Win 8.1 / Win10 stündlich xx:10 Uhr Popup wie soll linktyp geöffnet werden ->Weiterleitung Werbeseite

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:31-12-2015
durchgeführt von Peter (2016-01-09 14:28:46) Run:2
Gestartet von C:\Users\Peter\Desktop\Anti Malware
Geladene Profile: Peter (Verfügbare Profile: Peter & DefaultAppPool)
Start-Modus: Normal
==============================================

fixlist Inhalt:
*****************
start
CloseProcesses:
DeleteKey: HKLM\SOFTWARE\Classes\AppID\{5e7797ae-5ca1-4b50-95d8-97e746340487}
RemoveProxy:
CMD: ipconfig /flushdns
CMD: netsh winsock reset
EmptyTemp:
end
*****************

Prozess erfolgreich geschlossen.
HKLM\SOFTWARE\Classes\AppID\{5e7797ae-5ca1-4b50-95d8-97e746340487} => konnte nicht entfernt werden im ersten Versuch (ErrorCode: C0000121), siehe nächste Zeile.
HKLM\SOFTWARE\Classes\AppID\{5e7797ae-5ca1-4b50-95d8-97e746340487} => Schlüssel erfolgreich entfernt

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3036239713-1774766366-4091503571-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wert erfolgreich entfernt
HKU\S-1-5-21-3036239713-1774766366-4091503571-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wert erfolgreich entfernt


========= Ende von RemoveProxy: =========


=========  ipconfig /flushdns =========


Windows-IP-Konfiguration

Der DNS-Aufl�sungscache wurde geleert.

========= Ende von CMD: =========


=========  netsh winsock reset =========


Der Winsock-Katalog wurde zur�ckgesetzt.
Sie m�ssen den Computer neu starten, um den Vorgang abzuschlie�en.


========= Ende von CMD: =========

EmptyTemp: => 259.2 MB temporäre Dateien entfernt.


Das System musste neu gestartet werden.

==== Ende von Fixlog 14:28:56 ====
         

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# end=init
# utc_time=2016-01-07 07:59:21
# local_time=2016-01-07 08:59:21 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 27537
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# end=updated
# utc_time=2016-01-07 08:09:51
# local_time=2016-01-07 09:09:51 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# engine=27537
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-01-07 09:49:52
# local_time=2016-01-07 10:49:52 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 23946 6017535 0 0
# scanned=282351
# found=18
# cleaned=0
# scan_time=6000
sh=32ACDC7DE46FB14A2E2230480BE9E0DBFC2FFA05 ft=1 fh=d6364808962b2249 vn="Variante von Win32/Toolbar.Widgi.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\ytd video downloader\ytd_installer.exe.vir"
sh=16E54F243A10629AA0AF4E39FD2FFDC525BA6C94 ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\vudtmujw.default\Extensions\defsearchp@gmail.com\chrome\content\jquery-2.1.0.min.js.vir"
sh=0B6EDE277F9EC5D0B9848885781DCE7F79E42382 ft=1 fh=5b07ce7f608edc1f vn="Variante von Win32/Toolbar.Visicom.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll"
sh=B745063A09BD9B16054C2B4F21BE5EAE5FA24884 ft=1 fh=c034a68ab79e1ac8 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawaretb.dll"
sh=E76EA070AD321DAE71D3A0256FE88E484DCB9FFD ft=1 fh=68d72de984b0597b vn="Variante von Win32/Toolbar.Visicom.C evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\dtUser.exe"
sh=E3FF36778F795CE8EC391147E1B76FA1603D732E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.ACY.gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001dd5"
sh=B16BC42BE35125B7F45B7EE5AFB2366C96E70523 ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.ACY.gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Local\Google\Chrome\User Data\Default\Cache\f_001dda"
sh=E3FF36778F795CE8EC391147E1B76FA1603D732E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.ACY.gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Local\Temp\E6E7.tmp"
sh=4101270357B096EF454463D13581E3D123C60560 ft=1 fh=2a17fddd6cb742ea vn="Variante von Win32/InstallCore.ACL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Local\Temp\in0BD63D63\7176D8A0_stp\RAM.dll"
sh=CE39ABB4EAF9E36B738982F0A37D3BED938B406F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.GL Trojaner" ac=I fn="C:\Users\Peter\AppData\Roaming\ERoot\resource\share\arm\eroot.apk"
sh=CC8274D4CB778527ED9EFE52ACA45C8447B13266 ft=0 fh=0000000000000000 vn="LNK/URL.B Trojaner" ac=I fn="C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Recent\http--jmp2.in-taskmbbackuppclgwarn (2).lnk"
sh=CC8274D4CB778527ED9EFE52ACA45C8447B13266 ft=0 fh=0000000000000000 vn="LNK/URL.B Trojaner" ac=I fn="C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Recent\http--jmp2.in-taskmbbackuppclgwarn (3).lnk"
sh=CC8274D4CB778527ED9EFE52ACA45C8447B13266 ft=0 fh=0000000000000000 vn="LNK/URL.B Trojaner" ac=I fn="C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Recent\http--jmp2.in-taskmbbackuppclgwarn (4).lnk"
sh=CC8274D4CB778527ED9EFE52ACA45C8447B13266 ft=0 fh=0000000000000000 vn="LNK/URL.B Trojaner" ac=I fn="C:\Users\Peter\AppData\Roaming\Microsoft\Windows\Recent\http--jmp2.in-taskmbbackuppclgwarn.lnk"
sh=595A7C6FA27BCAAB889D8F6DFB687597E046C162 ft=0 fh=0000000000000000 vn="Variante von Android/SystemMonitor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Roaming\MyPhoneExplorer\thl T100S [357653011081762]\Cache\external\MyFavorite\BaiduYun_1462239399_1849431000.apk"
sh=C885802C60940C98AD69E7147352CE59189868EA ft=1 fh=92375844a5a83029 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
sh=C885802C60940C98AD69E7147352CE59189868EA ft=1 fh=92375844a5a83029 vn="Variante von Win32/AdkDLLWrapper.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\AppData\Roaming\uTorrent\updates\3.4.0_30635.exe"
sh=E3FF36778F795CE8EC391147E1B76FA1603D732E ft=0 fh=0000000000000000 vn="Variante von Win32/InstallCore.ACY.gen evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Peter\Desktop\install.zip"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# end=init
# utc_time=2016-01-09 01:32:58
# local_time=2016-01-09 02:32:58 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
Update Init
Update Download
Update Finalize
Updated modules version: 27566
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# end=updated
# utc_time=2016-01-09 01:35:20
# local_time=2016-01-09 02:35:20 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# osver=6.2.9200 NT 
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=5eb3c3c162341f45824b1818d7042efb
# engine=27566
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2016-01-09 06:52:26
# local_time=2016-01-09 07:52:26 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.2.9200 NT 
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 79831 6179689 0 0
# scanned=680289
# found=32
# cleaned=0
# scan_time=19025
sh=32ACDC7DE46FB14A2E2230480BE9E0DBFC2FFA05 ft=1 fh=d6364808962b2249 vn="a variant of Win32/Toolbar.Widgi.N potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\ytd video downloader\ytd_installer.exe.vir"
sh=16E54F243A10629AA0AF4E39FD2FFDC525BA6C94 ft=0 fh=0000000000000000 vn="Win32/Toolbar.TNT2.I potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Peter\AppData\Roaming\Mozilla\Firefox\Profiles\vudtmujw.default\Extensions\defsearchp@gmail.com\chrome\content\jquery-2.1.0.min.js.vir"
sh=0B6EDE277F9EC5D0B9848885781DCE7F79E42382 ft=1 fh=5b07ce7f608edc1f vn="a variant of Win32/Toolbar.Visicom.B potentially unwanted application" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawareDx.dll"
sh=B745063A09BD9B16054C2B4F21BE5EAE5FA24884 ft=1 fh=c034a68ab79e1ac8 vn="a variant of Win32/Toolbar.Visicom.A potentially unwanted application" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\adawaretb.dll"
sh=E76EA070AD321DAE71D3A0256FE88E484DCB9FFD ft=1 fh=68d72de984b0597b vn="a variant of Win32/Toolbar.Visicom.C potentially unwanted application" ac=I fn="C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\dtUser.exe"
sh=CE39ABB4EAF9E36B738982F0A37D3BED938B406F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.GL trojan" ac=I fn="C:\Users\Peter\AppData\Roaming\ERoot\resource\share\arm\eroot.apk"
sh=595A7C6FA27BCAAB889D8F6DFB687597E046C162 ft=0 fh=0000000000000000 vn="a variant of Android/SystemMonitor.A potentially unwanted application" ac=I fn="C:\Users\Peter\AppData\Roaming\MyPhoneExplorer\thl T100S [357653011081762]\Cache\external\MyFavorite\BaiduYun_1462239399_1849431000.apk"
sh=C885802C60940C98AD69E7147352CE59189868EA ft=1 fh=92375844a5a83029 vn="a variant of Win32/AdkDLLWrapper.A potentially unwanted application" ac=I fn="C:\Users\Peter\AppData\Roaming\uTorrent\uTorrent.exe"
sh=C885802C60940C98AD69E7147352CE59189868EA ft=1 fh=92375844a5a83029 vn="a variant of Win32/AdkDLLWrapper.A potentially unwanted application" ac=I fn="C:\Users\Peter\AppData\Roaming\uTorrent\updates\3.4.0_30635.exe"
sh=B99A5DC4E2813FB8332EFA3181D4A428C7C7D474 ft=0 fh=0000000000000000 vn="a variant of MSIL/DownloadGuide.A potentially unwanted application" ac=I fn="D:\CHIP-DVD1-0713-203073.iso"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a variant of Win32/Packed.FlyStudio potentially unwanted application" ac=I fn="D:\win7beste version.iso"
sh=B99A5DC4E2813FB8332EFA3181D4A428C7C7D474 ft=0 fh=0000000000000000 vn="a variant of MSIL/DownloadGuide.A potentially unwanted application" ac=I fn="E:\downloads\CHIP-DVD1-0713-203073.iso"
sh=B56E3933AE6C9A23CAD4899D1DF901E25C3710FD ft=1 fh=dfae2e41f5bfbcda vn="a variant of Win32/Ruanmei.A potentially unwanted application" ac=I fn="E:\downloads\pp.exe"
sh=C885802C60940C98AD69E7147352CE59189868EA ft=1 fh=92375844a5a83029 vn="a variant of Win32/AdkDLLWrapper.A potentially unwanted application" ac=I fn="E:\downloads\uTorrent3.4_30635.exe"
sh=E4C06131BB343A2F5D2A009A77AA96FD597EA6F0 ft=0 fh=0000000000000000 vn="Win32/Packed.Autoit.H suspicious application" ac=I fn="E:\downloads\CS\Freetz\ruKernelTool.zip"
sh=2446E82304B2A797346141850D2245916E179BB6 ft=1 fh=4f9fb98a1d8c5ee8 vn="Win32/Packed.Autoit.H suspicious application" ac=I fn="E:\downloads\CS\Freetz\ruKernelTool\ruKernelTool\_Lib_\PrettyPrintFirmwareLinkListe.exe"
sh=E79CE0DA43C79F2A4E48A4F4A02905DE783FBD16 ft=1 fh=a9eb553813c219ce vn="NSIS/StartPage.CC trojan" ac=I fn="E:\downloads\Neue shows\vlc-2.1.4-win64.exe"
sh=B56E3933AE6C9A23CAD4899D1DF901E25C3710FD ft=1 fh=dfae2e41f5bfbcda vn="a variant of Win32/Ruanmei.A potentially unwanted application" ac=I fn="E:\downloads\pp\pp.exe"
sh=2446E82304B2A797346141850D2245916E179BB6 ft=1 fh=4f9fb98a1d8c5ee8 vn="Win32/Packed.Autoit.H suspicious application" ac=I fn="E:\downloads\ruKernelTool\_Lib_\PrettyPrintFirmwareLinkListe.exe"
sh=E79CE0DA43C79F2A4E48A4F4A02905DE783FBD16 ft=1 fh=a9eb553813c219ce vn="NSIS/StartPage.CC trojan" ac=I fn="E:\Neue shows\vlc-2.1.4-win64.exe"
sh=AF77CBF4F019D1F006CC287CBEC142500FB218A8 ft=1 fh=7fe266c1f404d53c vn="a variant of Win32/DownloadSponsor.C potentially unwanted application" ac=I fn="E:\Trash\AniMake - CHIP-Installer.exe"
sh=8C8C75A8CF6FD3482AB5483BCAF8E0BC10E434E9 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP trojan" ac=I fn="E:\Trash\ROOT.rar"
sh=198491EFA1A48EC40305EC51107D298D34EAC0C8 ft=1 fh=f1a3073dae3b16c1 vn="a variant of Win32/DownloadSponsor.C potentially unwanted application" ac=I fn="E:\Trash\TestDisk PhotoRec - CHIP-Installer.exe"
sh=74FACDDF0E4BDB1BDDD53B66488B29C568EF836A ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP trojan" ac=I fn="E:\Trash\ROOT\ROOT\pwn"
sh=07FCFA8D5610AA203CA344A6E12A338D5D834D63 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP trojan" ac=I fn="E:\Trash\write imei\mt6589_rooter.zip"
sh=82C98DFD0E926561F566055553C57293EB93BE7B ft=1 fh=ec67b34d20e7908f vn="multiple threats" ac=I fn="E:\Trash\write imei\Nicht bestätigt 257267.crdownload"
sh=8C8C75A8CF6FD3482AB5483BCAF8E0BC10E434E9 ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP trojan" ac=I fn="E:\Trash\write imei\ROOT.rar"
sh=82C98DFD0E926561F566055553C57293EB93BE7B ft=1 fh=ec67b34d20e7908f vn="multiple threats" ac=I fn="E:\Trash\write imei\SRSRoot-Setup (1).exe"
sh=74FACDDF0E4BDB1BDDD53B66488B29C568EF836A ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.EP trojan" ac=I fn="E:\Trash\write imei\mt6589_rooter\mt6589_rooter\pwn"
sh=37148B45DC4D5586E817E1565A2DCA3BF856FD0B ft=0 fh=0000000000000000 vn="Win32/TrojanDownloader.Delf.BNS trojan" ac=I fn="G:\Downloads\iCloudBypass_Release_0.9.7.rar"
sh=E4C06131BB343A2F5D2A009A77AA96FD597EA6F0 ft=0 fh=0000000000000000 vn="Win32/Packed.Autoit.H suspicious application" ac=I fn="G:\Downloads\CS\Freetz\ruKernelTool.zip"
sh=949591FA5290F31D12F0A6098B86942009ED3BA6 ft=1 fh=8cb8ef78f590e3ad vn="Win32/TrojanDownloader.Delf.BNS trojan" ac=I fn="G:\Downloads\iCloudBypass_Release_0.9.7\setup.exe"