () C:\Program Files\shopperz22072015\Huyde64.exe (SecurityUtility) C:\ProgramData\SecurityUtility\SecurityUtility.exe (SearchProtect) C:\Program Files (x86)\MiuiTab\CmdShell.exe () C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe (XTab system) C:\Program Files (x86)\MiuiTab\HPNotify.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe (Kromtech) C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe () C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe () C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (SoftBrain Technologies Ltd.) C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Program Files (x86)\rec_de_57\rec_de_57.exe (SoftBrain Technologies Ltd.) C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebApp.exe () C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe konnte nicht auf den Prozess zugreifen -> sgminer.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe () C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe (Tuto4PC) C:\Program Files (x86)\DailyPCClean\DailyPCClean.exe () C:\Program Files (x86)\Optimizer Pro 3.99\OptimizerPro.exe (Avanquest Software) C:\Program Files (x86)\OneSafe PC Cleaner\OneSafePCCleaner.exe () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe (DTools LIMITED) C:\ProgramData\eWinManProe\ProtectWindowsManager.exe () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe (Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe (Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe () C:\Program Files (x86)\baidu\pps.exe () C:\Program Files (x86)\baidu\Bind.exe (Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe (iQIYI.COM) C:\IQIYI Video\Common\QyKernel.exe () C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe (Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe () C:\Users\VeraHagge\AppData\Local\Temp\nseBB78.tmp\setup.exe () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Goobzo LTD) C:\Program Files (x86)\ShopperPro\ShopperPro.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe (Unique Solutions) C:\ProgramData\rKRjrFKiDD\JwTtFpw.exe (Unique Solutions) C:\ProgramData\rKRjrFKiDD\dat\DmlQqncMGlH.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe () C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe () C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe (WS) C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe (Microsoft Corporation) C:\Windows\System32\sc.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TAOFrame.exe (Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe (Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe (Farbar) C:\Users\VeraHagge\Downloads\FRST64(1).exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-22] (Realtek Semiconductor) HKLM\...\Run: [shopperz22072015] => C:\Program Files\shopperz22072015\Huyde.exe [434040 2015-07-22] () HKLM\...\Run: [shopperz2207201564] => C:\Program Files\shopperz22072015\Huyde64.exe [464760 2015-07-22] () HKLM\...\Run: [prtstart] => C:\Program Files\shopperz22072015\dr_inst.exe [140664 2015-07-22] () HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe" HKLM\...\Run: [gpuminer] => C:\Users\VeraHagge\AppData\Roaming\cpuminer\sgminer\sgminer.cmd [96 2015-05-02] () HKLM\...\Run: [cpuminer] => C:\WINDOWS\system32\cpuminer-gw64.exe [1423136 2015-08-07] () HKLM\...\Run: [Windesk Winsearch] => C:\Program Files (x86)\WindeskWinsearch\Windesk Winsearch.exe [1061256 2015-04-08] (Windesk Winsearch) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-08-12] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation) HKLM-x32\...\Run: [mbot_de_012010041] => [X] HKLM-x32\...\Run: [SmartWeb] => C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.) HKLM-x32\...\Run: [gmsd_de_005010041] => [X] HKLM-x32\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [3225088 2015-07-26] () HKLM-x32\...\Run: [rec_de_57] => C:\Program Files (x86)\rec_de_57\rec_de_57.exe [3979408 2015-07-27] () HKLM-x32\...\Run: [gmsd_de_005010057] => C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe [3984016 2015-08-10] () HKLM-x32\...\Run: [gmsd_de_005010066] => C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe [3978384 2015-08-20] () HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe [355296 2015-08-21] (Tencent) HKLM-x32\...\RunOnce: [upgmsd_de_005010057.exe] => C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe [3346064 2015-08-10] () HKLM-x32\...\RunOnce: [upgmsd_de_005010066.exe] => C:\Users\VeraHagge\AppData\Local\gmsd_de_005010066\upgmsd_de_005010066.exe [3336848 2015-08-20] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Boost] => C:\Program Files (x86)\Boost\Boost.exe [445328 2015-06-17] (Boost Shopping) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [OffersWizard update] => C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe [982016 2015-08-10] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [PCKeeper2] => C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe [915976 2015-05-25] (Kromtech) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [PCKeeper Antivirus] => C:\Program Files\Kromtech\PCKAV\PCKAV.exe [332896 2015-07-17] (Kromtech) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [DesktopSearch] => C:\ProgramData\DesktopSearch\DesktopSearch.exe -ros -tray HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe [148112 2015-07-23] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [GoogleChromeAutoLaunch_550A9DCE601CA31D56B975602575A14B] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [770048 2015-05-11] (Crossbrowse) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [DeskBar] => C:\Users\VeraHagge\AppData\Local\DeskBar\dblaunch.exe [239104 2015-07-28] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [3225088 2015-07-26] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [InetStat] => C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe [840206 2015-07-28] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Shop-wit] => C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe [656128 2015-07-30] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Super Optimizer] => C:\Program Files (x86)\Super Optimizer\SupOptLauncher.exe [676400 2015-07-31] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [apphide] => C:\Program Files (x86)\baidu\pps.exe [77824 2015-08-12] () HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [HCDNClient] => C:\IQIYI Video\Common\QyKernel.exe [576104 2015-05-12] (iQIYI.COM) HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe -h HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [PCKeeper2] => C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe [915976 2015-05-25] (Kromtech) HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [PCKeeper Antivirus] => C:\Program Files\Kromtech\PCKAV\PCKAV.exe [332896 2015-07-17] (Kromtech) AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [247032 2015-08-03] (Client Connect LTD) AppInit_DLLs: C:\ProgramData\SecurityUtility\SecurityUtility64.dll => C:\ProgramData\SecurityUtility\SecurityUtility64.dll Datei nicht gefunden AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [219896 2015-08-03] (Client Connect LTD) AppInit_DLLs-x32: C:\ProgramData\SecurityUtility\SecurityUtility32.dll => C:\ProgramData\SecurityUtility\SecurityUtility32.dll [817152 2015-05-26] (SecurityUtility) Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk [2015-07-26] ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse) Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2015-07-23] ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\OLBPre\OLBPre.exe () Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk [2015-07-26] ShortcutTarget: SmartWeb.lnk -> C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.) ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMGCShellExt64.dll [2015-08-21] (Tencent) GroupPolicy: Gruppenrichtline auf Chrome erkannt <======= ACHTUNG CHR HKLM\SOFTWARE\Policies\Google: Richtlinienbeschränkung <======= ACHTUNG ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=92280131_hao_pg HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=92280131_hao_pg HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.hyrican.de HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1 HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=de-DE&Src=WD8&Tid=000328B0&OHP=http%3A%2F%2Flocaloem.msn.com,http%3A%2F%2Fwww.hyrican.de&OSP=http%3A%2F%2Fwww.bing.com%2Fsearch%3FPC%3DWCUG%26FORM%3DWCUGDF%26q%3D%7BsearchTerms%7D URLSearchHook: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 - (Kein Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - Keine Datei SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339, SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} SearchScopes: HKLM -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339, SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} SearchScopes: HKLM-x32 -> {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=b7672bac-eee2-4450-a0fc-afe69bcdc811&ref=toolbox&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {057F30DD-B52D-4722-895C-938EAD155A71} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {11C97485-3FF2-4457-A2F9-A0D103BEB765} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {184B4FA8-A1E8-4E20-9AA6-52E49443792C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {1BDF2369-538A-43C6-BC28-F6CEE7FC101D} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {1F71DD35-87E5-4AB8-B4C1-66B978B95397} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {2318B3E7-A682-4673-99C3-48E723D68584} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {29C3476D-89F3-4BC9-BCB4-95D3F43025D9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {2F3D2C83-A0B1-4974-8323-2B7119C602BD} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {3064EF31-AB79-4F98-854D-8D1CC55E9FD0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339, SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {35AB5128-2AB2-4FF4-A571-C96D846671BC} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {3C45BDFD-C268-4180-9B4C-3D04D0A1B1CC} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {405F9A19-29E6-4549-A406-A06C66B045CF} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {484047E0-22D1-4088-A063-B19DBC4C07D8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {4EDC63C2-ADA9-4124-8572-78C9C242C78C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {50FFA973-7C7A-4246-970E-5A8F751BDEC7} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5264C23E-EB63-4609-B5B7-AF4FA32C2E0D} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {57DDD6F6-E855-4012-9C56-5A6E7F3B8341} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5A205862-6A60-49BC-98E0-9F94038BB509} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5E15329E-AC33-4854-BD1E-72D7E804E0C9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5EAE81E7-7A5F-42C1-A8A8-C06637421BFA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {60C4FE33-8626-4FFF-BAA6-87203B805B3F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {626A71DA-8EBC-4906-894D-9E5EFABB96FA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {652C6314-A5DD-4495-9702-6F4FB2CDD1D3} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {69362D5A-0373-4BB8-9DF1-AEAF0D4D0008} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {70446E69-B3BD-4EF8-AABF-FEB092C86F64} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {72511F50-3731-4843-9AA9-A0768E6C56B9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {777AE081-BA32-4A7B-A743-0120E787FB99} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339, SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {837C3F4D-E4FA-4BA0-BBB9-038E4AB9DF7F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {84930819-BDF6-4618-B9E3-EE2369EB96AB} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {880D922A-AB3A-47CF-A2A0-4874114BD441} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {89E21140-DB28-4977-9549-D86ED009E9D3} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {8BD3FD3A-A717-43E3-8DFF-2111EF14DBA2} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {94012578-1D0A-4FD5-B277-1A5D754749D9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {981756DC-CBE8-4CC2-97F9-E2E45ECF3598} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {998AF2BF-D297-48B7-8476-FA8EE2B70AD2} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {9DB9FE33-B0C5-4D1E-8549-8768545F858C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {A2A73F41-6602-4F45-BFF4-B1EC9CAC4517} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {A5C8AC00-5065-4804-B73F-B0BA2FC4B65F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {B156A8F5-1821-4D62-BA1E-EA463FB24B21} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BBB7BE18-9AF7-4D4A-855F-B056B851D4DF} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BC3169B8-22BB-49FE-9D99-A0D0F40AE3C0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BEA7FEEB-4BE0-451B-995A-B61A4BF6F0B1} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BF5BAEAD-5FF5-4C5D-BC99-732209C768D8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {C46AB282-F3D2-41B8-A49A-52BBAD05884C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {C8E344FF-66E1-4B0D-BF13-6B30205CBF21} URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {CB52B59C-F5E8-4EFC-A19A-F1732B183BF8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {D48BC3F2-5109-4660-BAB6-7612738EF947} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E24CDA9F-E6D6-4A97-ABDC-8B8143018B92} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E2EB6FC6-2977-4DB1-9D98-2CC94CD63BC6} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E2ED86BC-EDD1-4A34-AA7C-52C2606C452C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E44E33FC-0DFF-458F-A8A6-02BAFC4C3E14} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EB2B76A5-848A-4EE3-B65D-0607DE69FE37} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EC099E9B-4DDE-4F92-8D0D-E633C6CACADA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EFF25583-5088-43DF-8179-B12F17328E87} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {F4B869AF-2472-464E-AEAE-E2852651CB1F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {F6F6209F-E89D-45FD-AD59-34878C61A3F1} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {FF215A2A-39B9-4DFC-B40F-5D3163BD5BBE} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-500 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-500 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSWebMon64.dat [2015-08-21] (Tencent) BHO: adTech Class -> {934B156A-3D17-3981-B78A-5C138F423AD6} -> C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_64.dll [2015-08-05] () BHO: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro64.dll [2015-07-26] (Goobzo Ltd.) BHO-x32: GoodTab Class -> {1F91A9A1-01BA-4c81-863D-3BA0751E1419} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-08-04] (Good Co. Limited) BHO-x32: adTech Class -> {934B156A-3D17-3981-B78A-5C138F423AD6} -> C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_32.dll [2015-08-05] () BHO-x32: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro.dll [2015-07-26] (Goobzo Ltd.) BHO-x32: °®ÆæÒÕÖúÊÖ -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> C:\IQIYI Video\Common\Accelerator\IEHelper.dll [2015-04-29] (爱奇艺) Toolbar: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Keine Datei Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited) Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited) Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited) Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited) Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited) Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited) Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited) Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited) Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited) Winsock: Catalog9-x64 15 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [NameServer] 52.18.92.32,8.8.8.8 Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{bbed3e08-0b41-11e3-8249-806e6f6e6963}: [NameServer] 52.18.92.32,8.8.8.8 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.oursurfing.com/?type=sc&ts=1436658449&z=13abf1ab21cdeb884a3e887gdz3c4qbqbweb3z8zdc&from=pjr&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT FireFox: ======== FF ProfilePath: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516 FF NewTab: hxxp://www.mystartsearch.com/newtab/?type=nt&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT FF DefaultSearchEngine: mystartsearch FF SelectedSearchEngine: mystartsearch FF Homepage: hxxp://www.mystartsearch.com/?type=hp&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT FF Keyword.URL: hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339, FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-21] () FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] () FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-21] () FF Plugin-x32: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] () FF Plugin-x32: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司) FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-17] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-17] (Oracle Corporation) FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\npQMExtensionsMozilla.dll [2015-08-21] (Tencent Technology (Shenzhen) Company Limited) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-07-26] (globalUpdate) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-07-26] (globalUpdate) FF Plugin HKU\S-1-5-21-3742509177-3204372618-1584296459-1002: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司) FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\istartsurf.xml [2015-07-31] FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\smod.xml [2015-07-27] FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\yahoo-ysp.xml [2015-07-17] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml [2015-08-13] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2015-08-21] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\StartWeb.xml [2015-07-14] FF Extension: PPriiCeLeess - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\22JDQ@j.org [2015-07-26] FF Extension: Lights Cinema 1.3betaV14.07 - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com [2015-08-10] FF Extension: deskCut - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\deskCutv2@gmail.com [2015-08-10] FF Extension: HD4Good - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com [2015-07-31] FF Extension: youtubeadblocker - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\hRGDtVG@B.org [2015-07-26] FF Extension: buyfastt - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\tIxgdvdh@u.org [2015-07-31] FF Extension: Shopper-Pro - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [2015-08-21] FF Extension: Super Web Accelerator ! - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\firefox [2015-08-10] FF HKLM\...\Firefox\Extensions: [{318d2d55-9ce3-446e-8640-a43be68a550f}] - C:\Program Files\shopperz22072015\Firefox FF Extension: shopperz22072015 - C:\Program Files\shopperz22072015\Firefox [2015-07-26] FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\PremierOpinion\firefox FF HKLM-x32\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\uphfrov1.default\extensions\searchffv2@gmail.com FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\extensions\defsearchp@gmail.com FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\extensions\deskCutv2@gmail.com FF HKLM-x32\...\Firefox\Extensions: [{318d2d55-9ce3-446e-8640-a43be68a550f}] - C:\Program Files\shopperz22072015\Firefox StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.mystartsearch.com/?type=sc&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\all-iminent.js [2015-07-26] FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-07-17] Chrome: ======= CHR dev: Chrome dev build erkannt! <======= ACHTUNG CHR HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jlcgehabolcakkjhgmgpkagpolbjlhfa] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [adpeheiliennogfclcgmchdfdmafjegc] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ehhlaekjfiiojlddgndcnefflngfmhen] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fjbbjfdilbioabojmcplalojlmdngbjl] - C:\Users\VeraHagge\AppData\Local\Temp\swlfiles\smileyswelovetoolbar.crx <nicht gefunden> CHR HKLM-x32\...\Chrome\Extension: [nociobghckdhokecfeajdpimjeapnopn] - https://clients2.google.com/service/update2/crx Opera: ======= OPR Extension: (HD4Good) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\hedklcodpbdbhomhhpmkogffkjneikhi [2015-07-12] OPR Extension: (Sale Clipper) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\miincmhponinjhaaagepklkeadfamabi [2015-07-12] OPR Extension: (PremierOpinion) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle [2015-07-12] ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) R2 088c3b28; c:\Program Files (x86)\LibrarySystem\LibrarySystem.dll [2239488 2015-07-31] () [Datei ist nicht signiert] R2 57e40902; c:\Program Files (x86)\wincheck\wincheck.dll [3196928 2015-07-26] () [Datei ist nicht signiert] R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-08-12] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert] S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) R2 c31ed948; c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll [2570896 2015-07-26] () <==== ACHTUNG R2 comyninu; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\hnspF5E6.tmp [161792 2015-07-26] () [Datei ist nicht signiert] R2 csrcc; C:\Program Files\shopperz22072015\csrcc.exe [1448824 2015-07-22] () R2 d0ce99eb-258e-401b-b95b-9e860f91a566; C:\Program Files\shopperz22072015\Jmahzov.exe [285560 2015-07-22] () R2 EZ Software Updater; C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe [221696 2015-02-17] () [Datei ist nicht signiert] <==== ACHTUNG S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [68608 2015-07-26] (globalUpdate) [Datei ist nicht signiert] <==== ACHTUNG S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [68608 2015-07-26] (globalUpdate) [Datei ist nicht signiert] <==== ACHTUNG R2 hyverumu; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\jnszDA4E.tmp [209920 2015-07-26] () [Datei ist nicht signiert] R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-08-04] (XTab system) R2 JwTtFpw; C:\ProgramData\rKRjrFKiDD\JwTtFpw.exe [2731488 2015-07-26] (Unique Solutions) R2 NetHttpService; C:\WINDOWS\SysWOW64\nethtsrv.exe [350720 2015-07-30] () [Datei ist nicht signiert] R2 PCKAVService; C:\Program Files\Kromtech\PCKAV\PCKAVService.exe [192816 2015-07-17] (Kromtech) R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe [297608 2015-08-21] (Tencent) R2 RsMgrSvc; C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe [184088 2015-05-21] (Beijing Rising Information Technology Co., Ltd.) R2 ServiceUpdater; C:\WINDOWS\SysWOW64\netupdsrv.exe [190976 2015-07-30] () [Datei ist nicht signiert] R2 shopperz22072015 Updater; C:\Program Files\shopperz22072015\Jvpmajlij.exe [174968 2015-07-22] () R2 SMUpd; C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe [2865152 2015-07-26] (Search Module Ltd.) [Datei ist nicht signiert] R2 SPBIUpd; C:\Program Files\Common Files\ShopperPro\spbiu.exe [2346416 2015-07-26] (ShopperPro) R3 TAOFrame; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TAOFrame.exe [293728 2015-08-21] (Tencent) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) R2 wesiciku; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\knsy42C5.tmp [708608 2015-07-31] () [Datei ist nicht signiert] S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) R2 WindowsMangerProtect; C:\ProgramData\eWinManProe\ProtectWindowsManager.exe [708264 2015-08-21] (DTools LIMITED) <==== ACHTUNG R2 wssvc_1.10.0.20; C:\Program Files (x86)\WordShark_1.10.0.20\Service\wssvc.exe [300120 2015-07-06] (WS) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S5 3ware; C:\Windows\System32\drivers\3ware.sys [108896 2013-08-22] (LSI) R5 ACPI; C:\Windows\System32\drivers\ACPI.sys [533824 2014-10-07] (Microsoft Corporation) R5 acpiex; C:\Windows\System32\Drivers\acpiex.sys [79712 2013-08-22] (Microsoft Corporation) S5 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra) S5 agp440; C:\Windows\System32\drivers\agp440.sys [62304 2013-08-22] (Microsoft Corporation) S5 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) S5 amdsata; C:\Windows\System32\drivers\amdsata.sys [79200 2013-08-22] (Advanced Micro Devices) S5 amdsbs; C:\Windows\System32\drivers\amdsbs.sys [259424 2013-08-22] (AMD Technologies Inc.) S5 amdxata; C:\Windows\System32\drivers\amdxata.sys [25952 2013-08-22] (Advanced Micro Devices) R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices) S5 arcsas; C:\Windows\System32\drivers\arcsas.sys [114016 2013-08-22] (PMC-Sierra, Inc.) R5 atapi; C:\Windows\System32\drivers\atapi.sys [26464 2013-08-22] (Microsoft Corporation) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices) S5 b06bdrv; C:\Windows\System32\drivers\bxvbda.sys [531296 2013-08-22] (Broadcom Corporation) R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [61336 2015-06-18] (Cherimoya Ltd) R5 CLFS; C:\Windows\System32\drivers\CLFS.sys [377152 2015-03-04] (Microsoft Corporation) R5 CNG; C:\Windows\System32\Drivers\cng.sys [561928 2015-03-30] (Microsoft Corporation) R5 disk; C:\Windows\System32\drivers\disk.sys [100192 2013-08-22] (Microsoft Corporation) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider) S5 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation) S5 EhStorClass; C:\Windows\System32\drivers\EhStorClass.sys [82784 2013-08-22] (Microsoft Corporation) S5 EhStorTcgDrv; C:\Windows\System32\drivers\EhStorTcgDrv.sys [114016 2013-08-22] (Microsoft Corporation) R5 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [79192 2014-03-18] (Microsoft Corporation) R5 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [354112 2014-08-26] (Microsoft Corporation) U5 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [30048 2013-08-22] (Microsoft Corporation) R5 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [589656 2014-07-18] (Microsoft Corporation) S5 gagp30kx; C:\Windows\System32\drivers\gagp30kx.sys [65888 2013-08-22] (Microsoft Corporation) S5 HpSAMD; C:\Windows\System32\drivers\HpSAMD.sys [64352 2013-08-22] (Hewlett-Packard Company) S5 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [24416 2013-08-22] (Microsoft Corporation) S5 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation) S5 iaStorV; C:\Windows\System32\drivers\iaStorV.sys [412000 2013-08-22] (Intel Corporation) S5 intelide; C:\Windows\System32\drivers\intelide.sys [18272 2013-08-22] (Microsoft Corporation) R5 intelpep; C:\Windows\System32\drivers\intelpep.sys [39744 2014-10-13] (Microsoft Corporation) S5 isapnp; C:\Windows\System32\drivers\isapnp.sys [21856 2013-08-22] (Microsoft Corporation) R5 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [100672 2014-10-29] (Microsoft Corporation) R5 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [178008 2015-06-28] (Microsoft Corporation) S5 LSI_SAS; C:\Windows\System32\drivers\lsi_sas.sys [109408 2013-08-22] (LSI Corporation) S5 LSI_SAS2; C:\Windows\System32\drivers\lsi_sas2.sys [93536 2013-08-22] (LSI Corporation) S5 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation) S5 LSI_SSS; C:\Windows\System32\drivers\lsi_sss.sys [82784 2013-08-22] (LSI Corporation) S5 megasas; C:\Windows\System32\drivers\megasas.sys [56672 2013-08-22] (LSI Corporation) S5 megasr; C:\Windows\System32\drivers\megasr.sys [575840 2013-08-22] (LSI Corporation, Inc.) R5 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [101720 2015-07-16] (Microsoft Corporation) R5 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [17248 2013-08-22] (Microsoft Corporation) R5 Mup; C:\Windows\System32\Drivers\mup.sys [78688 2013-08-22] (Microsoft Corporation) S5 mvumis; C:\Windows\System32\drivers\mvumis.sys [63840 2013-08-22] (Marvell Semiconductor, Inc.) R5 NDIS; C:\Windows\System32\drivers\ndis.sys [1113944 2015-07-14] (Microsoft Corporation) R1 nethfdrv; C:\WINDOWS\system32\drivers\nethfdrv.sys [46160 2015-07-30] (nethfdrv) S5 nvraid; C:\Windows\System32\drivers\nvraid.sys [150368 2013-08-22] (NVIDIA Corporation) S5 nvstor; C:\Windows\System32\drivers\nvstor.sys [168288 2013-08-22] (NVIDIA Corporation) S5 nv_agp; C:\Windows\System32\drivers\nv_agp.sys [124768 2013-08-22] (Microsoft Corporation) R5 partmgr; C:\Windows\System32\drivers\partmgr.sys [88896 2014-10-15] (Microsoft Corporation) R5 pci; C:\Windows\System32\drivers\pci.sys [280384 2014-07-24] (Microsoft Corporation) R5 pciide; C:\Windows\System32\drivers\pciide.sys [14688 2013-08-22] (Microsoft Corporation) S5 pcmcia; C:\Windows\System32\drivers\pcmcia.sys [114528 2013-08-22] (Microsoft Corporation) R5 pcw; C:\Windows\System32\drivers\pcw.sys [50016 2013-08-22] (Microsoft Corporation) R5 pdc; C:\Windows\System32\drivers\pdc.sys [86336 2014-10-13] (Microsoft Corporation) R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMUdisk64.sys [62264 2015-08-21] (Tencent) R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQSysMonX64.sys [127800 2015-08-21] (电脑管家) R5 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [249688 2014-03-18] (Microsoft Corporation) S5 sbp2port; C:\Windows\System32\drivers\sbp2port.sys [107872 2013-08-22] (Microsoft Corporation) S5 SiSRaid2; C:\Windows\System32\drivers\SiSRaid2.sys [44896 2013-08-22] (Silicon Integrated Systems Corp.) S5 SiSRaid4; C:\Windows\System32\drivers\sisraid4.sys [81760 2013-08-22] (Silicon Integrated Systems) R3 SMUpdd; C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys [41632 2015-07-26] () R5 spaceport; C:\Windows\System32\drivers\spaceport.sys [415040 2014-10-29] (Microsoft Corporation) R3 SPBIUpdd; C:\Program Files\Common Files\ShopperPro\spbiw.sys [41632 2015-07-26] () R2 SPDRIVER_1.42.1.2188; C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.sys [52384 2015-07-26] () S5 stexstor; C:\Windows\System32\drivers\stexstor.sys [31072 2013-08-22] (Promise Technology, Inc.) R5 storahci; C:\Windows\System32\drivers\storahci.sys [107872 2013-08-22] (Microsoft Corporation) S5 storflt; C:\Windows\System32\drivers\vmstorfl.sys [49944 2014-10-29] (Microsoft Corporation) S5 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-03-18] (Microsoft Corporation) S5 storvsc; C:\Windows\System32\drivers\storvsc.sys [45888 2013-08-22] (Microsoft Corporation) R2 TAOAccelerator; C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys [99640 2015-08-21] (Tencent) R1 TAOKernelDriver; C:\Windows\System32\Drivers\TAOKernel64.sys [174392 2015-08-21] (Tencent Technology(Shenzhen) Company Limited) R5 Tcpip; C:\Windows\System32\drivers\tcpip.sys [2476376 2015-06-11] (Microsoft Corporation) R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2015-08-21] (电脑管家) R1 TSCPM; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\tscpm64.sys [42296 2015-08-21] (电脑管家) S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSDefenseBT64.sys [28472 2015-08-21] (Tencent) R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSSysKit64.sys [87352 2015-08-21] (电脑管家) S5 uagp35; C:\Windows\System32\drivers\uagp35.sys [64864 2013-08-22] (Microsoft Corporation) S5 uliagpkx; C:\Windows\System32\drivers\uliagpkx.sys [65888 2013-08-22] (Microsoft Corporation) R5 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [37728 2013-08-22] (Microsoft Corporation) S5 viaide; C:\Windows\System32\drivers\viaide.sys [19808 2013-08-22] (VIA Technologies, Inc.) S5 vmbus; C:\Windows\System32\drivers\vmbus.sys [97048 2014-10-29] (Microsoft Corporation) R5 volmgr; C:\Windows\System32\drivers\volmgr.sys [73568 2013-08-22] (Microsoft Corporation) R5 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [377696 2013-08-22] (Microsoft Corporation) R5 volsnap; C:\Windows\System32\drivers\volsnap.sys [310080 2014-06-19] (Microsoft Corporation) S5 vsmraid; C:\Windows\System32\drivers\vsmraid.sys [168800 2013-08-22] (VIA Technologies Inc.,Ltd) S5 VSTXRAID; C:\Windows\System32\drivers\vstxraid.sys [305504 2013-08-22] (VIA Corporation) R5 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [839488 2013-08-22] (Microsoft Corporation) R5 WFPLWFS; C:\Windows\System32\DRIVERS\wfplwfs.sys [136512 2014-10-29] (Microsoft Corporation) R5 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-05-06] (Microsoft Corporation) R1 wsfd_vw_1_10_0_20; C:\Windows\System32\drivers\wsfd_vw_1_10_0_20.sys [57728 2015-07-06] (WS) S3 ZeoScanner; C:\Windows\System32\DRIVERS\zeoscanner.sys [25208 2015-07-17] (Windows (R) Win 7 DDK provider) S2 APXACC; \SystemRoot\system32\DRIVERS\appexDrv.sys [X] S3 SPPD; \??\C:\WINDOWS\system32\drivers\SPPD.sys [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-08-21 16:57 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\TXQMPC 2015-08-21 16:57 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\KingSoft 2015-08-21 16:55 - 2015-08-21 16:55 - 00000000 ____D C:\ProgramData\Rising 2015-08-21 16:55 - 2015-08-21 16:55 - 00000000 ____D C:\Program Files (x86)\Rising 2015-08-21 16:54 - 2015-08-21 16:56 - 00061735 _____ C:\Users\VeraHagge\Downloads\FRST.txt 2015-08-21 16:54 - 2015-08-21 16:54 - 00000000 ____D C:\Program Files\Common Files\Tencent 2015-08-21 16:54 - 2015-08-21 16:51 - 00099640 _____ (Tencent) C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys 2015-08-21 16:53 - 2015-08-21 16:51 - 00174392 _____ (Tencent Technology(Shenzhen) Company Limited) C:\WINDOWS\system32\Drivers\TAOKernel64.sys 2015-08-21 16:52 - 2015-08-21 16:52 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件 2015-08-21 16:52 - 2015-08-21 16:51 - 00087864 _____ (电脑管家) C:\WINDOWS\system32\Drivers\TFsFltX64.sys 2015-08-21 16:51 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\Tencent 2015-08-21 16:51 - 2015-08-21 16:54 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Tencent 2015-08-21 16:51 - 2015-08-21 16:51 - 00000000 ____D C:\Program Files (x86)\Tencent 2015-08-21 16:49 - 2015-08-21 16:32 - 02173952 _____ (Farbar) C:\Users\VeraHagge\Downloads\FRST64(1).exe 2015-08-21 16:49 - 2015-08-21 16:31 - 00380416 _____ C:\Users\VeraHagge\Downloads\Gmer-19357.exe 2015-08-21 16:42 - 2015-08-21 16:54 - 00000000 ____D C:\FRST 2015-08-21 16:41 - 2015-08-21 16:41 - 00000000 _____ C:\Users\VeraHagge\defogger_reenable 2015-08-21 16:25 - 2015-08-21 16:25 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP2.job 2015-08-21 16:24 - 2015-08-21 16:53 - 00000378 _____ C:\WINDOWS\Tasks\APSnotifierPP1.job 2015-08-21 16:24 - 2015-08-21 16:25 - 00002816 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP1 2015-08-21 16:24 - 2015-08-21 16:24 - 00001068 _____ C:\Users\VeraHagge\Desktop\AnyProtect.lnk 2015-08-21 16:24 - 2015-08-21 16:24 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup 2015-08-21 16:21 - 2015-08-21 16:21 - 00613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsbBBED.tmp 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SysassistByHotWheel 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\gmsd_de_005010066 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\qycache 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Program Files (x86)\gmsd_de_005010066 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\ppsfile 2015-08-21 16:14 - 2015-08-21 16:18 - 00000000 ____D C:\IQIYI Video 2015-08-21 16:14 - 2015-08-21 16:14 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\IQIYI Video 2015-08-21 16:14 - 2015-08-21 16:14 - 00000000 ____D C:\Users\Public\QiYi 2015-08-21 16:13 - 2015-08-21 16:14 - 00000000 ____D C:\ProgramData\IQIYI Video 2015-08-21 16:12 - 2015-08-21 16:12 - 00003266 _____ C:\WINDOWS\System32\Tasks\Super Optimizer Schedule 2015-08-21 16:12 - 2015-08-21 16:12 - 00000000 ____D C:\Users\VeraHagge\Documents\Super Optimizer 2015-08-21 16:11 - 2015-08-21 16:11 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Super Optimizer 2015-08-21 16:10 - 2015-08-21 16:10 - 00000000 ____D C:\Program Files (x86)\baidu 2015-08-21 16:05 - 2015-08-21 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Optimizer 2015-08-21 16:05 - 2015-08-21 16:05 - 00001109 _____ C:\Users\VeraHagge\Desktop\Super Optimizer.lnk 2015-08-21 16:04 - 2015-08-21 16:12 - 00043664 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys 2015-08-21 16:04 - 2015-08-21 16:06 - 00000000 ____D C:\Program Files (x86)\Super Optimizer 2015-08-21 16:03 - 2015-08-21 16:03 - 00000000 ____D C:\Program Files (x86)\MiniLite 2015-08-21 16:02 - 2015-08-21 16:04 - 00000000 ____D C:\ProgramData\eWinManProe 2015-08-21 15:44 - 2015-08-21 15:44 - 00000000 ____D C:\ProgramData\{9067e982-1f12-20b7-9067-7e9821f1a608} 2015-08-21 15:30 - 2015-08-21 15:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Windesk_Winsearch 2015-08-21 15:29 - 2015-08-21 15:29 - 00001131 _____ C:\Users\Public\Desktop\WindeskWinsearch.lnk 2015-08-21 15:29 - 2015-08-21 15:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WindeskWinsearch 2015-08-21 15:29 - 2015-08-21 15:29 - 00000000 ____D C:\Program Files (x86)\WindeskWinsearch 2015-08-21 15:28 - 2015-08-21 15:28 - 00000000 ____D C:\Users\VeraHagge\Downloads\antivir 2015-08-21 15:24 - 2015-08-21 15:24 - 00000687 _____ C:\awhFF08.tmp 2015-08-21 15:11 - 2015-08-21 15:11 - 00000687 _____ C:\awh998E.tmp 2015-08-21 12:32 - 2015-08-21 12:32 - 00000687 _____ C:\awhF033.tmp 2015-08-21 12:32 - 2015-07-29 16:37 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll 2015-08-21 12:32 - 2015-07-29 16:30 - 01381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll 2015-08-21 12:32 - 2015-07-29 16:23 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll 2015-08-21 12:32 - 2015-07-29 01:24 - 00025776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2015-08-21 12:32 - 2015-07-28 16:24 - 01148416 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2015-08-21 12:32 - 2015-07-28 16:24 - 01116160 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2015-08-21 12:32 - 2015-07-28 16:24 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2015-08-21 12:32 - 2015-07-28 16:24 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2015-08-21 12:32 - 2015-07-28 16:24 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2015-08-21 12:32 - 2015-07-28 16:24 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2015-08-21 12:32 - 2015-07-24 20:57 - 04177408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2015-08-21 12:32 - 2015-07-24 20:57 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2015-08-21 12:32 - 2015-07-24 20:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2015-08-21 12:32 - 2015-07-24 19:27 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2015-08-21 12:32 - 2015-07-24 19:23 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2015-08-21 12:32 - 2015-07-16 23:14 - 25192448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2015-08-21 12:32 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2015-08-21 12:32 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec 2015-08-21 12:32 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2015-08-21 12:32 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2015-08-21 12:32 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll 2015-08-21 12:32 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2015-08-21 12:32 - 2015-07-16 22:20 - 19870208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2015-08-21 12:32 - 2015-07-16 21:53 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll 2015-08-21 12:32 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2015-08-21 12:32 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec 2015-08-21 12:32 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2015-08-21 12:32 - 2015-07-16 21:45 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2015-08-21 12:32 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll 2015-08-21 12:32 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2015-08-21 12:32 - 2015-07-16 21:38 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll 2015-08-21 12:32 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2015-08-21 12:32 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2015-08-21 12:32 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2015-08-21 12:32 - 2015-07-16 21:14 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll 2015-08-21 12:32 - 2015-07-16 21:13 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2015-08-21 12:32 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2015-08-21 12:32 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2015-08-21 12:32 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2015-08-21 12:32 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2015-08-21 12:32 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2015-08-21 12:32 - 2015-07-16 20:52 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll 2015-08-21 12:32 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2015-08-21 12:32 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2015-08-21 12:32 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2015-08-21 12:32 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2015-08-21 12:32 - 2015-07-16 02:29 - 07458648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2015-08-21 12:32 - 2015-07-16 02:29 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll 2015-08-21 12:32 - 2015-07-16 02:29 - 00101720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys 2015-08-21 12:32 - 2015-07-16 02:28 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll 2015-08-21 12:32 - 2015-07-14 23:59 - 01113944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2015-08-21 12:32 - 2015-07-14 23:59 - 00487256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll 2015-08-21 12:32 - 2015-07-14 23:59 - 00393560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll 2015-08-21 12:32 - 2015-07-14 05:22 - 02529880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll 2015-08-21 12:32 - 2015-07-14 05:21 - 01901776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll 2015-08-21 12:32 - 2015-07-13 21:46 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\csrsrv.dll 2015-08-21 12:32 - 2015-07-13 21:45 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll 2015-08-21 12:32 - 2015-07-10 20:19 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll 2015-08-21 12:32 - 2015-07-10 19:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll 2015-08-21 12:32 - 2015-07-10 19:42 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll 2015-08-21 12:32 - 2015-07-10 19:14 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll 2015-08-21 12:32 - 2015-07-10 19:13 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll 2015-08-21 12:32 - 2015-07-10 18:47 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll 2015-08-21 12:32 - 2015-07-10 18:31 - 06213120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll 2015-08-21 12:32 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe 2015-08-21 12:32 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe 2015-08-21 12:32 - 2015-07-09 18:30 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe 2015-08-21 12:32 - 2015-07-07 11:40 - 00270168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys 2015-08-21 12:32 - 2015-07-07 11:40 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys 2015-08-21 12:32 - 2015-07-07 11:40 - 00044560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys 2015-08-21 12:32 - 2015-07-02 00:19 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll 2015-08-21 12:32 - 2015-07-02 00:16 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll 2015-08-21 12:32 - 2015-07-01 23:37 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll 2015-08-21 12:32 - 2015-07-01 23:35 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll 2015-08-21 12:32 - 2015-06-12 19:03 - 18823680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll 2015-08-21 12:32 - 2015-06-12 18:36 - 15159296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll 2015-08-21 12:32 - 2015-06-11 22:12 - 02476376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2015-08-21 12:32 - 2015-06-11 22:12 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS 2015-08-21 08:43 - 2015-08-22 01:06 - 00001397 _____ C:\startup.log 2015-08-13 13:33 - 2015-08-13 13:33 - 00000687 _____ C:\awhEDA9.tmp 2015-08-13 13:29 - 2015-08-21 16:38 - 00000000 ____D C:\ProgramData\HitmanPro 2015-08-10 20:42 - 2015-08-21 15:23 - 00003320 _____ C:\WINDOWS\System32\Tasks\ASP 2015-08-10 20:42 - 2015-08-21 15:23 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\ASP 2015-08-10 20:41 - 2015-08-13 13:25 - 00000294 _____ C:\WINDOWS\Tasks\RegClean Pro_UPDATES.job 2015-08-10 20:41 - 2015-08-13 13:25 - 00000286 _____ C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job 2015-08-10 20:41 - 2015-08-10 20:41 - 00003090 _____ C:\WINDOWS\System32\Tasks\RegClean Pro 2015-08-10 20:41 - 2015-08-10 20:41 - 00003026 _____ C:\WINDOWS\System32\Tasks\RegClean Pro_UPDATES 2015-08-10 20:41 - 2015-08-10 20:41 - 00002870 _____ C:\WINDOWS\System32\Tasks\RegClean Pro_DEFAULT 2015-08-10 20:41 - 2015-08-10 20:41 - 00001004 _____ C:\Users\Public\Desktop\RegClean Pro.lnk 2015-08-10 20:41 - 2015-08-10 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro 2015-08-10 20:41 - 2015-08-10 20:41 - 00000000 ____D C:\Program Files (x86)\RCP 2015-08-10 20:41 - 2015-07-02 14:14 - 00020248 _____ () C:\WINDOWS\system32\roboot64.exe 2015-08-10 20:40 - 2015-08-10 20:40 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\systweak 2015-08-10 20:38 - 2015-08-21 15:29 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057 2015-08-10 20:38 - 2015-08-10 20:38 - 00000000 ____D C:\Program Files (x86)\gmsd_de_005010057 2015-08-10 20:35 - 2015-08-21 16:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\mystartsearch 2015-08-10 20:35 - 2015-08-10 20:36 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\cpuminer 2015-08-10 20:35 - 2015-08-10 20:35 - 00000000 ____D C:\ProgramData\5WinManPro5 2015-08-10 20:19 - 2015-08-10 20:19 - 00001030 _____ C:\Users\VeraHagge\Desktop\GUPlayer.lnk 2015-08-10 20:19 - 2015-08-10 20:19 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer 2015-08-10 20:19 - 2015-08-10 20:19 - 00000000 ____D C:\Program Files (x86)\predm 2015-08-10 20:18 - 2015-08-10 20:23 - 00001374 _____ C:\Users\VeraHagge\Desktop\Continue GamesDesktop Uninstaller.lnk 2015-08-10 20:07 - 2015-08-10 20:07 - 03531374 _____ C:\Users\VeraHagge\AppData\Local\curl.zip 2015-08-10 20:07 - 2015-08-10 20:07 - 00003836 _____ C:\WINDOWS\System32\Tasks\uBr 2015-08-10 20:07 - 2015-08-10 20:07 - 00003776 _____ C:\WINDOWS\System32\Tasks\keepup 2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\pdfie 2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\NewNotepad 2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\iuv0j 2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\cu 2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\ProgramData\Convertor 2015-08-10 19:47 - 2015-08-10 19:47 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\bvxvyxvec 2015-08-10 19:46 - 2015-08-10 19:46 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA} 2015-08-07 20:13 - 2015-08-07 20:13 - 01423136 _____ C:\WINDOWS\system32\cpuminer-gw64.exe 2015-08-07 18:57 - 2015-08-07 18:57 - 00000220 _____ C:\WINDOWS\system32\cpuminer-conf.json 2015-07-31 19:56 - 2015-07-31 19:56 - 00000000 ____D C:\Program Files (x86)\Proxy List Free Proxies for everyone 2015-07-31 19:54 - 2015-07-31 19:57 - 00000000 ____D C:\Program Files (x86)\buyfastt 2015-07-31 19:53 - 2015-08-21 13:53 - 00000382 _____ C:\WINDOWS\Tasks\WheelsMaster.job 2015-07-31 19:53 - 2015-07-31 19:53 - 00003276 _____ C:\WINDOWS\System32\Tasks\WheelsMaster 2015-07-31 19:53 - 2015-07-31 19:53 - 00000000 ____D C:\ProgramData\{ef8baf33-367f-614b-ef8b-baf33367bccc} 2015-07-31 13:39 - 2015-07-31 13:39 - 00000000 ____D C:\ProgramData\{9448b5cb-7fb0-e8b2-9448-8b5cb7fbd72d} 2015-07-31 13:35 - 2015-07-31 13:35 - 00003256 _____ C:\WINDOWS\System32\Tasks\DailyPCClean Schedule 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\Documents\DailyPCClean 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\DailyPCClean 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DailyPcClean Support 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DailyPCClean 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Program Files (x86)\DailyPcClean Support 2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Program Files (x86)\DailyPCClean 2015-07-31 13:33 - 2015-07-31 13:35 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en(2).exe 2015-07-31 13:27 - 2015-07-31 13:27 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{E6207534-D154-409E-9FA4-5A81CFBB6126} 2015-07-31 13:27 - 2015-07-31 13:27 - 00000000 ____D C:\Program Files (x86)\LibrarySystem 2015-07-30 11:19 - 2015-07-30 11:19 - 00000000 ____D C:\ProgramData\{cd6397c2-994a-f3eb-cd63-397c29945f0a} 2015-07-30 11:13 - 2015-07-30 11:14 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en(1).exe 2015-07-30 11:12 - 2015-07-30 11:12 - 00003568 _____ C:\WINDOWS\System32\Tasks\Shop-wit Updater 2015-07-30 11:12 - 2015-07-30 11:12 - 00000000 ____D C:\Program Files (x86)\shopwit 2015-07-30 04:10 - 2015-07-30 04:10 - 00350720 _____ C:\WINDOWS\SysWOW64\nethtsrv.exe 2015-07-30 04:10 - 2015-07-30 04:10 - 00190976 _____ C:\WINDOWS\SysWOW64\netupdsrv.exe 2015-07-30 04:10 - 2015-07-30 04:10 - 00140288 _____ C:\WINDOWS\SysWOW64\installd.exe 2015-07-30 04:10 - 2015-07-30 04:10 - 00046160 _____ (nethfdrv) C:\WINDOWS\system32\Drivers\nethfdrv.sys 2015-07-30 04:09 - 2015-07-30 04:09 - 00438272 _____ C:\WINDOWS\SysWOW64\hfpapi.dll 2015-07-30 04:09 - 2015-07-30 04:09 - 00108544 _____ C:\WINDOWS\SysWOW64\hfnapi.dll 2015-07-29 22:45 - 2015-07-29 22:45 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{4D1A77BC-63B0-464F-823D-97B5B2CE8CD1} 2015-07-29 13:09 - 2015-07-29 13:09 - 00000000 ____D C:\Program Files (x86)\Media Downloader 2015-07-29 13:09 - 2015-07-29 13:09 - 00000000 ____D C:\Program Files (x86)\EZ Software Updater 2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\rec_de_57 2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Program Files (x86)\rec_de_57 2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Program Files (x86)\MyBestOffersToday 2015-07-29 08:45 - 2015-07-29 08:45 - 00000000 ____D C:\ProgramData\{8a5acb8e-91ed-48f3-8a5a-acb8e91e2e3a} 2015-07-29 08:39 - 2015-07-31 13:31 - 00002134 _____ C:\Users\VeraHagge\Desktop\Continue Games Desktop.lnk 2015-07-29 08:39 - 2015-07-29 08:40 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en.exe 2015-07-29 08:37 - 2015-07-29 08:37 - 00000000 ____D C:\DesktopSearch 2015-07-29 00:10 - 2015-08-21 16:45 - 00001942 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-07-29 00:10 - 2015-08-21 16:45 - 00001942 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-07-29 00:10 - 2015-07-29 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-07-28 17:44 - 2015-07-28 17:44 - 00001608 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Erstellen Sie sich einen Wiederherstellungsdateträger.lnk 2015-07-28 17:44 - 2015-07-28 17:44 - 00001022 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Treiber und Software.lnk 2015-07-28 17:43 - 2015-07-28 17:43 - 00002090 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup.lnk 2015-07-28 17:43 - 2015-07-28 17:43 - 00000714 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\setup_gmsd_en.lnk 2015-07-28 17:42 - 2015-07-28 17:42 - 00002429 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Continue Games Desktop.lnk 2015-07-28 12:14 - 2015-08-21 15:20 - 00000394 _____ C:\WINDOWS\Tasks\LVKAHSH1.job 2015-07-28 12:14 - 2015-08-10 20:19 - 00000000 ____D C:\Program Files (x86)\GUPlayer 2015-07-28 12:14 - 2015-07-31 13:28 - 00000000 ____D C:\ProgramData\SecurityUtility 2015-07-28 12:14 - 2015-07-28 12:14 - 00002908 _____ C:\WINDOWS\System32\Tasks\LVKAHSH1 2015-07-28 12:14 - 2015-07-28 12:14 - 00000000 ____D C:\ProgramData\7b24ec7cc000461ebe26d116b88142c8 2015-07-28 12:13 - 2015-07-28 12:18 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\InetStat 2015-07-28 12:13 - 2015-07-28 12:13 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat 2015-07-28 10:26 - 2015-07-28 10:26 - 00000000 ____D C:\ProgramData\Radio 2015-07-27 22:26 - 2015-08-10 20:07 - 00003252 _____ C:\WINDOWS\System32\Tasks\DriverMgr 2015-07-27 22:26 - 2015-08-10 20:07 - 00000306 __RSH C:\ProgramData\ntuser.pol 2015-07-27 22:26 - 2015-07-31 13:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Winsta 2015-07-27 22:26 - 2015-07-27 22:26 - 00000540 _____ C:\Users\VeraHagge\AppData\Local\s6zI3.vbs 2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\WinKit 2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\jellylam 2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Convertor 2015-07-27 15:25 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll 2015-07-27 15:25 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2015-07-27 14:42 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe 2015-07-27 14:42 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe 2015-07-27 01:49 - 2015-08-21 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\speed browser 2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\speed browser 2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Users\Administrator\AppData\Local\speed browser 2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Program Files (x86)\speed browser 2015-07-27 01:46 - 2015-07-27 01:46 - 00000000 ____D C:\ProgramData\Browser 2015-07-27 01:24 - 2015-07-31 13:30 - 00004208 _____ C:\WINDOWS\System32\Tasks\ShopperPro 2015-07-27 01:24 - 2015-07-27 01:24 - 00004252 _____ C:\WINDOWS\System32\Tasks\SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 2015-07-27 01:24 - 2015-07-27 01:24 - 00003504 _____ C:\WINDOWS\System32\Tasks\SPDriver 2015-07-27 01:24 - 2015-07-27 01:24 - 00000000 ____D C:\Program Files\Common Files\ShopperPro 2015-07-27 01:23 - 2015-08-21 16:32 - 00003578 _____ C:\WINDOWS\System32\Tasks\ShopperProJSUpd 2015-07-27 01:23 - 2015-08-21 16:31 - 00000000 ____D C:\Program Files (x86)\ShopperPro 2015-07-27 01:23 - 2015-07-27 01:24 - 00000000 ____D C:\ProgramData\ShopperPro 2015-07-27 01:23 - 2015-07-27 01:23 - 00000000 ____D C:\Users\Public\Documents\ShopperPro 2015-07-27 01:16 - 2015-07-28 17:42 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DeskBar 2015-07-27 01:16 - 2015-07-27 01:16 - 00004258 _____ C:\WINDOWS\System32\Tasks\SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 2015-07-27 01:16 - 2015-07-27 01:16 - 00003864 _____ C:\WINDOWS\System32\Tasks\SMWUpd 2015-07-27 01:16 - 2015-07-27 01:16 - 00000000 ____D C:\ProgramData\SearchModule 2015-07-27 01:16 - 2015-07-27 01:16 - 00000000 ____D C:\Program Files\Common Files\Goobzo 2015-07-27 01:15 - 2015-07-27 01:15 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\CrashRpt 2015-07-26 20:57 - 2015-07-26 20:57 - 00000686 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alte Firefox-Daten.lnk 2015-07-26 19:33 - 2015-07-26 19:33 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{0E4761C0-1449-43A1-9EF0-8A28FDBCC3E2} 2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer 2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files\Reference Assemblies 2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files\MSBuild 2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files (x86)\MSBuild 2015-07-26 16:21 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll 2015-07-26 16:21 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll 2015-07-26 11:04 - 2015-08-21 16:24 - 00000000 ____D C:\Program Files (x86)\AnyProtectEx 2015-07-26 11:04 - 2015-07-26 11:04 - 00613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsl7AFB.tmp 2015-07-26 11:04 - 2015-07-26 11:04 - 00000000 __SHD C:\Users\VeraHagge\AppData\Roaming\AnyProtectEx 2015-07-26 11:03 - 2015-07-26 11:04 - 00000000 ____D C:\Program Files\shopperz22072015 2015-07-26 11:03 - 2015-07-26 11:03 - 00003652 _____ C:\WINDOWS\System32\Tasks\Papuir 2015-07-26 11:03 - 2015-07-26 11:03 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Kromtech 2015-07-26 11:03 - 2015-06-18 12:08 - 00061336 _____ (Cherimoya Ltd) C:\WINDOWS\system32\Drivers\cherimoya.sys 2015-07-26 11:02 - 2015-08-10 20:07 - 00003334 _____ C:\WINDOWS\System32\Tasks\WinKit 2015-07-26 11:02 - 2015-07-27 22:26 - 00003794 _____ C:\WINDOWS\System32\Tasks\Convertor 2015-07-26 11:02 - 2015-07-27 22:26 - 00003310 _____ C:\WINDOWS\System32\Tasks\Winsta Update 2015-07-26 11:02 - 2015-07-26 11:02 - 00000000 ____D C:\Program Files (x86)\Winsta 2015-07-26 11:01 - 2015-07-26 11:02 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DocToPDFConverter 2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\PDFConvert 2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\DocToPDFConverter 2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Program Files (x86)\Convertor 2015-07-26 10:59 - 2015-08-21 16:22 - 00003150 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6.job 2015-07-26 10:59 - 2015-08-21 15:20 - 00003150 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7.job 2015-07-26 10:59 - 2015-08-21 15:20 - 00002458 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user.job 2015-07-26 10:59 - 2015-08-21 15:20 - 00002458 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5.job 2015-07-26 10:59 - 2015-07-26 10:59 - 00006154 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7 2015-07-26 10:59 - 2015-07-26 10:59 - 00006154 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6 2015-07-26 10:59 - 2015-07-26 10:59 - 00005462 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5 2015-07-26 10:58 - 2015-08-21 16:44 - 00003454 _____ C:\WINDOWS\System32\Tasks\Oikliuhoad 2015-07-26 10:58 - 2015-08-10 20:36 - 00000000 ____D C:\Program Files (x86)\MiuiTab 2015-07-26 10:58 - 2015-07-29 00:33 - 00003272 _____ C:\WINDOWS\System32\Tasks\Optimizer Pro Schedule 2015-07-26 10:58 - 2015-07-26 10:59 - 00000000 ____D C:\Program Files (x86)\BrowserV25.07 2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\Users\VeraHagge\Documents\Optimizer Pro 2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Optimizer Pro 2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\WindowsMangerProtect 2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\IHProtectUpDate 2015-07-26 10:57 - 2015-07-29 16:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DesktopSearch 2015-07-26 10:57 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\Oikliuhoad 2015-07-26 10:57 - 2015-07-26 10:57 - 00000000 _____ C:\WINDOWS\prleth.sys 2015-07-26 10:57 - 2015-07-26 10:57 - 00000000 _____ C:\WINDOWS\hgfs.sys 2015-07-26 10:56 - 2015-08-21 16:56 - 00001084 _____ C:\WINDOWS\Tasks\Crossbrowse.job 2015-07-26 10:56 - 2015-08-10 20:36 - 00000000 ____D C:\Program Files (x86)\FriendlyError 2015-07-26 10:56 - 2015-07-26 10:56 - 00004094 _____ C:\WINDOWS\System32\Tasks\Crossbrowse 2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\istartsurf 2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Crossbrowse 2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse 2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Program Files (x86)\Crossbrowse 2015-07-26 10:55 - 2015-07-28 10:41 - 00000000 ____D C:\ProgramData\MailUpdate 2015-07-26 10:55 - 2015-07-26 10:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SmartWeb 2015-07-26 10:55 - 2015-07-26 10:55 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\MailUpdate 2015-07-26 10:54 - 2015-07-26 10:54 - 00000000 ____D C:\Program Files (x86)\wincheck 2015-07-26 10:53 - 2015-08-21 16:45 - 00001948 _____ C:\Users\VeraHagge\Desktop\Iexplore .lnk 2015-07-26 10:53 - 2015-08-21 16:45 - 00001948 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iexplore .lnk 2015-07-26 10:53 - 2015-08-21 16:45 - 00001942 _____ C:\Users\VeraHagge\AppData\Local\Firefox .lnk 2015-07-26 10:53 - 2015-08-21 16:45 - 00001936 _____ C:\Users\VeraHagge\AppData\Local\Iexplore .lnk 2015-07-26 10:53 - 2015-07-26 10:53 - 00000298 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome .lnk 2015-07-26 10:53 - 2015-07-26 10:53 - 00000298 _____ C:\Users\VeraHagge\AppData\Local\Chrome .lnk 2015-07-26 10:53 - 2015-07-26 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2 2015-07-26 10:52 - 2015-08-21 15:44 - 00003262 _____ C:\WINDOWS\System32\Tasks\Optscan 2015-07-26 10:52 - 2015-08-21 15:44 - 00000368 _____ C:\WINDOWS\Tasks\Optscan.job 2015-07-26 10:52 - 2015-07-26 10:53 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro 3.99 2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\ProgramData\{76f270a0-8ddb-0972-76f2-270a08ddc282} 2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\Program Files (x86)\youtubeadblocker 2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\Program Files (x86)\Tweet Button for Chrome by Shareaho 2015-07-26 10:51 - 2015-07-31 19:56 - 00000000 ____D C:\ProgramData\6632678238890282139 2015-07-26 10:51 - 2015-07-26 10:53 - 00000000 ____D C:\ProgramData\rKRjrFKiDD 2015-07-26 10:51 - 2015-07-26 10:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desktop Search 2015-07-26 10:50 - 2015-07-26 10:51 - 00000000 ____D C:\Program Files (x86)\PPriiCeLeess 2015-07-26 10:49 - 2015-08-21 16:49 - 00000390 _____ C:\WINDOWS\Tasks\IntelliText.job 2015-07-26 10:49 - 2015-07-26 10:49 - 00003284 _____ C:\WINDOWS\System32\Tasks\IntelliText 2015-07-26 10:49 - 2015-07-26 10:49 - 00000000 ____D C:\ProgramData\{36543f71-a4eb-bdfc-3654-43f71a4efdc6} 2015-07-26 10:45 - 2015-08-21 16:45 - 00002486 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user.job 2015-07-26 10:45 - 2015-08-21 16:45 - 00002486 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5.job 2015-07-26 10:45 - 2015-07-26 10:45 - 00005490 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5 2015-07-26 10:44 - 2015-08-21 16:44 - 00004534 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-4.job 2015-07-26 10:44 - 2015-08-21 16:44 - 00003514 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7.job 2015-07-26 10:44 - 2015-08-21 16:44 - 00003178 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6.job 2015-07-26 10:44 - 2015-08-21 16:44 - 00002152 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user.job 2015-07-26 10:44 - 2015-07-31 19:52 - 00000000 ____D C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009 2015-07-26 10:44 - 2015-07-31 13:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\03D40274-1437907493-057A-7206-A20700080009 2015-07-26 10:44 - 2015-07-26 10:45 - 00000000 ____D C:\Program Files (x86)\Lights Cinema 1.3betaV14.07 2015-07-26 10:44 - 2015-07-26 10:44 - 00007538 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-4 2015-07-26 10:44 - 2015-07-26 10:44 - 00006518 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7 2015-07-26 10:44 - 2015-07-26 10:44 - 00006182 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6 2015-07-26 10:44 - 2015-07-26 10:44 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage 2015-07-26 10:44 - 2013-08-22 15:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-07-26 10:42 - 2015-08-10 19:47 - 00000000 ____D C:\Program Files (x86)\SearchProtect 2015-07-26 10:42 - 2015-07-26 10:43 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SearchProtect 2015-07-26 10:40 - 2015-07-29 13:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Downloader 2015-07-26 10:40 - 2015-07-26 10:40 - 00010910 _____ C:\WINDOWS\System32\Tasks\DNSPALENVILLE PostInstall 2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL932.tmp 2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL8F3.tmp 2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL886.tmp 2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL857.tmp 2015-07-26 10:39 - 2015-07-26 10:41 - 00000000 ____D C:\6a08e3df-832b-4f9a-b9f5-18b3ace52db9 2015-07-26 10:38 - 2015-07-26 10:38 - 00296448 _____ C:\Users\VeraHagge\Downloads\Setup.exe 2015-07-26 10:34 - 2015-07-29 00:33 - 00003268 _____ C:\WINDOWS\System32\Tasks\OneSafe PC Cleaner Schedule 2015-07-26 10:34 - 2015-07-26 10:48 - 00000000 ____D C:\Users\VeraHagge\Documents\OneSafe PC Cleaner 2015-07-26 10:33 - 2015-07-26 10:34 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\OneSafe PC Cleaner 2015-07-26 10:33 - 2015-07-26 10:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneSafe PC Cleaner 2015-07-26 10:33 - 2015-07-26 10:33 - 00000000 ____D C:\Program Files (x86)\OneSafe PC Cleaner 2015-07-23 07:53 - 2015-07-23 07:53 - 00003668 _____ C:\WINDOWS\System32\Tasks\PCKeeper-Aktualisierungsprogramm 2015-07-23 07:52 - 2015-07-23 07:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kromtech 2015-07-23 07:50 - 2015-07-23 07:53 - 00000000 ____D C:\Program Files\Kromtech 2015-07-23 07:49 - 2015-07-27 15:28 - 00000000 ____D C:\ProgramData\Kromtech 2015-07-23 07:43 - 2015-07-23 07:43 - 00006235 _____ C:\WINDOWS\system32\ScanResults.xml 2015-07-23 07:40 - 2015-07-23 07:40 - 00000464 _____ C:\WINDOWS\system32\ScannerSettings 2015-07-23 07:33 - 2015-08-10 20:31 - 00000000 ____D C:\Program Files\WinZip Driver Updater 2015-07-23 07:26 - 2015-07-23 07:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{96911369-42B5-4B2D-982D-9809511A53A6} 2015-07-22 22:48 - 2015-07-22 22:48 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-08-21 16:57 - 2015-07-12 01:57 - 00003138 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.job 2015-08-21 16:54 - 2015-06-08 01:14 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\VirtualStore 2015-08-21 16:53 - 2015-06-18 12:16 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\CrashDumps 2015-08-21 16:49 - 2015-06-08 01:24 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-1002 2015-08-21 16:45 - 2015-06-08 01:14 - 00002066 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-08-21 16:45 - 2014-09-10 10:51 - 00002066 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-08-21 16:41 - 2015-06-08 01:12 - 00000000 ____D C:\Users\VeraHagge 2015-08-21 16:22 - 2014-03-18 11:47 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-08-21 16:22 - 2014-03-18 11:30 - 00764340 _____ C:\WINDOWS\system32\perfh007.dat 2015-08-21 16:22 - 2014-03-18 11:30 - 00159160 _____ C:\WINDOWS\system32\perfc007.dat 2015-08-21 16:18 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru 2015-08-21 16:08 - 2015-07-12 02:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-08-21 15:40 - 2015-06-08 01:12 - 01603754 _____ C:\WINDOWS\WindowsUpdate.log 2015-08-21 15:30 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp 2015-08-21 15:21 - 2015-07-12 01:51 - 00000382 _____ C:\WINDOWS\Tasks\AmiUpdXp.job 2015-08-21 15:20 - 2015-07-12 01:57 - 00004840 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.job 2015-08-21 15:20 - 2015-07-12 01:57 - 00004494 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.job 2015-08-21 15:20 - 2015-07-12 01:57 - 00003138 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.job 2015-08-21 15:20 - 2015-07-12 01:57 - 00002446 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user.job 2015-08-21 15:20 - 2015-07-12 01:57 - 00002446 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.job 2015-08-21 15:20 - 2015-07-12 01:55 - 00000974 _____ C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job 2015-08-21 15:20 - 2015-07-12 01:55 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-08-21 15:19 - 2013-08-22 16:46 - 00031880 _____ C:\WINDOWS\setupact.log 2015-08-21 15:19 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-08-21 15:19 - 2013-08-22 16:44 - 00338016 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-08-21 15:18 - 2014-09-10 11:02 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin 2015-08-21 15:17 - 2015-06-12 13:34 - 00000000 ___SD C:\WINDOWS\system32\CompatTel 2015-08-21 15:17 - 2015-06-12 13:34 - 00000000 ____D C:\WINDOWS\system32\appraiser 2015-08-21 15:17 - 2015-06-11 15:18 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Defender 2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2015-08-21 15:16 - 2014-09-10 10:46 - 00000000 ____D C:\Users\Administrator 2015-08-21 15:11 - 2015-06-11 15:18 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2015-08-21 14:05 - 2015-07-17 21:06 - 09284296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe 2015-08-21 14:05 - 2015-07-12 02:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater 2015-08-21 13:53 - 2015-07-12 01:53 - 00000368 _____ C:\WINDOWS\Tasks\Superclean.job 2015-08-21 12:32 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-08-13 13:25 - 2014-03-18 03:38 - 00749070 _____ C:\WINDOWS\PFRO.log 2015-08-10 20:07 - 2015-07-07 09:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-08-10 19:52 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-08-08 15:55 - 2013-08-22 17:38 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2015-08-08 15:55 - 2013-08-22 17:38 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2015-07-31 13:28 - 2015-07-12 02:12 - 00000000 ____D C:\ProgramData\4adc7a4f00005e5d 2015-07-30 11:04 - 2015-07-12 01:55 - 00000978 _____ C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job 2015-07-27 22:26 - 2013-08-22 17:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy 2015-07-27 22:26 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy 2015-07-26 19:33 - 2015-07-12 01:45 - 00003994 _____ C:\WINDOWS\System32\Tasks\LaunchPreSignup 2015-07-26 19:33 - 2015-07-12 01:45 - 00000000 ____D C:\Program Files (x86)\OLBPre 2015-07-26 16:25 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI 2015-07-26 16:25 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\MUI 2015-07-26 10:59 - 2015-07-12 01:55 - 00003950 _____ C:\WINDOWS\System32\Tasks\globalUpdateUpdateTaskMachineUA 2015-07-26 10:59 - 2015-07-12 01:55 - 00003714 _____ C:\WINDOWS\System32\Tasks\globalUpdateUpdateTaskMachineCore 2015-07-26 10:59 - 2015-07-12 01:55 - 00000000 ____D C:\Program Files (x86)\globalUpdate 2015-07-26 10:55 - 2015-06-22 09:02 - 00000000 ____D C:\Program Files (x86)\Boost 2015-07-26 10:54 - 2015-06-08 01:12 - 00000549 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2015-07-26 10:53 - 2015-06-08 01:12 - 00000551 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2015-07-26 10:53 - 2015-06-06 18:53 - 00002499 _____ C:\Users\Public\Desktop\SlimCleaner Plus.lnk 2015-07-26 10:53 - 2015-06-06 18:51 - 00002519 _____ C:\Users\Public\Desktop\DriverUpdate.lnk 2015-07-26 10:53 - 2014-09-10 20:43 - 00001338 _____ C:\Users\Default\Desktop\Erstellen Sie sich einen Wiederherstellungsdateträger.lnk 2015-07-26 10:53 - 2014-09-10 20:43 - 00001338 _____ C:\Users\Default User\Desktop\Erstellen Sie sich einen Wiederherstellungsdateträger.lnk 2015-07-26 10:53 - 2014-09-10 20:43 - 00000848 _____ C:\Users\Default\Desktop\Treiber und Software.lnk 2015-07-26 10:53 - 2014-09-10 20:43 - 00000848 _____ C:\Users\Default User\Desktop\Treiber und Software.lnk 2015-07-26 10:53 - 2014-09-10 10:46 - 00001338 _____ C:\Users\Administrator\Desktop\Erstellen Sie sich einen Wiederherstellungsdateträger.lnk 2015-07-26 10:53 - 2014-09-10 10:46 - 00000848 _____ C:\Users\Administrator\Desktop\Treiber und Software.lnk 2015-07-26 10:53 - 2014-09-10 10:46 - 00000551 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2015-07-26 10:53 - 2014-09-10 10:46 - 00000549 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2015-07-26 10:53 - 2014-03-18 11:48 - 00000551 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2015-07-26 10:53 - 2014-03-18 11:48 - 00000551 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2015-07-26 10:53 - 2014-03-18 11:48 - 00000549 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2015-07-26 10:53 - 2014-03-18 11:48 - 00000549 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2015-07-26 03:52 - 2015-07-08 18:29 - 00000000 ____D C:\ProgramData\f43a0a22-b5b9-43e4-9c6f-705bf4e40c7b 2015-07-25 18:34 - 2015-07-20 17:27 - 00000165 _____ C:\WINDOWS\Reimage.ini 2015-07-25 18:26 - 2015-06-11 15:04 - 00000000 ___SD C:\WINDOWS\system32\GWX 2015-07-24 22:04 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF 2015-07-24 21:39 - 2015-07-20 17:31 - 00003452 _____ C:\WINDOWS\System32\Tasks\Reimage Reminder 2015-07-24 21:39 - 2015-06-06 18:59 - 00000000 ____D C:\rei 2015-07-23 07:53 - 2015-07-12 01:53 - 00000000 ____D C:\ProgramData\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f} ==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse ======= 2015-07-26 10:53 - 2015-07-26 10:53 - 0000298 _____ () C:\Users\VeraHagge\AppData\Local\Chrome .lnk 2015-08-10 20:07 - 2015-08-10 20:07 - 3531374 _____ () C:\Users\VeraHagge\AppData\Local\curl.zip 2015-07-26 10:53 - 2015-08-21 16:45 - 0001942 _____ () C:\Users\VeraHagge\AppData\Local\Firefox .lnk 2015-07-26 10:53 - 2015-08-21 16:45 - 0001936 _____ () C:\Users\VeraHagge\AppData\Local\Iexplore .lnk 2015-08-21 16:21 - 2015-08-21 16:21 - 0613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsbBBED.tmp 2015-07-26 11:04 - 2015-07-26 11:04 - 0613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsl7AFB.tmp 2015-07-27 22:26 - 2015-07-27 22:26 - 0000540 _____ () C:\Users\VeraHagge\AppData\Local\s6zI3.vbs Einige Dateien in TEMP: ==================== C:\Users\VeraHagge\AppData\Local\Temp\13895.exe C:\Users\VeraHagge\AppData\Local\Temp\2300.exe C:\Users\VeraHagge\AppData\Local\Temp\3276.exe C:\Users\VeraHagge\AppData\Local\Temp\6068.exe C:\Users\VeraHagge\AppData\Local\Temp\aff_setup0.exe C:\Users\VeraHagge\AppData\Local\Temp\bitool.dll C:\Users\VeraHagge\AppData\Local\Temp\install1215124.exe C:\Users\VeraHagge\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe C:\Users\VeraHagge\AppData\Local\Temp\jre-8u51-windows-au.exe C:\Users\VeraHagge\AppData\Local\Temp\of3w22233.exe C:\Users\VeraHagge\AppData\Local\Temp\of3w36381.exe C:\Users\VeraHagge\AppData\Local\Temp\of3w55934.exe C:\Users\VeraHagge\AppData\Local\Temp\of3w77613.exe C:\Users\VeraHagge\AppData\Local\Temp\of3w91274.exe C:\Users\VeraHagge\AppData\Local\Temp\optprosetup.exe C:\Users\VeraHagge\AppData\Local\Temp\qqpcmgr_v10.7.16065.215_71643_Silence.exe C:\Users\VeraHagge\AppData\Local\Temp\ReimagePackage.exe C:\Users\VeraHagge\AppData\Local\Temp\Setup.exe C:\Users\VeraHagge\AppData\Local\Temp\setup3.exe C:\Users\VeraHagge\AppData\Local\Temp\ShopperProDBUPD.exe C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe C:\Users\VeraHagge\AppData\Local\Temp\shpwt.exe C:\Users\VeraHagge\AppData\Local\Temp\sqlite3.exe C:\Users\VeraHagge\AppData\Local\Temp\supoptsetup.exe C:\Users\VeraHagge\AppData\Local\Temp\Uninstall.exe C:\Users\VeraHagge\AppData\Local\Temp\z1upd43311.exe C:\Users\VeraHagge\AppData\Local\Temp\z1upd59047.exe C:\Users\VeraHagge\AppData\Local\Temp\zxupd71311.exe ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2015-07-20 21:09 ==================== Ende von Ergebnis ============================ |
22.08.2015, 09:30 | #4 |
| Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet "IMHO" Ehrlicherweise finde ich den Scan und das Ergebnis von Hitman aussagekräftiger und umfassender. Oder? Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:21-08-2015 durchgeführt von VeraHagge (2015-08-21 16:59:21) Gestartet von C:\Users\VeraHagge\Downloads Start-Modus: Normal ========================================================== ==================== Konten: ============================= Administrator (S-1-5-21-3742509177-3204372618-1584296459-500 - Administrator - Disabled) => C:\Users\Administrator Gast (S-1-5-21-3742509177-3204372618-1584296459-501 - Limited - Disabled) VeraHagge (S-1-5-21-3742509177-3204372618-1584296459-1002 - Administrator - Enabled) => C:\Users\VeraHagge ==================== Sicherheits-Center ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.) AV: 电脑管家系统防护 (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5} AV: PCKeeper Antivirus (Disabled - Out of date) {021CBDD8-61D6-36AB-A5D7-3970E8936E82} AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: 电脑管家系统防护 (Enabled - Up to date) {D4FDDE76-901F-01C9-CA01-7F04796B2F48} ==================== Installierte Programme ====================== (Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.) AccountService (Version: 1.1.66 - Kromtech) Hidden <==== ACHTUNG Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated) AMD Catalyst Install Manager (HKLM\...\{1113B31C-097E-644C-7242-829DFC0CED38}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.4 - CMI Limited) <==== ACHTUNG AnySend (HKLM-x32\...\ASPackage) (Version: - CMI Limited) <==== ACHTUNG Boost (HKLM-x32\...\Boost) (Version: 3.0.1.6 - Boost Shopping) BrowserV25.07 (HKLM-x32\...\BrowserV25.07) (Version: 1.36.01.22 - BrowserV25.07) <==== ACHTUNG buyfastt (HKLM-x32\...\{78B72F2B-0468-A7AC-ECEE-02C79EC3EF0B}) (Version: - ) <==== ACHTUNG Buzzdock (HKLM-x32\...\{cfd32d46-7d3f-483f-bace-7172aec5592d}) (Version: - Alactro LLC) <==== ACHTUNG CPU Miner (HKLM\...\cpuminer) (Version: 1.2 - Open Source) Crossbrowse (HKLM-x32\...\Crossbrowse) (Version: 39.6.2171.95 - The Crossbrowse Authors) <==== ACHTUNG CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4427.02 - CyberLink Corp.) DailyPcClean Support (HKLM-x32\...\dpcc_en_002040044_is1) (Version: - Tuto4PC.Com) <==== ACHTUNG DailyPCClean v4.1 (HKLM-x32\...\DailyPCClean_is1) (Version: 4.1 - Tuto4PC.Com) <==== ACHTUNG DesktopSearch (HKLM-x32\...\DesktopSearch) (Version: 3.0.74 - Unique Solutions) DNS Unlocker version 1.3 (HKLM-x32\...\{E1527582-8509-4011-B922-29E3FB548882}_is1) (Version: 1.3 - www.vidcreek.tv) <==== ACHTUNG DocToPDFConverter (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\DocToPDFConverter) (Version: 01.00.00.00 - VolatoTech) EZ Software Updater version 1.2.0.4 (HKLM-x32\...\EZ Software Updater_is1) (Version: 1.2.0.4 - www.ezupdater.com) FastSearch (HKLM-x32\...\FastSearch) (Version: 3.0.0.8 - FastSearch) Friendly Error (HKLM-x32\...\FriendlyError) (Version: - ) GamesDesktop 014.005010057 (HKLM-x32\...\gmsd_de_005010057_is1) (Version: - GAMESDESKTOP) <==== ACHTUNG GamesDesktop 014.005010066 (HKLM-x32\...\gmsd_de_005010066_is1) (Version: - GAMESDESKTOP) <==== ACHTUNG globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ACHTUNG GUPlayer (remove only) (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\GUPlayer) (Version: - ) <==== ACHTUNG HD4Good (HKLM-x32\...\HD4Good) (Version: 1.36.01.22 - Buca Apps) Iminent (HKLM-x32\...\IMBoosterARP) (Version: 7.48.4.1 - Iminent) <==== ACHTUNG IminentToolbar (HKLM-x32\...\IminentToolbar) (Version: 7.48.4.1 - Iminent) <==== ACHTUNG InetStat (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\InetStat) (Version: 0.5b - InetStat) <==== ACHTUNG istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version: - istartsurf) <==== ACHTUNG Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation) LibrarySystem (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{88c3b28}) (Version: - Software Publisher) <==== ACHTUNG Lights Cinema 1.3betaV14.07 (HKLM-x32\...\Lights Cinema 1.3betaV14.07) (Version: 1.36.01.22 - Cinema PlusV14.07) <==== ACHTUNG Media Downloader version 1.5 (HKLM-x32\...\Media Downloader_is1) (Version: 1.5 - Media Downloader) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation) Mozilla Firefox 27.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0 (x86 en-US)) (Version: 27.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0 - Mozilla) MyBestOffersToday 014.57 (HKLM-x32\...\rec_de_57_is1) (Version: - MYBESTOFFERSTODAY) <==== ACHTUNG MyPC Backup (HKLM\...\OLBPre) (Version: - MyPC Backup) <==== ACHTUNG mystartsearch uninstall (HKLM-x32\...\mystartsearch uninstall) (Version: - mystartsearch) <==== ACHTUNG OffersWizard (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\OffersWizard) (Version: - ) OffersWizard Network System Driver (HKLM-x32\...\inethnfd) (Version: 1.0.0.3001 - ) <==== ACHTUNG OneSafe PC Cleaner v4 (HKLM-x32\...\OneSafe PC Cleaner_is1) (Version: 4.0 - ) Optimizer Pro v3.2 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.3.1.7 - PCUtilities Software Limited) <==== ACHTUNG PCKeeper (HKLM-x32\...\{E44BBEE3-3F83-4670-9E2E-EE0556442287}) (Version: 2.2.1370 - Kromtech) <==== ACHTUNG PCKeeper (Version: 2.2.1370 - Kromtech) Hidden <==== ACHTUNG PCKeeper Antivirus (HKLM-x32\...\{E7E7B26A-88AA-48B0-A47C-173C062FD904}) (Version: 1.1.85 - Kromtech) <==== ACHTUNG PCKeeper Antivirus (Version: 1.1.85 - Kromtech) Hidden <==== ACHTUNG PCKLang.de (Version: 1.0.0 - Kromtech) Hidden <==== ACHTUNG PPriiCeLeess (HKLM-x32\...\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}) (Version: - ) <==== ACHTUNG PremierOpinion (HKLM-x32\...\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}) (Version: 1.3.337.346 - VoiceFive, Inc.) <==== ACHTUNG Proxy List Free Proxies for everyone (HKLM-x32\...\{26453017-2C54-574B-7597-9EA6652686A6}) (Version: - ) <==== ACHTUNG Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.34.617.2014 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.) RegClean-Pro (HKLM-x32\...\RegClean-Pro_is1) (Version: 6.21 - systweak.com) <==== ACHTUNG Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.1.9 - Reimage) <==== ACHTUNG Sale Clipper (HKLM-x32\...\Sale Clipper) (Version: 2.0.5667.8733 - Sale Clipper) <==== ACHTUNG Search module (HKLM-x32\...\Search module) (Version: - Goobzo) Search Protect (HKLM-x32\...\SearchProtect) (Version: 3.0.3.67 - Client Connect LTD) <==== ACHTUNG SecurityUtility (HKLM-x32\...\SecurityUtility) (Version: - ) <==== ACHTUNG Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version: - ) Shopper-Pro (HKLM-x32\...\ShopperPro) (Version: - ) <==== ACHTUNG shopperz22072015 2.0.0.471 (HKLM\...\{318d2d55-9ce3-446e-8640-a43be68a550f}_is1) (Version: 2.0.0.471 - shopperz) <==== ACHTUNG Shop-wit (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\shopwit) (Version: - shopwit) <==== ACHTUNG SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ACHTUNG Software Version Updater (HKLM-x32\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.4.2 - ) <==== ACHTUNG speed browser (HKLM-x32\...\speed browser) (Version: 44.0.2367.0 - Smart Applications) <==== ACHTUNG Super Optimizer v3.2 (HKLM-x32\...\Super Optimizer_is1) (Version: 3.2.0.1 - Super PC Tools ltd) <==== ACHTUNG Support PL 1.1 (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{57e40902}) (Version: - riceLes) <==== ACHTUNG Tweet Button for Chrome by Shareaho (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) <==== ACHTUNG WindeskWinsearch 1.0 (HKLM-x32\...\WindeskWinsearch) (Version: 1.0 - PCSoftware) <==== ACHTUNG WordShark 1.10.0.20 (HKLM-x32\...\WordShark_1.10.0.20) (Version: 1.10.0.20 - WordShark) <==== ACHTUNG Yahoo Search Set (HKLM-x32\...\Yahoo! SearchSet) (Version: - Yahoo Inc.) youtubeadblocker (HKLM-x32\...\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version: - ) <==== ACHTUNG 爱奇艺影音 (HKLM-x32\...\IQIYI Video) (Version: - 爱奇艺) ==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Wiederherstellungspunkte ========================= 12-07-2015 13:31:33 Uniblue PC Mechanic installation 16-07-2015 23:59:30 Windows Update 17-07-2015 08:03:58 Wiederherstellungsvorgang 20-07-2015 14:57:27 Smileys We Love Toolbar for IE wird entfernt 23-07-2015 07:42:43 WinZip Driver Updater (23/07/2015 07:42) 26-07-2015 10:28:36 windows 8 26-07-2015 16:16:15 Windows Modules Installer 21-08-2015 15:09:25 Windows Update ==================== Hosts Inhalt: =============================== (Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.) 2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) ============= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) Task: {023008A5-CEE0-4D4E-8B0A-D064DB82BDE1} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe [2015-07-23] () <==== ACHTUNG Task: {090697A2-DD60-4F36-8DE1-66FCB81B5D3F} - System32\Tasks\Winsta Update => C:\Users\VeraHagge\AppData\Roaming\Winsta\Winsta.exe [2015-01-29] () Task: {0BA5144B-6C4D-43EA-A2BB-6A4FE3A1A184} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe [2015-07-12] (Buca Apps) <==== ACHTUNG Task: {10FC111E-2E33-4D4A-9E8D-82E701D6779E} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe [2015-07-12] (Buca Apps) <==== ACHTUNG Task: {147AF33D-35E7-4F97-B141-469BF6AC8A19} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.exe [2015-07-12] (Buca Apps) <==== ACHTUNG Task: {15C0F3B4-CFA5-473C-8874-11BE75CA1419} - System32\Tasks\Oikliuhoad => C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe [2015-07-26] () Task: {1C14D75C-A75F-4E44-8DD7-879DEF90D2F3} - System32\Tasks\ShopperPro => C:\Program Files (x86)\ShopperPro\ShopperPro.exe [2015-08-20] (Goobzo LTD) <==== ACHTUNG Task: {2059AF37-3684-475F-83F9-3C8A3F794D2E} - System32\Tasks\SPDriver => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [2015-07-26] () <==== ACHTUNG Task: {28B85FDA-77F3-4D8F-B57E-4C4DBF95EC53} - System32\Tasks\SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 <==== ACHTUNG Task: {2CEE3A3E-B0F0-4C04-BC32-A83662A853E2} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG Task: {336375A5-4B53-4956-B147-CCF175DBF4E7} - System32\Tasks\AmiUpdXp => C:\Users\VeraHagge\AppData\Local\29908\Updater.exe [2015-07-12] () <==== ACHTUNG Task: {38307FF6-E63E-4462-9ADB-866679486EF8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-08-21] (Microsoft Corporation) Task: {392F15F1-6932-405D-9C62-8A4BC38C5345} - System32\Tasks\OneSafe PC Cleaner Schedule => C:\Program Files (x86)\OneSafe PC Cleaner\OSPCSchedule.exe [2015-07-24] (Avanquest Software) Task: {3D0E5EA7-9953-43BD-ABD8-6F9FDBD1CB65} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG Task: {44D3F9C0-D248-4295-B8FA-30E5618ED0B7} - System32\Tasks\Superclean => c:\programdata\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}\hqghumeaylnlf.exe [2014-07-12] (Super PC Tools Ltd) <==== ACHTUNG Task: {460D18FD-BF7E-44E9-BBD2-DEE7134E2A75} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ACHTUNG Task: {472FE64C-FBD4-4F11-B550-EFBF7C0907A1} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG Task: {47EB4A3A-920A-41A6-8563-18477A65BB97} - System32\Tasks\Optscan => c:\programdata\{9067e982-1f12-20b7-9067-7e9821f1a608}\hqghumeaylnlf.exe [2014-08-21] (PC Utilities Software Limited) <==== ACHTUNG Task: {4A038234-004A-4A05-9F3E-2AA83093DF67} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-08-21] (AnyProtect.com) <==== ACHTUNG Task: {501C1A81-04D2-40CD-9DCF-2175E0952EF9} - System32\Tasks\Convertor => C:\Users\VeraHagge\AppData\Roaming\Convertor\Convertor.exe [2015-01-29] () Task: {5435653C-33AB-4EC3-B013-5153B0866C10} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-6.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG Task: {55957403-B8E3-4BCD-A77D-6A23D3FF521C} - System32\Tasks\LVKAHSH1 => C:\ProgramData\SecurityUtility\SecurityUtility.exe [2015-05-26] (SecurityUtility) <==== ACHTUNG Task: {55B34A96-F696-4894-B046-5C00C63FDD06} - System32\Tasks\DNSPALENVILLE PostInstall => dnspalenville.exe Task: {58C8A81C-81E6-4401-B3A6-28470C72D99F} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-21] (Adobe Systems Incorporated) Task: {5947C620-3C56-4A6D-BC84-76959B9BCC2C} - System32\Tasks\PCKeeper-Aktualisierungsprogramm => C:\ProgramData\Kromtech\installer.exe <==== ACHTUNG Task: {642CB0E0-FE7E-4295-8A7B-6E37E9CF8F6B} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2015-05-19] (Reimage®) <==== ACHTUNG Task: {648C86F9-48EA-4868-AEAB-7A289E6D789B} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG Task: {654A74CB-F098-4E45-8B15-30767C639BC1} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe <==== ACHTUNG Task: {66A8DBC8-F7AE-430B-8E4B-8D21A6FDB52F} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [2015-07-26] (globalUpdate) <==== ACHTUNG Task: {6B4B9EF0-07F8-4990-B2BA-75D0BCAA7DF3} - System32\Tasks\WinZipDriverUpdater_UPDATES => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe Task: {6D2AB3F8-C3CD-4A08-B6EC-2E16A6236E0B} - System32\Tasks\Papuir => C:\Program Files\shopperz22072015\Asyofakaz.bat [2015-07-22] () <==== ACHTUNG Task: {6D68BC42-698E-4D67-A1FE-3FAE10042ECB} - System32\Tasks\WheelsMaster => c:\programdata\{ef8baf33-367f-614b-ef8b-baf33367bccc}\5951259966257080345e.exe [2014-07-31] () <==== ACHTUNG Task: {703ECDFE-6066-4290-BADF-B8F896DAD91C} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe [2015-07-12] (Buca Apps) <==== ACHTUNG Task: {71DA6959-D9A4-42BB-85AB-D763441706BD} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-7.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG Task: {747F57D3-AA28-4733-8987-90EF1B02ACA8} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe [2015-07-26] (Goobzo) <==== ACHTUNG Task: {789F433C-C81C-48AC-AAF7-01A9C68020D3} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe [2015-07-23] () <==== ACHTUNG Task: {85FDE24F-97A9-401D-83ED-1F2E19031A6B} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [2015-07-26] (globalUpdate) <==== ACHTUNG Task: {9089A441-7567-40E1-BEDB-7C38411E3062} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG Task: {9454C744-54FC-4409-AF8C-14C0BA0F17CE} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG Task: {9725831F-0D22-460F-918C-136C9D96C495} - System32\Tasks\ShopperProJSUpd => C:\Program Files (x86)\ShopperPro\updater.exe [2015-08-20] (Goobzo) <==== ACHTUNG Task: {9CC35DDB-1A35-45A0-B423-C29C7359C2D3} - System32\Tasks\SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ACHTUNG Task: {A2067C6F-5725-4BF3-A42C-BF9334D54568} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe [2015-07-12] (Reimage ltd.) <==== ACHTUNG Task: {A2CAB576-0E92-4F10-9F10-5998A157C3F8} - System32\Tasks\DriverMgr => C:\Users\VeraHagge\AppData\Roaming\iuv0j\rinti.exe [2015-08-05] () Task: {AA33371F-9415-4DD0-8A72-759376E7506F} - System32\Tasks\keepup => C:\Users\VeraHagge\AppData\Roaming\iuv0j\rinti.exe [2015-08-05] () Task: {B4F89F73-7808-4AB3-A53E-8B66164A980D} - System32\Tasks\Shop-wit Updater => Wscript.exe //B "C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\..\updt.js" <==== ACHTUNG Task: {B6EC764F-CCD8-4C59-A0FA-7A5AC1A8832F} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Core => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe <==== ACHTUNG Task: {BAF7F5A8-C3E4-45B0-963D-813B179D1494} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.exe [2015-07-12] (Buca Apps) <==== ACHTUNG Task: {BDF0898D-DC41-4E5B-A416-1237C435F3E8} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG Task: {C753085F-E567-4BF2-86A3-695D873DE2C5} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG Task: {C876BA3C-170A-46BF-B63F-3E954378227B} - System32\Tasks\Super Optimizer Schedule => C:\Program Files (x86)\Super Optimizer\SupOptLauncher.exe [2015-07-31] () <==== ACHTUNG Task: {CA32D1AC-0C7B-49D8-B96C-27B4C165D77E} - System32\Tasks\WinKit => C:\Users\VeraHagge\AppData\Roaming\NewNotepad\GUP.exe [2015-08-05] (Don HO don.h@free.fr) Task: {CB337DD0-9AB2-4A32-90DE-E3CCCBC83029} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser Task: {CDB98180-20BE-48C5-AEED-0AC3A0F61AB3} - System32\Tasks\IntelliText => c:\programdata\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}\priceless_p_soft_partner.exe [2014-07-26] () <==== ACHTUNG Task: {CF94A10F-B565-4070-A486-1DCD4EC4F500} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-7.exe <==== ACHTUNG Task: {D487C202-2A15-4BE6-B82C-BC371E9DEAF8} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG Task: {D54D0452-6F9A-4AAA-80E1-095F0BC2A5E0} - System32\Tasks\ASP => C:\Program Files (x86)\RCP\systweakasp.exe [2015-02-19] (Systweak Inc ) Task: {E0A268FA-64D1-46A0-BEB5-D2FCCB60BDE1} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-4 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-4.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG Task: {E2ADF0E0-E18A-4029-87BB-8C6B0779CD2F} - System32\Tasks\uBr => C:\ProgramData\Convertor\Convertor.exe [2015-08-05] (Don HO don.h@free.fr) <==== ACHTUNG Task: {F9B2ED92-1F2D-44B1-A7B3-0426D51745AB} - System32\Tasks\DailyPCClean Schedule => C:\Program Files (x86)\DailyPCClean\DPCCSchedule.exe [2015-05-19] (Tuto4PC) Task: {FD1A5C7A-82A3-4E2A-9B1F-0C989C28D188} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.exe [2015-07-12] (Buca Apps) <==== ACHTUNG (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.) Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-6.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-7.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\AmiUpdXp.job => C:\Users\VeraHagge\AppData\Local\29908\Updater.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-7.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-4.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-4.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\IntelliText.job => c:\programdata\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}\priceless_p_soft_partner.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\LVKAHSH1.job => C:\ProgramData\SecurityUtility\SecurityUtility.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\Optscan.job => c:\programdata\{9067e982-1f12-20b7-9067-7e9821f1a608}\hqghumeaylnlf.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\Superclean.job => c:\programdata\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}\hqghumeaylnlf.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\WheelsMaster.job => c:\programdata\{ef8baf33-367f-614b-ef8b-baf33367bccc}\5951259966257080345e.exe <==== ACHTUNG Task: C:\WINDOWS\Tasks\WinZipDriverUpdater_UPDATES.job => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe ==================== Geladene Module (Nicht auf der Ausnahmeliste) ============== 2015-07-26 11:03 - 2015-07-22 16:26 - 01448824 _____ () C:\Program Files\shopperz22072015\csrcc.exe 2015-07-26 11:03 - 2015-07-22 16:26 - 00285560 _____ () C:\Program Files\shopperz22072015\Jmahzov.exe 2015-07-29 13:09 - 2015-02-17 17:02 - 00221696 _____ () C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe 2015-07-30 04:10 - 2015-07-30 04:10 - 00350720 _____ () C:\WINDOWS\SysWOW64\nethtsrv.exe 2015-07-17 17:30 - 2015-07-17 17:30 - 00090328 _____ () C:\Program Files\Kromtech\PCKAV\SharedNativeLibraryPS.dll 2015-07-30 04:10 - 2015-07-30 04:10 - 00190976 _____ () C:\WINDOWS\SysWOW64\netupdsrv.exe 2015-07-26 11:03 - 2015-07-22 16:26 - 00174968 _____ () C:\Program Files\shopperz22072015\Jvpmajlij.exe 2015-07-26 11:03 - 2015-07-22 16:27 - 00297848 _____ () C:\Program Files\shopperz22072015\Xpnsbedno64.DLL 2015-07-26 11:03 - 2015-07-22 16:26 - 00434040 _____ () C:\Program Files\shopperz22072015\Huyde.exe 2015-07-26 11:03 - 2015-07-22 16:26 - 00464760 _____ () C:\Program Files\shopperz22072015\Huyde64.exe 2015-07-26 11:03 - 2015-07-22 16:27 - 00631160 _____ () C:\Program Files\shopperz22072015\Dhnayvhf64.DLL 2015-07-26 11:03 - 2015-07-22 16:27 - 00277880 _____ () C:\Program Files\shopperz22072015\Keeqcb64.DLL 2015-07-26 11:03 - 2015-07-22 16:27 - 00337272 _____ () C:\Program Files\shopperz22072015\Xeelfeze64.DLL 2015-08-10 20:38 - 2015-08-10 12:04 - 03346064 _____ () C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe 2015-08-10 19:46 - 2015-08-10 19:46 - 00982016 _____ () C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe 2015-05-25 17:29 - 2015-05-25 17:29 - 00104752 _____ () C:\Program Files\Kromtech\PCKeeper\ZBAnalyticsCore.dll 2015-05-25 15:00 - 2015-05-25 15:00 - 04901376 _____ () C:\Program Files\Kromtech\PCKeeper\de\ImageResources.de.dll 2015-05-25 17:29 - 2015-05-25 17:29 - 00060720 _____ () C:\Program Files\Kromtech\PCKeeper\ZBAnalytics.dll 2015-07-27 01:23 - 2015-07-26 07:12 - 03225088 _____ () C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe 2015-07-28 12:13 - 2015-07-28 12:13 - 00840206 _____ () C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe 2015-07-30 11:12 - 2015-07-30 11:12 - 00656128 _____ () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe 2015-07-29 12:59 - 2015-07-27 17:16 - 03979408 _____ () C:\Program Files (x86)\rec_de_57\rec_de_57.exe 2015-08-10 20:38 - 2015-08-10 12:03 - 03984016 _____ () C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe 2014-08-12 11:06 - 2014-08-12 11:06 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll 2015-07-26 07:09 - 2015-07-26 07:09 - 01684480 _____ () C:\Program Files\Common Files\ShopperPro\spbici64.dll 2015-08-21 15:31 - 2015-08-21 15:31 - 04717435 _____ () C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe 2015-07-26 10:52 - 2015-07-23 17:59 - 03645584 _____ () C:\Program Files (x86)\Optimizer Pro 3.99\OptimizerPro.exe 2015-07-30 11:12 - 2015-07-30 11:12 - 00452352 _____ () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe 2015-08-21 16:10 - 2015-08-12 00:00 - 00077824 ____H () C:\Program Files (x86)\baidu\pps.exe 2015-08-21 16:10 - 2015-08-11 23:58 - 00036864 ____H () C:\Program Files (x86)\baidu\Bind.exe 2015-08-21 16:20 - 2015-08-20 15:04 - 03978384 _____ () C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe 2015-08-21 15:48 - 2015-08-21 16:27 - 04613520 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nseBB78.tmp\setup.exe 2015-08-21 16:39 - 2015-08-21 16:39 - 01455072 _____ () C:\ProgramData\rKRjrFKiDD\dat\vgKjuCRO.dll 2015-08-10 20:07 - 2015-08-05 17:23 - 00221312 _____ () C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_64.dll 2015-07-26 10:57 - 2015-07-26 10:57 - 00158720 _____ () C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe 2015-07-31 13:27 - 2015-07-31 13:28 - 02239488 _____ () c:\Program Files (x86)\LibrarySystem\LibrarySystem.dll 2015-07-26 10:54 - 2015-07-26 10:54 - 03196928 _____ () c:\Program Files (x86)\wincheck\wincheck.dll 2015-07-26 10:53 - 2015-07-26 10:53 - 02570896 _____ () c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll 2015-07-26 11:03 - 2015-07-22 16:27 - 00291704 _____ () C:\Program Files\shopperz22072015\Xpnsbedno.DLL 2015-07-26 11:03 - 2015-07-22 16:27 - 00620408 _____ () C:\Program Files\shopperz22072015\Dhnayvhf.DLL 2015-07-26 11:03 - 2015-07-22 16:27 - 00243576 _____ () C:\Program Files\shopperz22072015\Keeqcb.DLL 2015-07-26 11:03 - 2015-07-22 16:27 - 00312184 _____ () C:\Program Files\shopperz22072015\Xeelfeze.DLL 2015-08-21 16:30 - 2015-08-21 16:30 - 00004608 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\nsProcess.dll 2015-08-21 16:30 - 2015-08-21 16:30 - 00251904 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\AccDownload.dll 2015-08-21 16:32 - 2015-08-21 16:32 - 00011264 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\System.dll 2015-08-21 16:32 - 2015-08-21 16:32 - 00006656 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\nsExec.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\zlib.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libexpatw.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\tinyxml.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00481632 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\sqlite.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00063840 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00051552 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00018784 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\oDayProtect.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00203104 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQFileFlt.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00194912 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\xImage.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00342040 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\arkGraphic.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00092184 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\xGraphic32.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libpng.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libjpegturbo.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00045920 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\jgImage.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\jgIOStub.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00076128 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\MemDefrag.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00502168 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMLoader\QQPCDetector.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00268640 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\StartupMgr\SoftMon.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00092184 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\xGraphic32.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\zlib.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libexpatw.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\tinyxml.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00342040 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\arkGraphic.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00045920 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\jgImage.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\jgIOStub.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libpng.dll 2015-08-21 16:51 - 2015-08-21 16:51 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libjpegturbo.dll ==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) ========= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.) ==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service" ==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.) ==================== Internet Explorer Vertrauenswürdig/Eingeschränkt =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.) IE trusted site: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\localhost -> localhost IE trusted site: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\webcompanion.com -> hxxp://webcompanion.com ==================== Andere Bereiche ============================ (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\Theme2\img12.jpg HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg DNS Servers: 52.18.92.32 - 8.8.8.8 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall ist aktiviert. ==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge == (Aktuell gibt es keinen automatisierten Fix für diesen Bereich.) ==================== Firewall Regeln (Nicht auf der Ausnahmeliste) =============== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{746F8BB3-5428-4343-8158-8FABAAF16679}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe FirewallRules: [{C0FB77C1-5EC8-43F6-89C9-6B7BED00A8E0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE FirewallRules: [{6515E186-6D47-4B6C-AFB3-709B4935D9C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{45C19567-A39A-422B-9938-A30E7A78EF2C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{B71E6EDA-A6E3-4C91-B70D-0E2C2A9D96B8}] => (Allow) C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe FirewallRules: [{D5F4F611-7EF7-417C-88E4-B8F58CAF022F}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe FirewallRules: [{1A0CA108-B1B1-4DC6-AC59-6CCF2DC8AD25}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe FirewallRules: [{EBCE7656-28C8-4146-A6DA-ADFD3A5214AB}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe FirewallRules: [{7B392023-D9E8-49AD-8E32-C291BF2D1644}] => (Allow) C:\Program Files (x86)\speed browser\Application\browser.exe FirewallRules: [{3E487AB0-39D3-421C-9F31-EB56EA8B3CEC}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe FirewallRules: [{54749A6D-F2DB-4FF3-B624-C27D6F8A1637}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe FirewallRules: [{1E377C14-C008-4AED-8841-9593EC742956}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe FirewallRules: [{AFF403EC-49D4-4B53-9BFA-211D5F0E56F8}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCmgrInstallGuide.exe FirewallRules: [{3BCB4B94-C2F4-4D0B-900D-51305B02D2A2}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe FirewallRules: [{EC220F28-4C86-4F2A-AE3B-F5D636581BA7}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCMgr.exe FirewallRules: [{A0B2E722-81FA-4A3D-98EE-4AED8E67627A}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe FirewallRules: [{2DC3DE63-37D2-4004-ACAF-5CA1D058CB34}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMDL.exe FirewallRules: [{F4E6F4E3-7F6E-4731-82AC-2C5066934DAA}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\bugreport.exe FirewallRules: [{5DDE6DBD-938F-4120-99DA-B18931133A1C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCFileOpen.exe FirewallRules: [{3F0A16D0-825C-405E-BF82-1045EA443DFD}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCLeakScan.exe FirewallRules: [{1CC214C1-0F1B-4C7E-85C3-8A268988B4E0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPConfig.exe FirewallRules: [{038BFC67-E288-4E41-A406-5E621EA7F593}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSoftMgr.exe FirewallRules: [{17CCEE76-DE33-461E-AE79-4F8F44D4F854}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe FirewallRules: [{2BAB52DA-A9E2-4C62-80BE-19CA3D40F393}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe FirewallRules: [{7B6BB968-2C91-4018-8A08-A18AB91DB67D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\QQPCNetFlow.exe FirewallRules: [{FF6405A1-CD50-4357-A065-0C1EE2097607}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCBTU.exe FirewallRules: [{452A7506-E3EE-40B6-B0A6-6001E1E34223}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCClinic.exe FirewallRules: [{6A2FC18B-9B1D-482A-B1F4-0C63E0FA14EA}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCLaunch.exe FirewallRules: [{6D9642CF-FDF7-41F3-8D85-158A44CD63B1}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMUpdate\QQPCMgrUpdate.exe FirewallRules: [{9BDCC5E8-3476-4931-AB57-807B59A5753E}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSoftGame.exe FirewallRules: [{94EA5551-7A1C-4117-BB54-DA1F5D29B31C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSysOptimize.exe FirewallRules: [{59677356-AA59-4350-B8E4-802BE5E406E2}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCUpdateAVLib.exe FirewallRules: [{CE73CF55-FF24-4E9D-B0CD-4F5CE8DA25E7}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQRepair.exe FirewallRules: [{1B4377B5-6AA3-4D29-8F46-E851AABC08F6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\Uninst.exe FirewallRules: [{7728906C-EF26-45A5-9BDA-05F291853C80}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCPatch.exe FirewallRules: [{A644DE9C-392E-4601-9B20-C3445CB45EBC}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TpkUpdate.exe FirewallRules: [{F2E0ABB8-737D-433D-9CAF-BDB96EC52725}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMRouterMgr.exe FirewallRules: [{C04D1627-2A94-46E4-8789-6996230059E3}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMAccountProtection.exe ==================== Fehlerhafte Geräte im Gerätemanager ============= ==================== Fehlereinträge in der Ereignisanzeige: ========================= Applikationsfehler: ================== Error: (08/21/2015 04:53:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x7487ca20 ID des fehlerhaften Prozesses: 0x2434 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:53:30 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x00954fa0 ID des fehlerhaften Prozesses: 0x2434 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:53:22 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x7487ca20 ID des fehlerhaften Prozesses: 0x2704 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:53:16 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x00a94fa0 ID des fehlerhaften Prozesses: 0x2704 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:53:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x7487ca20 ID des fehlerhaften Prozesses: 0x25d4 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:53:05 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x020d4fa0 ID des fehlerhaften Prozesses: 0x25d4 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:52:47 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x7487ca20 ID des fehlerhaften Prozesses: 0xde4 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:52:42 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x02124fa0 ID des fehlerhaften Prozesses: 0xde4 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:52:35 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x7487ca20 ID des fehlerhaften Prozesses: 0x25a8 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Error: (08/21/2015 04:52:28 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc00001a5 Fehleroffset: 0x00a94fa0 ID des fehlerhaften Prozesses: 0x25a8 Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0 Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1 Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2 Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3 Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5 Systemfehler: ============= Error: (08/21/2015 04:55:08 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: Der Dienst "Rsd Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (08/21/2015 04:52:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: Der Dienst "QQPCMgr RTP Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (08/21/2015 04:38:29 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: Der Dienst "JwTtFpw" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts. Error: (08/21/2015 03:19:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Internet Explorer Flash Player unter Windows 8.1 für x64-basierte Systeme (KB3089023) Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5 unter Windows 8.1 und Windows Server 2012 R2 für x64-basierte Systeme (KB3072307) Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3070071) Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT) Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3075853) Error: (08/21/2015 02:13:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (08/21/2015 02:13:25 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 21.08.2015 um 13:58:29 unerwartet heruntergefahren. Microsoft Office: ========================= Error: (08/21/2015 04:53:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20243401d0dc21248e9840C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown6468749d-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:53:30 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500954fa0243401d0dc21248e9840C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown6285a95d-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:53:22 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20270401d0dc211c4f4f89C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown5db98f9d-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:53:16 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500a94fa0270401d0dc211c4f4f89C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown5a72eefa-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:53:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca2025d401d0dc2115900188C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown567d223d-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:53:05 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a5020d4fa025d401d0dc2115900188C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown53ba57c1-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:52:47 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20de401d0dc21086e2bb7C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown48c17d31-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:52:42 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a502124fa0de401d0dc21086e2bb7C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown4641d652-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:52:35 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca2025a801d0dc20fefb559eC:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown4188b952-4814-11e5-826b-74d4357a72a2 Error: (08/21/2015 04:52:28 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500a94fa025a801d0dc20fefb559eC:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown3d55e383-4814-11e5-826b-74d4357a72a2 CodeIntegrity: =================================== Date: 2015-07-27 01:19:03.992 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-27 01:19:03.883 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-27 01:18:43.539 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-27 01:18:43.414 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-27 01:17:17.195 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-27 01:17:17.007 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system. Date: 2015-07-23 07:34:17.784 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-07-23 07:34:17.518 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-07-12 13:31:23.675 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2015-07-12 13:31:23.409 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Speicherinformationen =========================== Processor: AMD A4-4020 APU with Radeon(tm) HD Graphics Prozentuale Nutzung des RAM: 71% Installierter physikalischer RAM: 3271.44 MB Verfügbarer physikalischer RAM: 926.19 MB Summe virtueller Speicher: 5607.32 MB Verfügbarer virtueller Speicher: 2037.11 MB ==================== Laufwerke ================================ Drive c: (Windows) (Fixed) (Total:916.15 GB) (Free:876.33 GB) NTFS Drive d: (CD_ROM) (CDROM) (Total:0.15 GB) (Free:0 GB) CDFS Drive f: (HITMANPRO) (Removable) (Total:1.86 GB) (Free:1.73 GB) FAT32 ==================== MBR & Partitionstabelle ================== ======================================================== Disk: 0 (Size: 931.5 GB) (Disk ID: E6631533) Partition: GPT. ==================== Ende von Ergebnis ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-08-21 20:11:01 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000025 ST31000524AS rev.JC4B 931,51GB Running: Gmer-19357.exe; Driver: C:\Users\VERAHA~1\AppData\Local\Temp\kfrirpow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff9600016bd00 15 bytes [00, E4, F2, 01, 80, 8C, 6C, ...] .text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff9600016bd10 11 bytes [00, 72, FC, FF, 00, 09, CB, ...] ---- User code sections - GMER 2.1 ---- .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!DllInstall + 4 0000000070af5144 16 bytes [83, EC, 4C, 8B, 45, 0C, 8B, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!DllInstall + 24 0000000070af5158 6 bytes [89, 45, F8, C7, 45, E4] .text ... * 15 .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!__apicall + 42 0000000070af533a 10 bytes [45, D4, 32, BF, D7, 75, 8B, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!__apicall + 56 0000000070af5348 16 bytes {JMP 0x75d7bf36} .text ... * 8 .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_init + 38 0000000070af5516 73 bytes [89, 45, F0, C7, 45, D4, CB, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_init + 112 0000000070af5560 3 bytes [00, 00, 00] .text ... * 10 .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_uninstall + 32 0000000070af56f0 2 bytes [DC, A1] .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_uninstall + 38 0000000070af56f6 44 bytes [89, 45, F0, C7, 45, D4, B8, ...] .text ... * 13 .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!serv + 22 0000000070af58c6 12 bytes {CALL 0xffffffff89e44d8f} .text C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!serv + 38 0000000070af58d6 1 byte [89] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!DllInstall + 24 00000000700b7218 23 bytes [89, 45, F8, C7, 45, E4, E1, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!DllInstall + 51 00000000700b7233 83 bytes {JG 0x21; JMP 0xb} .text ... * 9 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__apicall + 22 00000000700b73e6 12 bytes {CALL 0xffffffff89e44d8f} .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__apicall + 38 00000000700b73f6 52 bytes [89, 45, F0, C7, 45, D4, 32, ...] .text ... * 16 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__install + 31 00000000700b75cf 26 bytes [89, 45, F4, C7, 45, DC, 94, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__install + 61 00000000700b75ed 74 bytes {SBB EAX, [RAX]; ADD [RAX], AL; JMP 0x9} .text ... * 13 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__uninstall + 6 00000000700b7796 17 bytes [EC, 50, 8B, 45, 10, 8B, 4D, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__uninstall + 31 00000000700b77af 14 bytes [89, 45, F4, C7, 45, DC, C1, ...] .text ... * 16 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_init + 38 00000000700b7996 72 bytes [89, 45, F0, C7, 45, D4, 87, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_init + 111 00000000700b79df 25 bytes {SBB EAX, [RAX]; ADD [RAX], AL; JMP 0x9} .text ... * 7 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_uninstall + 16 00000000700b7b60 18 bytes [55, 0C, 8B, 75, 08, 89, 45, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_uninstall + 38 00000000700b7b76 50 bytes [89, 45, F0, C7, 45, D4, 63, ...] .text ... * 11 .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!ENT + 38 00000000700b7d56 71 bytes [89, 45, F0, C7, 45, D4, 32, ...] .text C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!ENT + 110 00000000700b7d9e 31 bytes {POP QWORD [RDI+0x0]; ADD [RAX], AL; JMP 0xa} .text C:\WINDOWS\system32\dashost.exe[2588] C:\WINDOWS\system32\KERNEL32.DLL!SetFileCompletionNotificationModes 00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]} .text C:\Program Files\shopperz22072015\Huyde64.exe[4632] C:\WINDOWS\system32\KERNEL32.DLL!SetFileCompletionNotificationModes 00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]} .text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[7640] C:\WINDOWS\system32\KERNEL32.dll!SetFileCompletionNotificationModes 00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]} ---- Threads - GMER 2.1 ---- Thread C:\WINDOWS\system32\csrss.exe [568:592] fffff960008b02d0 Thread C:\WINDOWS\SysWOW64\rundll32.exe [1792:2196] 000000007ed3fdc0 Thread C:\WINDOWS\SysWOW64\rundll32.exe [1792:5772] 000000007eeb8bd0 Thread C:\WINDOWS\SysWOW64\rundll32.exe [2156:2400] 000000007f490110 Thread C:\WINDOWS\SysWOW64\rundll32.exe [2156:4776] 000000007f3aa670 Thread C:\WINDOWS\SysWOW64\rundll32.exe [2344:2856] 000000007ee0c700 Thread C:\WINDOWS\SysWOW64\rundll32.exe [2344:1188] 000000007ed000a0 Thread C:\WINDOWS\system32\svchost.exe [2992:2220] 00007ffd3cda1120 Thread C:\WINDOWS\system32\svchost.exe [2992:2212] 00007ffd3c193460 Thread C:\WINDOWS\system32\taskhost.exe [2408:812] 00007ffd2ea3def0 Thread C:\WINDOWS\system32\taskhost.exe [5032:1588] 00007ffd2d87b360 Thread C:\WINDOWS\system32\taskhost.exe [5032:4988] 00007ffd36ca7470 Thread C:\WINDOWS\system32\taskhost.exe [5032:2136] 00007ffd36ca7470 Thread C:\WINDOWS\system32\taskhost.exe [5032:4384] 00007ffd36ca7470 Thread C:\WINDOWS\Explorer.EXE [3696:7092] 00007ffd26d6e630 Thread C:\WINDOWS\Explorer.EXE [3696:6920] 00007ffd26d6e630 Thread C:\WINDOWS\Explorer.EXE [3696:6812] 00007ffd26d6e630 Thread C:\WINDOWS\Explorer.EXE [3696:6232] 00007ffd26d69970 ---- Processes - GMER 2.1 ---- Process C:\ProgramData\SecurityUtility\SecurityUtility.exe (*** suspicious ***) @ C:\ProgramData\SecurityUtility\SecurityUtility.exe [3500] (Install/SecurityUtility)(2015-07-28 10:14:30) 00007ff652990000 Process C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe (*** suspicious ***) @ C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe [7084](2015-08-10 17:46:37) 0000000000d00000 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- |
23.08.2015, 05:53 | #5 |
/// the machine /// TB-Ausbilder | Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet Du bist offiziell der TB-Adware-König Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Downloade Dir bitte Malwarebytes Anti-Malware
Downloade Dir bitte AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
27.08.2015, 19:46 | #6 |
| Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastetCode:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-08-2015 02 durchgeführt von VeraHagge (Administrator) auf BINE-VERA (27-08-2015 10:26:02) Gestartet von C:\Users\VeraHagge\Downloads\antivir Geladene Profile: VeraHagge (Verfügbare Profile: VeraHagge & Administrator) Platform: Windows 8.1 Connected (X64) Sprache: Deutsch (Deutschland) Internet Explorer Version 11 (Standard-Browser: IE) Start-Modus: Normal Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Prozesse (Nicht auf der Ausnahmeliste) ================= (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.) (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe ==================== Registry (Nicht auf der Ausnahmeliste) =========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-22] (Realtek Semiconductor) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-08-12] (Advanced Micro Devices, Inc.) ==================== Internet (Nicht auf der Ausnahmeliste) ==================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..) HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.hyrican.de HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms} Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [DhcpNameServer] 192.168.1.254 ==================== Dienste (Nicht auf der Ausnahmeliste) ======================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-08-12] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert] S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-07-18] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-07-18] (Microsoft Corporation) ===================== Treiber (Nicht auf der Ausnahmeliste) ========================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.) R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices) R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [225504 2014-03-28] (AppEx Networks Corporation) R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-27] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) R4 ccSet_NIS; \SystemRoot\system32\drivers\NISx64\1500000.064\ccSetx64.sys [X] R4 IDSVia64; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\IPSDefs\20130805.011\IDSVia64.sys [X] R4 SRTSPX; \SystemRoot\system32\drivers\NISx64\1500000.064\SRTSPX64.SYS [X] R4 SymDS; \SystemRoot\system32\drivers\NISx64\1500000.064\SYMDS64.SYS [X] R4 SymEFA; \SystemRoot\system32\drivers\NISx64\1500000.064\SYMEFA64.SYS [X] R4 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [X] ==================== NetSvcs (Nicht auf der Ausnahmeliste) =================== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.) ==================== Ein Monat: Erstellte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-08-27 10:25 - 2015-08-27 10:25 - 00000608 _____ C:\Users\VeraHagge\Documents\JRT.txt 2015-08-27 10:25 - 2015-08-27 10:25 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Macromedia 2015-08-27 10:20 - 2015-08-27 10:20 - 00000608 _____ C:\Users\VeraHagge\Desktop\JRT.txt 2015-08-27 10:16 - 2015-08-27 10:16 - 00030223 _____ C:\Users\VeraHagge\Documents\AdwCleaner[S1].txt 2015-08-27 10:11 - 2015-08-27 10:11 - 00001189 _____ C:\Users\VeraHagge\Documents\mbam.txt 2015-08-27 09:47 - 2015-08-27 09:48 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-08-27 09:47 - 2015-08-27 09:47 - 00001125 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-08-27 09:47 - 2015-08-27 09:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-08-27 09:46 - 2015-08-27 09:47 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-08-27 09:46 - 2015-08-27 09:46 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-08-27 09:46 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2015-08-27 09:46 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2015-08-27 09:46 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys 2015-08-26 18:04 - 2015-08-26 18:09 - 00000000 ____D C:\Users\VeraHagge\Downloads\# neue versionen # 2015-08-26 18:03 - 2015-08-27 09:57 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-1002 2015-08-26 18:00 - 2015-08-26 18:00 - 00000000 __SHD C:\Users\VeraHagge\AppData\Local\EmieUserList 2015-08-26 18:00 - 2015-08-26 18:00 - 00000000 __SHD C:\Users\VeraHagge\AppData\Local\EmieSiteList 2015-08-26 17:59 - 2015-08-26 17:59 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\AMD 2015-08-26 17:58 - 2015-08-26 17:58 - 00007988 _____ C:\Users\VeraHagge\Desktop\Entfernte Anwendungen.html 2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD 2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\ATI 2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\ATI 2015-08-26 17:57 - 2015-08-26 17:57 - 00001461 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-08-26 17:57 - 2015-08-26 17:57 - 00000020 ___SH C:\Users\VeraHagge\ntuser.ini 2015-08-26 17:57 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Adobe 2015-08-26 17:57 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\VirtualStore 2015-08-26 14:04 - 2015-08-27 06:04 - 00000000 ____D C:\Windows.old 2015-08-26 14:04 - 2015-08-26 14:04 - 00262144 _____ C:\WINDOWS\system32\config\userdiff 2015-08-26 13:09 - 2015-08-27 10:17 - 01068115 _____ C:\WINDOWS\WindowsUpdate.log 2015-08-26 13:09 - 2015-08-26 13:09 - 00001226 _____ C:\Users\Administrator\AppData\Local\Application.xml 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Vorlagen 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Startmenü 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Eigene Dateien 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Druckumgebung 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Vorlagen 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Startmenü 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programme 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Dokumente 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten 2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien 2015-08-26 13:08 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge 2015-08-26 13:08 - 2015-08-26 13:09 - 00028578 _____ C:\WINDOWS\diagwrn.xml 2015-08-26 13:08 - 2015-08-26 13:09 - 00028578 _____ C:\WINDOWS\diagerr.xml 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Vorlagen 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Startmenü 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Netzwerkumgebung 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Lokale Einstellungen 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Eigene Dateien 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Druckumgebung 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Documents\Eigene Musik 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Documents\Eigene Bilder 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Local\Verlauf 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Local\Anwendungsdaten 2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Anwendungsdaten 2015-08-26 13:08 - 2014-07-18 09:03 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2015-08-26 13:08 - 2014-07-18 08:53 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools 2015-08-26 13:08 - 2014-03-18 11:48 - 00000369 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk 2015-08-26 13:08 - 2014-03-18 11:48 - 00000369 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk 2015-08-26 13:08 - 2013-10-18 12:44 - 00001320 _____ C:\Users\VeraHagge\Desktop\Erstellen Sie sich einen Wiederherstellungsdateträger.lnk 2015-08-26 13:08 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2015-08-26 13:08 - 2013-08-22 17:36 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2015-08-26 13:08 - 2012-10-02 08:25 - 00000830 _____ C:\Users\VeraHagge\Desktop\Treiber und Software.lnk 2015-08-26 13:06 - 2015-08-26 13:06 - 00002312 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-500 2015-08-26 13:06 - 2015-08-26 13:06 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf 2015-08-26 12:43 - 2015-08-26 18:17 - 00000000 ___HD C:\$SysReset 2015-08-26 09:47 - 2015-08-26 09:47 - 00001192 _____ C:\AdwCleaner[C3].txt 2015-08-26 09:45 - 2015-08-26 09:45 - 00001086 _____ C:\AdwCleaner[S3].txt 2015-08-26 09:36 - 2015-08-26 09:36 - 01798576 _____ (Malwarebytes Corporation) C:\Users\VeraHagge\Downloads\JRT-26-08-15.exe 2015-08-26 09:20 - 2015-08-26 09:19 - 19334088 _____ (Innovative Solutions ) C:\Users\VeraHagge\Downloads\Advanced_Uninstaller11.exe 2015-08-26 09:16 - 2015-08-26 09:16 - 00058716 _____ C:\Users\VeraHagge\Documents\eset.txt 2015-08-25 11:33 - 2015-08-25 11:33 - 00001229 _____ C:\AdwCleaner[C2].txt 2015-08-25 11:08 - 2015-08-25 11:09 - 00001105 _____ C:\AdwCleaner[S2].txt 2015-08-25 11:05 - 2015-08-25 11:05 - 00931408 _____ (Google Inc.) C:\Users\VeraHagge\Downloads\ChromeSetup.exe 2015-08-25 11:01 - 2015-08-25 11:01 - 00030187 _____ C:\AdwCleaner[C1].txt 2015-08-25 10:59 - 2015-08-27 10:12 - 00030223 _____ C:\AdwCleaner[S1].txt 2015-08-25 10:59 - 2015-08-25 10:59 - 00000000 ____D C:\AdwCleaner 2015-08-24 09:22 - 2015-08-24 09:16 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VeraHagge\Downloads\revosetup95.exe 2015-08-21 20:14 - 2015-08-21 20:11 - 00016878 _____ C:\Users\VeraHagge\Downloads\gmer.log 2015-08-21 17:01 - 2015-08-24 12:40 - 00000000 ___RD C:\RavBin 2015-08-21 16:59 - 2015-08-21 17:01 - 00061237 _____ C:\Users\VeraHagge\Downloads\Addition.txt 2015-08-21 16:54 - 2015-08-21 17:01 - 00110968 _____ C:\Users\VeraHagge\Downloads\FRST.txt 2015-08-21 16:49 - 2015-08-21 16:31 - 00380416 _____ C:\Users\VeraHagge\Downloads\Gmer-19357.exe 2015-08-21 16:42 - 2015-08-27 10:26 - 00000000 ____D C:\FRST 2015-08-21 16:41 - 2015-08-21 16:41 - 00000000 _____ C:\Users\VeraHagge\defogger_reenable 2015-08-21 16:20 - 2015-08-24 09:18 - 00000000 ____D C:\qycache 2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\ppsfile 2015-08-21 15:28 - 2015-08-27 09:45 - 00000000 ____D C:\Users\VeraHagge\Downloads\antivir 2015-08-21 15:24 - 2015-08-21 15:24 - 00000687 _____ C:\awhFF08.tmp 2015-08-21 15:11 - 2015-08-21 15:11 - 00000687 _____ C:\awh998E.tmp 2015-08-21 12:32 - 2015-08-21 12:32 - 00000687 _____ C:\awhF033.tmp 2015-08-21 08:43 - 2015-08-22 01:06 - 00001397 _____ C:\startup.log 2015-08-13 13:33 - 2015-08-13 13:33 - 00000687 _____ C:\awhEDA9.tmp ==================== Ein Monat: Geänderte Dateien und Ordner ======== (Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.) 2015-08-27 10:16 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\restore 2015-08-27 10:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru 2015-08-27 04:37 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2015-08-27 04:30 - 2015-05-11 14:00 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Packages 2015-08-27 00:00 - 2014-09-10 20:43 - 00000000 ___DC C:\WINDOWS\Panther 2015-08-26 18:03 - 2014-09-10 10:47 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security 2015-08-26 18:03 - 2013-08-22 17:36 - 00000000 ___HD C:\WINDOWS\ELAMBKUP 2015-08-26 18:03 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM 2015-08-26 17:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\Recovery 2015-08-26 14:04 - 2013-08-22 17:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template 2015-08-26 13:14 - 2014-03-18 11:47 - 01686150 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2015-08-26 13:14 - 2014-03-18 11:30 - 00726688 _____ C:\WINDOWS\system32\perfh007.dat 2015-08-26 13:14 - 2014-03-18 11:30 - 00151380 _____ C:\WINDOWS\system32\perfc007.dat 2015-08-26 13:12 - 2014-09-10 10:47 - 00000000 ____D C:\ProgramData\Norton 2015-08-26 13:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache 2015-08-26 13:09 - 2013-08-22 17:36 - 00000000 __RHD C:\Users\Public\Libraries 2015-08-26 13:09 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows NT 2015-08-26 13:09 - 2013-08-22 16:46 - 00027757 _____ C:\WINDOWS\setupact.log 2015-08-26 13:09 - 2013-08-22 15:36 - 00000000 __RHD C:\Users\Default 2015-08-26 13:07 - 2014-09-10 11:02 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin 2015-08-26 13:07 - 2014-09-10 10:46 - 00000000 ____D C:\Users\Administrator 2015-08-26 13:07 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-08-26 13:07 - 2013-08-22 16:44 - 00335992 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-08-26 13:07 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2015-08-26 13:06 - 2013-08-22 17:37 - 00003608 _____ C:\WINDOWS\DtcInstall.log 2015-08-26 13:05 - 2014-03-18 03:38 - 00001912 _____ C:\WINDOWS\PFRO.log Einige Dateien in TEMP: ==================== C:\Users\VeraHagge\AppData\Local\Temp\SEVINST64x86.EXE ==================== Bamital & volsnap ================= (Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.) C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert C:\WINDOWS\explorer.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert C:\WINDOWS\system32\services.exe => Datei ist digital signiert C:\WINDOWS\system32\User32.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert LastRegBack: 2014-09-10 10:43 ==================== Ende von FRST.txt ============================ Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Malwarebytes Version: 7.5.4 (07.27.2015:1) OS: Windows 8.1 Connected x64 Ran by VeraHagge on 27.08.2015 at 10:16:33,22 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Tasks ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 27.08.2015 at 10:20:17,94 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 27.08.2015 Suchlaufzeit: 09:48 Protokolldatei: mbam-log.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.08.27.01 Rootkit-Datenbank: v2015.08.16.01 Lizenz: Testversion Malware-Schutz: Aktiviert Schutz vor bösartigen Websites: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: VeraHagge Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 372486 Abgelaufene Zeit: 7 Min., 40 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v5.000 - Logfile created 25/08/2015 at 10:59:46 # Updated 14/08/2015 by Xplode # Database : 2015-08-23.3 [Server] # Operating system : Windows 8.1 Connected (x64) # Username : VeraHagge - BINE-VERA # Running from : C:\Users\VeraHagge\Downloads\antivir\adwcleaner_5.000.exe # Option : Scan ***** [ Services ] ***** Service Found : nethfdrv Service Found : NethxxpService Service Found : ServiceUpdater Service Found : QMUdisk Service Found : TS888x64 Service Found : RsMgrSvc Service Found : 088c3b28 Service Found : 1f68291f Service Found : 80b4b4af Service Found : SPDRIVER_1.42.1.2188 ***** [ Folders ] ***** Folder Found : C:\IQIYI Video Folder Found : C:\DesktopSearch Folder Found : C:\Program Files\Kromtech Folder Found : C:\Program Files\WinZip Driver Updater Folder Found : C:\Program Files (x86)\Boost Folder Found : C:\Program Files (x86)\predm Folder Found : C:\Program Files (x86)\shopwit Folder Found : C:\Program Files (x86)\Convertor Folder Found : C:\Program Files (x86)\GUPlayer Folder Found : C:\Program Files (x86)\tencent Folder Found : C:\Program Files (x86)\DailyPcClean Support Folder Found : C:\Program Files (x86)\Rising Folder Found : C:\Program Files (x86)\winsta Folder Found : C:\Program Files (x86)\MiniLite Folder Found : C:\Program Files (x86)\MiniiMuuumPruice Folder Found : C:\Program Files (x86)\Winsta Folder Found : C:\Program Files (x86)\Common Files\Umbrella Folder Found : C:\Program Files (x86)\Common Files\tencent Folder Found : C:\Program Files\Common Files\tencent Folder Found : C:\ProgramData\Browser Folder Found : C:\ProgramData\Kromtech Folder Found : C:\ProgramData\Convertor Folder Found : C:\ProgramData\radio Folder Found : C:\ProgramData\tencent Folder Found : C:\ProgramData\TXQMPC Folder Found : C:\ProgramData\Rising Folder Found : C:\ProgramData\4adc7a4f00005e5d Folder Found : C:\ProgramData\53e616a6000027d3 Folder Found : C:\ProgramData\5b64599000004c3f Folder Found : C:\ProgramData\6632678238890282139 Folder Found : C:\ProgramData\{36543f71-a4eb-bdfc-3654-43f71a4efdc6} Folder Found : C:\ProgramData\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f} Folder Found : C:\ProgramData\{76f270a0-8ddb-0972-76f2-270a08ddc282} Folder Found : C:\ProgramData\{8a5acb8e-91ed-48f3-8a5a-acb8e91e2e3a} Folder Found : C:\ProgramData\{8f1ec0c1-07e2-335f-8f1e-ec0c107e0304} Folder Found : C:\ProgramData\{9067e982-1f12-20b7-9067-7e9821f1a608} Folder Found : C:\ProgramData\{9448b5cb-7fb0-e8b2-9448-8b5cb7fbd72d} Folder Found : C:\ProgramData\{cd6397c2-994a-f3eb-cd63-397c29945f0a} Folder Found : C:\ProgramData\{ef8baf33-367f-614b-ef8b-baf33367bccc} Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kromtech Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desktop Search Folder Found : C:\Users\Administrator\AppData\Local\speed browser Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\Iminent Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\PremierOpinion Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\tencent Folder Found : C:\Users\VeraHagge\AppData\Local\Boost Folder Found : C:\Users\VeraHagge\AppData\Local\Kromtech Folder Found : C:\Users\VeraHagge\AppData\Local\DesktopSearch Folder Found : C:\Users\VeraHagge\AppData\Local\YSearchUtil Folder Found : C:\Users\VeraHagge\AppData\Local\SysassistByHotWheel Folder Found : C:\Users\VeraHagge\AppData\Local\03D40274-1437907493-057A-7206-A20700080009 Folder Found : C:\Users\VeraHagge\AppData\LocalLow\Browser-Security Folder Found : C:\Users\VeraHagge\AppData\Roaming\ASP Folder Found : C:\Users\VeraHagge\AppData\Roaming\Convertor Folder Found : C:\Users\VeraHagge\AppData\Roaming\pdfie Folder Found : C:\Users\VeraHagge\AppData\Roaming\WinKit Folder Found : C:\Users\VeraHagge\AppData\Roaming\tencent Folder Found : C:\Users\VeraHagge\AppData\Roaming\cpuminer Folder Found : C:\Users\VeraHagge\AppData\Roaming\jellylam Folder Found : C:\Users\VeraHagge\AppData\Roaming\winsta Folder Found : C:\Users\VeraHagge\AppData\Roaming\Winsta Folder Found : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer Folder Found : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???? Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\22JDQ@j.org Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\fIed@2Q.net Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\hRGDtVG@B.org Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\tIxgdvdh@u.org Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com Folder Found : C:\Users\VeraHagge\Documents\DailyPCClean Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\SearchProtect Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\speed browser Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\tencent ***** [ Files ] ***** File Found : C:\Program Files (x86)\Mozilla Firefox\defaults\pref\all-iminent.js File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\StartWeb.xml File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml File Found : C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe File Found : C:\Users\Public\Desktop\slimcleaner plus.lnk File Found : C:\Users\Public\Desktop\driverupdate.lnk File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\istartsurf.xml File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\user.js File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\yahoo.xml File Found : C:\Users\VeraHagge\Desktop\GUPlayer.lnk File Found : C:\WINDOWS\Sysnative\sasnative64.exe File Found : C:\WINDOWS\Sysnative\drivers\fileHiders.sys File Found : C:\WINDOWS\Sysnative\drivers\TFsFltX64.sys File Found : C:\WINDOWS\SysWOW64\SafeAppLM.ocx File Found : C:\WINDOWS\SysWOW64\drivers\TS888x64.sys ***** [ Shortcuts ] ***** Shortcut Infected : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome .lnk ( hxxp://start.iminent.com/?appId=b7672bac-eee2-4450-a0fc-afe69bcdc811&ref=sct ) ***** [ Scheduled tasks ] ***** Task Found : ASP Task Found : Convertor Task Found : WinKit Task Found : WinZipDriverUpdater_UPDATES Task Found : LaunchPreSignup Task Found : DriverMgr Task Found : keepup Task Found : SMWUpd Task Found : Superclean Task Found : Winsta Update Task Found : Shop-wit Updater Task Found : Optscan Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-6 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-7 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5_user Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-11 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-4 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user Task Found : c233af57-2b16-455f-9052-a826317e171a-1-6 Task Found : c233af57-2b16-455f-9052-a826317e171a-1-7 Task Found : c233af57-2b16-455f-9052-a826317e171a-10_user Task Found : c233af57-2b16-455f-9052-a826317e171a-4 Task Found : c233af57-2b16-455f-9052-a826317e171a-5 Task Found : c233af57-2b16-455f-9052-a826317e171a-5_user Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-6 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-7 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5 Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5_user Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-11 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-4 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5 Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user Task Found : c233af57-2b16-455f-9052-a826317e171a-1-6 Task Found : c233af57-2b16-455f-9052-a826317e171a-1-7 Task Found : c233af57-2b16-455f-9052-a826317e171a-10_user Task Found : c233af57-2b16-455f-9052-a826317e171a-4 Task Found : c233af57-2b16-455f-9052-a826317e171a-5 Task Found : c233af57-2b16-455f-9052-a826317e171a-5_user Task Found : SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 Task Found : SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 Task Found : LVKAHSH1 ***** [ Registry ] ***** Key Found : HKCU\Software\Mozilla\Extends Key Found : HKLM\SOFTWARE\CLASSES\Boost.BoostBho.1 Key Found : HKLM\SOFTWARE\CLASSES\Boost.BoostBho Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Boost] Key Found : HKLM\SOFTWARE\Classes\AppID\DownloadProxy.EXE Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SmartWeb] Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DesktopSearch] Value Found : HKLM\SOFTWARE\Classes\.htm\OpenWithProgids [CRSBRWSHTML] Value Found : HKLM\SOFTWARE\Classes\.html\OpenWithProgids [CRSBRWSHTML] Value Found : HKLM\SOFTWARE\RegisteredApplications [Crossbrowse] Key Found : HKLM\SOFTWARE\CLASSES\METNSD Key Found : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP Key Found : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [PCKeeper2] Value Found : HKLM\SOFTWARE\Classes\.xht\OpenWithProgIDs [CRSBRWSHTML] Value Found : HKLM\SOFTWARE\Classes\.webp\OpenWithProgIDs [CRSBRWSHTML] Value Found : HKLM\SOFTWARE\Classes\.shtml\OpenWithProgIDs [CRSBRWSHTML] Key Found : HKLM\SOFTWARE\CLASSES\adTech.adTech.1 Key Found : HKLM\SOFTWARE\CLASSES\adTech.adTech Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mbot_de_012010041] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010041] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [rec_de_57] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010057] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010066] Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DesktopSearch] Key Found : HKLM\SOFTWARE\15256f25-c79f-8bd9-2f30-4c64ad1a4c09 Key Found : HKLM\SOFTWARE\5da059a482fd494db3f252126fbc3d5b Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{1f68291f} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{80b4b4af} Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchffv2@gmail.com] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com] Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [defsearchp@gmail.com] Key Found : HKLM\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{70DE12EA-79F4-46BC-9812-86DB50A2FD64} Key Found : HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19} Key Found : HKLM\SOFTWARE\Classes\CLSID\{6EDBF8C0-C94C-4A13-956F-E393BCA5BA4B} Key Found : HKLM\SOFTWARE\Classes\CLSID\{934B156A-3D17-3981-B78A-5C138F423AD6} Key Found : HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F} Key Found : HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370} Key Found : HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E} Key Found : HKLM\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E860F65C-6645-411C-A662-E12E25FD3A93} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{934B156A-3D17-3981-B78A-5C138F423AD6} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2299856A-6506-42E3-A34F-CD35A47C1B19} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{934B156A-3D17-3981-B78A-5C138F423AD6} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2299856A-6506-42E3-A34F-CD35A47C1B19} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5EC7C511-CD0F-42E6-830C-1BD9882F3458} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1F91A9A1-01BA-4C81-863D-3BA0751E1419} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{934B156A-3D17-3981-B78A-5C138F423AD6} Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{1F91A9A1-01BA-4C81-863D-3BA0751E1419}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{934B156A-3D17-3981-B78A-5C138F423AD6}] Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08} Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19} Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{5CD76C57-6893-478A-B776-47E7C82504BE} Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{934B156A-3D17-3981-B78A-5C138F423AD6} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652} Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{934B156A-3D17-3981-B78A-5C138F423AD6} Key Found : HKU\.DEFAULT\Software\Browser Key Found : HKCU\Software\InstalledBrowserExtensions Key Found : HKCU\Software\MyBestOffersToday Key Found : HKCU\Software\NoVooITSet Key Found : HKCU\Software\Vonteera Safe ads Key Found : HKCU\Software\GAMESDESKTOP Key Found : HKCU\Software\Squeaky Key Found : HKCU\Software\reimagerepair Key Found : HKCU\Software\PRODUCTSETUP Key Found : HKCU\Software\Kromtech Key Found : HKCU\Software\Browser Key Found : HKCU\Software\OffersWizard Key Found : HKCU\Software\DAILYPCCLEAN Key Found : HKCU\Software\AppDataLow\Software\Boost Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} Key Found : HKLM\SOFTWARE\InstalledBrowserExtensions Key Found : HKLM\SOFTWARE\Tutorials Key Found : HKLM\SOFTWARE\Uniblue Key Found : HKLM\SOFTWARE\ORBTR Key Found : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81} Key Found : HKLM\SOFTWARE\AIM Toolbar Key Found : HKLM\SOFTWARE\AdGazelle Key Found : HKLM\SOFTWARE\FFPluginHp Key Found : HKLM\SOFTWARE\ZoomWebLists Key Found : HKLM\SOFTWARE\searchult Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA1838EF-A497-194E-3850-37A62CEE398B} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC} Key Found : [x64] HKCU\Software\InstalledBrowserExtensions Key Found : [x64] HKCU\Software\MyBestOffersToday Key Found : [x64] HKCU\Software\NoVooITSet Key Found : [x64] HKCU\Software\Vonteera Safe ads Key Found : [x64] HKCU\Software\GAMESDESKTOP Key Found : [x64] HKCU\Software\Squeaky Key Found : [x64] HKCU\Software\reimagerepair Key Found : [x64] HKCU\Software\PRODUCTSETUP Key Found : [x64] HKCU\Software\Kromtech Key Found : [x64] HKCU\Software\Browser Key Found : [x64] HKCU\Software\OffersWizard Key Found : [x64] HKCU\Software\DAILYPCCLEAN Key Found : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions Key Found : [x64] HKLM\SOFTWARE\BubbleSound Key Found : [x64] HKLM\SOFTWARE\WebBar Key Found : [x64] HKLM\SOFTWARE\SecurityUtility Key Found : [x64] HKLM\SOFTWARE\Kromtech Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gpuminer Data Found : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.hao123.com/?tn=91800134_hao_pg Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT Data Found : HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Data Found : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.oursurfing.com/?type=sc&ts=1436658449&z=13abf1ab21cdeb884a3e887gdz3c4qbqbweb3z8zdc&from=pjr&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT Data Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\programdata\securityutility\securityutility32.dll ***** [ Web browsers ] ***** [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.defaultenginename", "mystartsearch"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.alias", "istartsurf"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.iconURL", "hxxp://www.istartsurf.com/favicon.ico"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.name", "istartsurf"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.url", "hxxp://www.istartsurf.com/web/?type=ds&ts=1437900925&z=c6a2f3ee8426432ab8bdfa3gcz9cbm7t6ece4beb4c&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searc[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.selectedEngine", "mystartsearch"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hp&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.MdmFGpy6eTjyS0bF.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.ZvqtEhdEa7X79ffG.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.cookie.previous_page.value", "%22hxxp%3A//start.iminent.com/de-DE/newtab/%23ref%3DNewTab%22"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.af04aefc88ba04db5917375513b63d2761c0acb40234c4912b8ce35e3901228adcom57563.57563.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.c[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.af04aefc88ba04db5917375513b63d2761c0acb40234c4912b8ce35e3901228adcom57563.57563.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.crossrider.bic", "14e9ab5d489c8155bf6e8def973422d3"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.fnprTKRPzQ0XbvnL.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.quick_start.enable_search1", false); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.u6FAJmxBVjsYnKmE.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.BirthDate", "1437900771"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.LayoutId", "1"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent._oaZGabJJ8Q_", "{\"cpt\":0,\"cpr\":0,\"s\":0,\"es\":1}"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.adapters", "{\"www.kbdadsfast.com\":{\"CountryCode\":\"DE\",\"NoAds\":false,\"Status\":2,\"AdapterKey\":\"default_adapter\",\"v\":true,\"p\":0,\"t\":1,\"th\":1.1,\"expireTime\":\"14[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.cifs", "1"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.enableToolbar", "true"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.enabledAds", "obsolete"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.externalScripts", "{\"value\":[{\"addonUid\":\"b7110a40-a16f-4a12-a411-bd0b6014905a\",\"name\":\"Superfish\",\"addonId\":2,\"url\":\"//www.best-deals-products.com/ws/sf_main.jsp\",\[...] [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.newtabredirect", "true"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.nomsi", "true"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.searchindex", "1"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.trackExternalScripts14", "1437932654360"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.trackExternalScripts2", "1437932652462"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.version", "9.30.5.1"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.versioning", "{\"CurrentVersion\":\"9.30.5.1\",\"InstallEventCTime\":1438364753062,\"InstallEvent\":\"True\"}"); [C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("keyword.URL", "hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,"); ************************* C:\AdwCleaner[S1].txt - [28960 octets] - [25/08/2015 10:59:46] ########## EOF - C:\AdwCleaner[S1].txt - [29024 octets] ########## AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v5.000 - Logfile created 27/08/2015 at 10:12:13 # Updated 14/08/2015 by Xplode # Database : 2015-08-25.1 [Server] # Operating system : Windows 8.1 Connected (x64) # Username : VeraHagge - BINE-VERA # Running from : C:\Users\VeraHagge\Downloads\antivir\adwcleaner_5.000.exe # Option : Scan ***** [ Services ] ***** ***** [ Folders ] ***** ***** [ Files ] ***** ***** [ Shortcuts ] ***** ***** [ Scheduled tasks ] ***** ***** [ Registry ] ***** ***** [ Web browsers ] ***** ************************* C:\AdwCleaner[C1].txt - [30187 octets] - [25/08/2015 11:01:17] C:\AdwCleaner[C2].txt - [1229 octets] - [25/08/2015 11:33:29] C:\AdwCleaner[C3].txt - [1192 octets] - [26/08/2015 09:47:17] C:\AdwCleaner[S1].txt - [29963 octets] - [25/08/2015 10:59:46] C:\AdwCleaner[S2].txt - [1105 octets] - [25/08/2015 11:08:28] C:\AdwCleaner[S3].txt - [1086 octets] - [26/08/2015 09:45:19] ########## EOF - C:\AdwCleaner[S1].txt - [30153 octets] ########## So, alles gemacht. Für mich war es jetzt einmal wichtig zu erfahren ob auf dem Weg die Restauration von Windows schneller geht als durch eine Neuinstallation und ob ich auch wieder Vertrauen in meinen Rechner habe. Ich finde das ist ein gangbarer Weg und ich bedanke mich sehr. allerdings geht das Windows update nicht mehr |
28.08.2015, 15:37 | #7 |
/// the machine /// TB-Ausbilder | Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastetESET Online Scanner
Downloade Dir bitte SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet |
100%, ausgelastet, browser, browsern, dauert, fenster, große, hilfe, installier, installiere, installieren, neu, neu installieren, nicht mehr, nutze, programme, rechner, schleife, start, suchmaschine, suchmaschinen, windows, wissen, überhaupt, öffnen |