Trojaner-Board - Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods)

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods) (https://www.trojaner-board.de/159934-internetseiten-werbung-oeffnen-automatisch-befall-maleware-hat-sprunghaft-zugenommen-u-a-pup-funmoods.html)

Internetseiten mit Werbung öffnen sich automatisch, "Befall" von Maleware hat sprunghaft zugenommen (u.a.: pup.funmoods)

Hallo,
seit einigen Tagen öffnen sich immer wieder Internetseiten mit Werbung, selbst wenn ich Firefox gar nicht geöffnet habe und die Anzahl der gefundenen Spyware etc. ist rasant angestiegen.
Seit einiger Zeit funktioniert meine WLan Verbindung auch nur noch sporadisch, wobei das Problem schon länger besteht und wahrscheinlich nichts damit zu tun hat?

Mit GMER hatte ich Probleme bei der Ausführung, habe dann den Haken bei Devices entfernt, dann klappte es.

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-10-20 19:32:12

Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB3O 298,09GB

Running: Gmer-19357.exe; Driver: C:\Users\Medion\AppData\Local\Temp\ugriypod.sys
 
 

---- System - GMER 2.1 ----
 

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwClose [0x90B70444]

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwCreateFile [0x90B6FC8A]

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwCreateKey [0x90B6F958]

SSDT   8848F514                                                                                                                ZwCreateMutant

SSDT   88499854                                                                                                                ZwCreateProcess

SSDT   884892E4                                                                                                                ZwCreateProcessEx

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwCreateSection [0x90B71520]

SSDT   8848F4DC                                                                                                                ZwCreateSymbolicLinkObject

SSDT   8848F5BC                                                                                                                ZwCreateThread

SSDT   8848F584                                                                                                                ZwCreateThreadEx

SSDT   8849F2BC                                                                                                                ZwCreateUserProcess

SSDT   8848F38C                                                                                                                ZwDebugActiveProcess

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwDeleteKey [0x90B6FA68]

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwDeleteValueKey [0x90B6FB5A]

SSDT   8848F4A4                                                                                                                ZwDuplicateObject

SSDT   8848F434                                                                                                                ZwGetContextThread

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwLoadDriver [0x90B70780]

SSDT   8848F62C                                                                                                                ZwMapViewOfSection

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwOpenFile [0x90B6FF9C]

SSDT   884A073C                                                                                                                ZwOpenProcess

SSDT   8848F664                                                                                                                ZwOpenSection

SSDT   8849F10C                                                                                                                ZwOpenThread

SSDT   88494694                                                                                                                ZwRenameKey

SSDT   8849465C                                                                                                                ZwRestoreKey

SSDT   8848F3C4                                                                                                                ZwResumeThread

SSDT   8848F3FC                                                                                                                ZwSetContextThread

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwSetInformationFile [0x90B700D2]

SSDT   8848F46C                                                                                                                ZwSetSystemInformation

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwSetValueKey [0x90B6F77E]

SSDT   8848F354                                                                                                                ZwSystemDebugControl

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwTerminateProcess [0x90B706C8]

SSDT   884871C4                                                                                                                ZwTerminateThread

SSDT   \??\C:\Windows\system32\drivers\sp_rsdrv2.sys                                                                           ZwWriteFile [0x90B702BC]

SSDT   8848F5F4                                                                                                                ZwWriteVirtualMemory
 

---- Kernel code sections - GMER 2.1 ----
 

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                                8328DA15 1 Byte  [06]

.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                  832C7212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text  ntkrnlpa.exe!KeRemoveQueueEx + 116F                                                                                     832CE504 4 Bytes  [44, 04, B7, 90] {INC ESP; ADD AL, 0xb7; NOP }

.text  ntkrnlpa.exe!KeRemoveQueueEx + 11AF                                                                                     832CE544 4 Bytes  [8A, FC, B6, 90] {MOV BH, AH; MOV DH, 0x90}

.text  ntkrnlpa.exe!KeRemoveQueueEx + 11BF                                                                                     832CE554 4 Bytes  [58, F9, B6, 90] {POP EAX; STC ; MOV DH, 0x90}

.text  ntkrnlpa.exe!KeRemoveQueueEx + 11CF                                                                                     832CE564 4 Bytes  [14, F5, 48, 88]

.text  ntkrnlpa.exe!KeRemoveQueueEx + 11E3                                                                                     832CE578 8 Bytes  [54, 98, 49, 88, E4, 92, 48, ...]

.text  ...                                                                                                                     
 

---- Registry - GMER 2.1 ----
 

Reg    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active                                      

Reg    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@C5930859                             1851

Reg    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@5C7ED759                             1843

Reg    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CIT\System\Active@93FF0859                             1854

Reg    HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{A68A6F46-602D-11E0-871E-806E6F6E6963}  21560373688
 

---- Disk sectors - GMER 2.1 ----
 

Disk   \Device\Harddisk0\DR0                                                                                                   unknown MBR code
 

---- EOF - GMER 2.1 ----

Anbei auch noch die Log Files von Malwarebytes der letzens vier Tage (immer wieder pup.FunMoods)
und die Ergebnisse der letzen Suche meines Antivirenprogramms Trend Micro, sowie die Spyware und Virenfunde der letzten Monate (da es so viel ist, muss ich es leider als Datei anhängen).
Ich bedanke mich jetzt schon mal für die Geduld und Hilfe von euch :dankeschoen:

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hi Schrauber,
hier die Filelogs vom FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-10-2014

Ran by Miriam II (ATTENTION: The logged in user is not administrator) on MEDION-PC on 20-10-2014 17:04:42

Running from C:\Users\Miriam II\Downloads

Loaded Profile: Miriam II (Available profiles: Medion & Finn & Miriam II)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

() C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-Agent.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe

() C:\Program Files\fst_de_76\fst_de_76.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(APN) C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe

(1&1 Mail & Media GmbH) C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

(Google) C:\Program Files\Google\Drive\googledrivesync.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM\...\Run: [Ocs_SM] => C:\Users\Medion\AppData\Roaming\OCS\SM\SearchAnonymizer.exe

HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)

HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)

HKLM\...\Run: [fst_de_76] => C:\Program Files\fst_de_76\fst_de_76.exe [3974112 2014-07-01] ()

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

HKLM\...\Run: [ApnTBMon] => C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1942424 2014-09-22] (APN)

HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKLM\...\RunOnce: [upfst_de_76.exe] => C:\Users\Medion\AppData\Local\fst_de_76\upfst_de_76.exe [3353080 2014-07-01] ()

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [SpywareTerminatorUpdate] => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [792576 2014-06-04] (1&1 Mail & Media GmbH)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [1und1DispatcherCorp] => C:\Users\Miriam II\AppData\Local\1und1UpdaterCorpE\SchedDispatcher.exe [220808 2013-05-29] (1&1 Mail & Media GmbH)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb65-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb86-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {b636cf64-b326-11e1-b7d9-00262dbfe53b} - F:\AutoRun.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\Users\Miriam II\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Miriam II\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

BootExecute: autocheck autochk * sdnclean.exe

GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.medion.com

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://medion.msn.com

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1399044617&from=wld&uid=HitachiXHTS545032B9A300_100404PBNC001YJM8BXSX&q={searchTerms}

SearchScopes: HKLM - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdjHzygkyNWQHqjF8aaSY_ZQGichEhnzLz-bC0AL9y9ID8zMoHkmqvoqs3uT9BQRQnVIXGBa6ZLqMzq5OBrtaEqnPCo_nY6sCgYm9VQvjlVTfBWjHrbkNQ,,&q={searchTerms}

SearchScopes: HKLM - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdjHzygkyNWQHqjF8aaSY_ZQGichEhnzLz-bC0AL9y9ID8zMoHkmqvoqs3uT9BQRQnVIXGBa6ZLqMzq5OBrtaEqnPCo_nY6sCgYm9VQvjlVTfBWjHrbkNQ,,&q={searchTerms}

SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={8C39A798-654B-4DBB-A405-B51541FC5E32}&mid=7d4b16a558d047d6b19ed16f6b5b0cc8-f2b269effa754ae9f58378cbb5609b05236812b2&lang=de&ds=AVG&pr=fr&d=2012-10-10 18:14:44&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

BHO: Yahoo Community Smartbar (by Linkury)Engine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

BHO: PriceSparrow -> {3F2DC1E7-A56F-49D8-B0CF-DB2300594497} -> C:\Program Files\PriceSparrow\Internet Explorer\pricesparrow.dll ()

BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: No Name -> {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} ->  No File

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Toolbar: HKLM - No Name - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} -  No File

Toolbar: HKCU - No Name - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} -  No File

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - No Name - {32B29DF0-2237-4370-9A29-37CEBB730E9B} -  No File

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563

FF DefaultSearchEngine: Ecosia

FF SelectedSearchEngine: Ecosia

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\11-suche.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ask-search.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ecosia.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\englische-ergebnisse.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\gmx-suche.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\lastminute.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\Web Search.xml

FF SearchPlugin: C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\webde-suche.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\sweet-page.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\2020Player_IKEA@2020Technologies.com [2014-06-19]

FF Extension: WEB.DE Club MailCheck - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\toolbar@web.de.xpi [2014-05-17]

FF Extension: NoScript - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-05-17]

FF Extension: Ecosia — The search engine that plants trees! - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{d04b0b40-3dab-4f0b-97a6-04ec3eddbfb0}.xpi [2014-10-18]

FF Extension: Adblock Plus - C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-17]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]

FF HKLM\...\Firefox\Extensions: [dnshelp@dnshelp.com] - C:\Users\Finn.Medion-PC\AppData\Roaming\Helper

FF Extension: No Name - C:\Users\Finn.Medion-PC\AppData\Roaming\Helper [2014-02-10]

FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\quick_start@gmail.com

FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]

FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension

FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]

FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]
 

Chrome: 

=======

CHR Profile: C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Docs) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-04]

CHR Extension: (Google Drive) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-04]

CHR Extension: (YouTube) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-04]

CHR Extension: (Google-Suche) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-04]

CHR Extension: (PriceSparrow) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm [2014-10-04]

CHR Extension: (Google Mail) - C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-04]

CHR HKLM\...\Chrome\Extension: [bbjciahceamgodcoidkjpchnokgfpphh] - C:\Users\Medion\AppData\Local\funmoods_2.3.1.crx [2014-09-03]

CHR HKLM\...\Chrome\Extension: [cjpglkicenollcignonpgiafdgfeehoj] - C:\Users\Medion\AppData\Local\funmoods-speeddial.crx [2014-09-03]

CHR HKLM\...\Chrome\Extension: [kljkanaekoongefljnjbghkgjjocmikm] - C:\Program Files\PriceSparrow\Chrome\pricesparrow-1.4.9.crx [2013-03-11]

CHR HKLM\...\Chrome\Extension: [knkakpihealnpggeceajhaonlmgdkaip] - C:\Users\Medion\AppData\Local\Temp\tbch.crx [2013-03-11]

CHR HKLM\...\Chrome\Extension: [mkcedibhemacmilmkpndpkoidlnmgngg] - C:\Users\Medion\ChromeExtensions\mkcedibhemacmilmkpndpkoidlnmgngg\amazon.crx [2013-03-11]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AddonsHelper; C:\Users\Medion\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [896512 2014-02-10] () [File not signed]

R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166296 2014-09-22] (APN LLC.)

R2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [36936 2014-09-18] (Just Develop It) <==== ATTENTION

S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]

S2 globalUpdate; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-02] (globalUpdate) [File not signed]

S3 globalUpdatem; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-02] (globalUpdate) [File not signed]

R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S2 KMService; C:\Windows\system32\srvany.exe [8192 2003-04-18] () [File not signed]

R2 lmhosts; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NewPlayerUpdaterService; C:\Program Files\NewPlayer\NewPlayerUpdaterService.exe [11776 2014-05-05] () [File not signed]

R2 NlaSvc; C:\Windows\System32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

R2 nsi; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)

R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]

R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)

R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)

R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)

R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)

R2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [1598128 2013-06-27] (AVG Secure Search)

S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]

R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]

R2 bupService; C:\Users\Medion\AppData\Roaming\BupSystem\bup.exe [X]

S4 LPTSystemUpdater;  [X] <==== ATTENTION

R2 SearchAnonymizer; "C:\Users\Medion\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe" [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)

R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)

R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)

S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)

R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)

R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)

R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)

R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)

R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)

R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]

U2 TMAgent; No ImagePath

S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]

S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-20 17:04 - 2014-10-20 17:05 - 00030264 _____ () C:\Users\Miriam II\Downloads\FRST.txt

2014-10-20 11:46 - 2014-10-20 17:04 - 00000000 ____D () C:\FRST

2014-10-20 11:44 - 2014-10-20 11:44 - 01102848 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe

2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log

2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable

2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe

2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe

2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys

2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action

2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim

2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-20 17:04 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-20 17:04 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-20 17:02 - 2014-09-03 17:02 - 00000296 _____ () C:\Windows\Tasks\Funmoods.job

2014-10-20 17:00 - 2011-04-06 10:26 - 01850252 _____ () C:\Windows\WindowsUpdate.log

2014-10-20 16:56 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive

2014-10-20 16:55 - 2014-08-20 19:46 - 00065536 _____ () C:\Windows\system32\Ikeext.etl

2014-10-20 16:55 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub

2014-10-20 16:55 - 2014-07-17 22:09 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-20 16:55 - 2014-07-02 17:54 - 00000876 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job

2014-10-20 16:54 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-20 16:54 - 2009-07-14 06:39 - 00177123 _____ () C:\Windows\setupact.log

2014-10-20 16:34 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam

2014-10-20 16:32 - 2014-07-17 22:09 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-20 16:32 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-20 16:32 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing

2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion

2014-10-20 11:31 - 2014-05-02 17:31 - 00000000 ____D () C:\Program Files\SupTab

2014-10-20 11:22 - 2014-07-02 17:57 - 00000000 ____D () C:\Program Files\LPT

2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-10-19 23:41 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans

2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2

2014-10-18 21:45 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache

2014-10-18 16:50 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype

2014-10-18 16:36 - 2014-07-02 17:54 - 00000000 ____D () C:\Users\Medion\AppData\Local\fst_de_76

2014-10-17 17:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe

2014-10-17 16:57 - 2014-07-02 17:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\LPT

2014-10-17 16:47 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator

2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-14 00:28 - 2014-05-02 17:19 - 00000000 ____D () C:\Program Files\MyPC Backup

2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-10-03 06:57 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub

2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment

2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam

2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft

2014-09-25 20:21 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-09-22 07:59 - 2014-09-07 21:20 - 00000000 ____D () C:\FreeOCR
 

Files to move or delete:

====================

C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
 
 

Some content of TEMP:

====================

C:\Users\Medion\AppData\Local\temp\0acncs1a.eea.exe

C:\Users\Medion\AppData\Local\temp\1sv0noim.wxt.exe

C:\Users\Medion\AppData\Local\temp\amazonicon_v4.exe

C:\Users\Medion\AppData\Local\temp\amazoninstallernircmdc.exe

C:\Users\Medion\AppData\Local\temp\APNSetup.exe

C:\Users\Medion\AppData\Local\temp\awtcmhrt.uzg.exe

C:\Users\Medion\AppData\Local\temp\BackupSetup.exe

C:\Users\Medion\AppData\Local\temp\dlLogic.exe

C:\Users\Medion\AppData\Local\temp\dltr.exe

C:\Users\Medion\AppData\Local\temp\erb3vygz.wnz.exe

C:\Users\Medion\AppData\Local\temp\foxy_security_games.exe

C:\Users\Medion\AppData\Local\temp\GCVerifier.dll

C:\Users\Medion\AppData\Local\temp\iodhz2td.rks.exe

C:\Users\Medion\AppData\Local\temp\sdanircmdc.exe

C:\Users\Medion\AppData\Local\temp\sdapskill.exe

C:\Users\Medion\AppData\Local\temp\sdaspwn.exe

C:\Users\Medion\AppData\Local\temp\sdyfmtve.0ap.exe

C:\Users\Medion\AppData\Local\temp\SkypeSetup.exe

C:\Users\Medion\AppData\Local\temp\sweetpage_294wld.exe

C:\Users\Medion\AppData\Local\temp\Uni000.exe

C:\Users\Medion\AppData\Local\temp\vdoiuwkh.d1k.exe

C:\Users\Medion\AppData\Local\temp\verifier.exe

C:\Users\Medion\AppData\Local\temp\vfxpnvpx.lx3.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-10-2014

Ran by Miriam II at 2014-10-20 17:06:25

Running from C:\Users\Miriam II\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Trend Micro Titanium Maximum Security (Enabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Trend Micro Titanium Maximum Security (Enabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

32 Bit HP CIO Components Installer (Version: 7.1.8 - Hewlett-Packard) Hidden

Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.9.0.1210 - Adobe Systems Incorporated)

Adobe AIR (Version: 3.9.0.1210 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.09) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)

Advanced Disk Recovery (HKLM\...\{2AA44AF4-C116-4219-B800-4573E7E6D421}_is1) (Version: 2.5.500.15827 - Systweak Software)

Amazon MP3-Downloader 1.0.17 (HKLM\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)

Apple Application Support (HKLM\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{941B4CE7-3F5D-443E-A8B7-56A420D2EAFD}) (Version: 7.1.2.6 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Audacity 1.2.6 (HKLM\...\Audacity_is1) (Version:  - )

AudibleManager (HKLM\...\AudibleManager) (Version: 2008373984.48.56.10227058 - Audible, Inc.)

Avidemux 2.5 (HKLM\...\Avidemux 2.5) (Version: 2.5.4.6714 - )

B110 (Version: 140.0.283.000 - Hewlett-Packard) Hidden

Battle.net (HKLM\...\Battle.net) (Version:  - Blizzard Entertainment)

BF Leselernprogramme 2.0 (HKLM\...\BFLeseDemo) (Version:  - )

BF Mathelernprogramme 2.0 (HKLM\...\BFMatheDemo) (Version:  - )

BlueStacks App Player (HKLM\...\BlueStacks App Player) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)

BlueStacks Notification Center (HKLM\...\{FE5ABB0E-EDEA-4023-B0FB-9DEA39A98D76}) (Version: 0.8.7.3069 - BlueStack Systems, Inc.)

Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)

Brick-Force  (HKLM\...\Brick-Force) (Version:  - Infernum Productions AG)

Browser App (HKLM\...\Browser App) (Version: 1.34.7.1 - app)

BufferChm (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Call of Duty: Ghosts - Multiplayer (HKLM\...\Steam App 209170) (Version:  - Infinity Ward)

CHIP Updater (HKLM\...\CHIP Updater_is1) (Version: 2.32 - Abelssoft)

Cisco EAP-FAST Module (HKLM\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)

Cisco LEAP Module (HKLM\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)

Cisco PEAP Module (HKLM\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)

Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2602 - CyberLink Corp.)

CyberLink LabelPrint (Version: 2.5.2602 - CyberLink Corp.) Hidden

CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)

CyberLink Power2Go (Version: 6.1.3602c - CyberLink Corp.) Hidden

CyberLink PowerDVD Copy (HKLM\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)

CyberLink PowerDVD Copy (Version: 1.5.1306 - CyberLink Corp.) Hidden

CyberLink YouCam (HKLM\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2609 - CyberLink Corp.)

CyberLink YouCam (Version: 3.0.2609 - CyberLink Corp.) Hidden

D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden

Desktop Icon für Amazon (HKLM\...\DesktopIconAmazon) (Version: 1.0.1 (de) - CHIP.de)

Destinations (Version: 140.0.77.000 - Hewlett-Packard) Hidden

DeviceDiscovery (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Diablo III (HKLM\...\Diablo III) (Version:  - Blizzard Entertainment)

Driver Support (HKLM\...\{597FB4A5-DD86-4316-A410-7E8074CC2CCE}) (Version: 8.1 - Driver Support)

Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)

ElsterFormular für Privatanwender (HKLM\...\ElsterFormular für Privatanwender 12.2.1.6570p) (Version: 12.2.1.6570p - Landesfinanzdirektion Thüringen)

Fiesta Online DE (HKCU\...\fiestaonline_de) (Version:  - )

Finger Sensing Pad Driver (HKLM\...\{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}) (Version: 8.5.4.0 - Sentelic)

Fotogalerie (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Free Sound Recorder v9.2.7 (HKLM\...\Free Sound Recorder_is1) (Version:  - Copyright(C) 2005-2011 FreeSoundRecorder Technologies, Inc.)

Free YouTube to MP3 Converter version 3.11.34.1015 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.34.1015 - DVDVideoSoft Ltd.)

FreeOCR v5.0 (HKLM\...\freeocr_is1) (Version:  - )

Funmoods (HKLM\...\funmoods) (Version:  - Funmoods) <==== ATTENTION

G DATA Logox4 Speechengine (HKLM\...\lgx4.lgx.server) (Version:  - G DATA Software AG)

GIMP 2.8.6 (HKLM\...\GIMP-2_is1) (Version: 2.8.6 - The GIMP Team)

Google Chrome (HKLM\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)

Google Drive (HKLM\...\{C6640705-7479-4EE5-BC86-879F05F65E74}) (Version: 1.17.7290.4094 - Google, Inc.)

Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden

GPBaseService2 (Version: 140.0.211.000 - Hewlett-Packard) Hidden

Happy Cloud Client (HKCU\...\HappyCloud) (Version: 4.42 - Happy Cloud, Inc.)

Hewlett-Packard ACLM.NET v1.1.0.0 (Version: 1.00.0000 - Hewlett-Packard) Hidden

HotPotatoes v 6.3.0.5 (HKLM\...\hotpot_is1) (Version:  - HalfBaked)

HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)

HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)

HP Photosmart Wireless B110 All-In-One Driver Software 14.0 Rel. 7 (HKLM\...\{59C83C08-63F4-4AEC-81D6-392C5E23B843}) (Version: 14.0 - HP)

HP Product Detection (HKLM\...\{A436F67F-687E-4736-BD2B-537121A804CF}) (Version: 11.14.0001 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)

HP Update (HKLM\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)

HPAppStudio (Version: 140.0.95.000 - Hewlett-Packard) Hidden

HPDiagnosticAlert (Version: 1.00.0000 - Microsoft) Hidden

HPPhotoGadget (Version: 140.0.524.000 - Hewlett-Packard) Hidden

HPProductAssistant (Version: 140.0.212.000 - Hewlett-Packard) Hidden

HPSSupply (Version: 140.0.211.000 - Hewlett-Packard) Hidden

HTC Driver Installer (HKLM\...\{4CEEE5D0-F905-4688-B9F9-ECC710507796}) (Version: 4.13.0.003 - HTC Corporation)

HTC Sync Manager (HKLM\...\{231D0C79-98A6-4693-A366-36DE7D7346EC}) (Version: 3.1.24.5 - HTC)

HUAWEI DataCard Driver 4.20.12.00 (HKLM\...\HUAWEI DataCard Driver) (Version: 4.20.12.00 - Huawei technologies Co., Ltd.)

iCF Skin Pack (HKLM\...\iCF Skin Pack) (Version:  - )

iCloud (HKLM\...\{00A61104-74B5-4056-AD00-4397EF4FB141}) (Version: 3.1.0.40 - Apple Inc.)

iColorFolder (HKLM\...\iColorFolder) (Version:  - )

IDS Intelligence and Development Scales (HKLM\...\{5093E76B-8BCB-49BA-8AC5-4018D307C771}) (Version: 1.0.0.1 - Verlag Hans Huber, Hogrefe AG, Bern)

IDT Audio (HKLM\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6208.0 - IDT)

Installer (HKLM\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION

Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.2302 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.0.1014 - Intel Corporation)

Intel(R) TV Wizard (HKLM\...\TVWiz) (Version:  - Intel Corporation)

IPTInstaller (HKLM\...\{08208143-777D-4A06-BB54-71BF0AD1BB70}) (Version: 4.0.9 - HTC)

iTunes (HKLM\...\{0A37EE62-9A58-420D-90CC-4E52153112EE}) (Version: 11.3.0.54 - Apple Inc.)

Java 7 Update 67 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)

Java Auto Updater (Version: 2.1.67.1 - Oracle, Inc.) Hidden

JMicron Flash Media Controller Driver (HKLM\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.32.1 - JMicron Technology Corp.)

Junk Mail filter update (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Launch Manager V1.5.0.5 (HKLM\...\{D0846526-66DD-4DC9-A02C-98F9A2806812}) (Version: 1.5.0.5 - Wistron Corp.)

Lesehaus (HKLM\...\InstallShield_{BDADFC84-14B9-4D54-BC34-BD33A7530B00}) (Version: 1.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH)

Lesehaus (Version: 1.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH) Hidden

LPT System Updater Service (Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION

Lurs-Minimator (HKLM\...\Lurs-Minimator) (Version: 1.0 - LegaKids)

Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)

MarketResearch (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 11.24.5.3 - Marvell)

Medion Home Cinema (HKLM\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.1318 - CyberLink Corp.)

Medion Home Cinema (Version: 8.0.1318 - CyberLink Corp.) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Office Live Add-in 1.4 (HKLM\...\{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}) (Version: 2.0.3008.0 - Microsoft Corporation)

Microsoft Office Outlook Connector (HKLM\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)

Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)

Microsoft Outlook Social Connector Provider for Facebook 32-bit (HKLM\...\{95140000-007C-0409-0000-0000000FF1CE}) (Version: 14.0.5117.5000 - Microsoft Corporation)

Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [DEU] (HKLM\...\{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU) (Version: 10.0.40303 - Microsoft Corporation)

Microsoft Works (HKLM\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)

Mobile Connection Manager (HKLM\...\o2DE) (Version:  - Mobile Connection Manager)

MobileMe Control Panel (HKLM\...\{5A9AA2C0-972F-4239-AA41-E409434194D5}) (Version: 3.1.8.0 - Apple Inc.)

Movie Maker (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Mozilla Firefox 32.0.3 (x86 de) (HKLM\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)

Mozilla Thunderbird 17.0 (x86 de) (HKLM\...\Mozilla Thunderbird 17.0 (x86 de)) (Version: 17.0 - Mozilla)

MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT110 (Version: 16.4.1108.0727 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MyPC Backup  (HKLM\...\MyPC Backup) (Version:  - JDi Backup Ltd) <==== ATTENTION

Network (Version: 140.0.215.000 - Hewlett-Packard) Hidden

NewPlayer (HKLM\...\NewPlayer) (Version: v2.1.1.9 - ) <==== ATTENTION

OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden

Open It! (HKLM\...\OpenIt Open It!) (Version: 1.1.1 - OpenIt)

PC Connectivity Solution (HKLM\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)

PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.5.0 - Frank Heindörfer, Philip Chinery)

phase-6 2.3.4 (HKLM\...\phase-6) (Version: 2.3.4 - phase-6)

Photo Gallery (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)

PriceSparrow (HKLM\...\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}) (Version: 1.4.9 - Ciuvo GmbH) <==== ATTENTION

PS_AIO_07_B110_SW_Min (Version: 140.0.142.000 - Hewlett-Packard) Hidden

QuickTransfer (Version: 140.0.98.000 - Hewlett-Packard) Hidden

REALTEK Wireless LAN Driver (HKLM\...\{9D3D8C60-A55F-4fed-B2B9-173F09590E16}) (Version: 1.00.0148 - REALTEK Semiconductor Corp.)

SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version:  - )

Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version:  - )

SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version:  - )

Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )

SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version:  - )

SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version:  - )

Samsung New PC Studio (HKLM\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)

Samsung New PC Studio (Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version:  - )

SamsungConnectivityCableDriver (HKLM\...\{7E84FAC8-C518-40F9-9807-7455301D6D25}) (Version: 6.83.6.2.1 - Samsung)

Scan (Version: 140.0.80.000 - Hewlett-Packard) Hidden

ScarletBlade (HKLM\...\ScarletBlade) (Version:  - )

SearchAnonymizer (HKLM\...\SearchAnonymizer) (Version: 1.0.1 (de) - )

Secunia PSI (3.0.0.7011) (HKLM\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)

Securita Scout (HKLM\...\Securita Scout) (Version:  - ) <==== ATTENTION

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)

Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (Version:  - Microsoft) Hidden

Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)

Shopping App by Ask (HKLM\...\{4F524A2D-5354-2D53-5045-A758B70C0F05}) (Version: 12.15.5.31 - APN, LLC)

simfy (HKLM\...\Simfy) (Version: 1.6.10 - simfy AG)

simfy (Version: 1.6.10 - simfy AG) Hidden

Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)

SMART Common Files (HKLM\...\{BBA07B40-F7C6-44F7-BF08-767F8835685F}) (Version: 11.4.194.0 - SMART Technologies ULC)

SMART German Language Pack (HKLM\...\{603E8F13-20D9-4367-81F2-CF6E22D05DA9}) (Version: 11.3.29.0 - SMART Technologies ULC)

SMART Ink (HKLM\...\{5ABC49B5-D0DC-428D-A082-4AEFF6490F04}) (Version: 2.0.720.0 - SMART Technologies ULC)

SMART Notebook (HKLM\...\{E57F6C8B-E159-477E-93BF-764759747BC4}) (Version: 11.3.857.0 - SMART Technologies ULC)

SMART Product Update (HKLM\...\{8D4B716A-0ABE-4238-9090-D208E5F57A5E}) (Version: 5.0.108.0 - SMART Technologies ULC)

SMART Produkttreiber (HKLM\...\{589B09F5-0768-4BE9-B8C0-DD253E6B3643}) (Version: 11.3.550.0 - SMART Technologies ULC)

SmartTools Publishing • Word Falz & Lochmarken-Assistent (HKLM\...\SmartToolsFalz & Lochmarken-Assistentv6.50) (Version: v6.50 - SmartTools Publishing)

SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (Version: 140.0.214.000 - Hewlett-Packard) Hidden

Spyware Terminator 2012 (HKLM\...\{56736259-613E-4A3B-B428-6235F2E76F44}_is1) (Version: 3.0.0.82 - Crawler.com)

Status (Version: 140.0.256.000 - Hewlett-Packard) Hidden

Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)

The Elder Scrolls V: Skyrim (HKLM\...\Steam App 72850) (Version:  - Bethesda Game Studios)

The Sea App (Internet Explorer)  (HKLM\...\The Sea App) (Version:  - Growth Systems, LLC) <==== ATTENTION

TomTom HOME (HKLM\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)

TomTom HOME Visual Studio Merge Modules (HKLM\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)

Toolbox (Version: 140.0.428.000 - Hewlett-Packard) Hidden

TrayApp (Version: 140.0.212.000 - Hewlett-Packard) Hidden

Trend Micro Titanium (Version: 7.0 - Trend Micro Inc.) Hidden

Trend Micro Titanium Maximum Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 7.0 - Trend Micro Inc.)

VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)

VoiceOver Kit (HKLM\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)

WEB.DE Club SmartFax (HKLM\...\WEB.DE Club SmartFax) (Version: 2.00.223 - WEB.DE GmbH)

WEB.DE Online-Speicher 1.7.3288.0 (HKCU\...\WEB.DE Application {sync-000021}) (Version: 1.7.3288.0 - 1&1 Mail & Media GmbH)

WEB.DE Softwareaktualisierung CE (HKCU\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.1.1 - 1&1 Mail & Media GmbH)

WebReg (Version: 140.0.212.017 - Hewlett-Packard) Hidden

Winamp (HKLM\...\Winamp) (Version: 5.63  - Nullsoft, Inc)

Windows Live Communications Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

Windows Live Essentials (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Family Safety (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden

Windows Live Installer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Mail (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Messenger (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Photo Common (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live SOXE (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)

Windows Live UX Platform (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Writer (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows Live Writer Resources (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden

Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0) (HKLM\...\3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F) (Version: 10/12/2007 6.85.4.0 - Nokia)

WinPatrol (HKLM\...\{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}) (Version: 28.5.2013.0 - BillP Studios)

WinRAR 5.10 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)

Yahoo Community Smartbar (HKLM\...\{3BC7022B-CDE0-4664-9AB6-E3EC25CE644A}) (Version: 11.63.66.17714 - Linkury Inc.) <==== ATTENTION
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

Could not list Restore Points. Check "winmgmt" service or repair WMI.
 
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:04 - 2013-07-23 13:41 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?

Task: C:\Windows\Tasks\AllmyappsUpdateTask.job => ?

Task: C:\Windows\Tasks\Funmoods.job => ?

Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => ? <==== ATTENTION

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
 

==================== Loaded Modules (whitelisted) =============
 

2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF

2014-08-06 13:42 - 2014-08-06 13:42 - 00821600 _____ () C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe

2014-05-14 21:58 - 2013-01-16 03:50 - 00039424 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc110-mt-1_49.dll

2014-05-14 21:58 - 2013-01-16 03:55 - 00049152 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc110-mt-1_49.dll

2014-05-15 17:59 - 2013-12-18 15:33 - 00047784 _____ () C:\Program Files\Trend Micro\Titanium\plugin\fcMsgDispatcher.dll

2014-07-02 17:54 - 2014-07-01 13:17 - 03974112 _____ () C:\Program Files\fst_de_76\fst_de_76.exe

2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll

2014-02-06 01:52 - 2014-02-06 01:52 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll

2014-08-13 13:30 - 2013-08-29 09:58 - 00882584 _____ () C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\WLMailApiCore.dll

2014-10-20 16:55 - 2014-10-20 16:55 - 00098816 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32api.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00110080 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pywintypes27.dll

2014-10-20 16:55 - 2014-10-20 16:55 - 00364544 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pythoncom27.dll

2014-10-20 16:55 - 2014-10-20 16:55 - 00045568 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_socket.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 01160704 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_ssl.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00320512 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32com.shell.shell.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00713216 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_hashlib.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 01175040 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._core_.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00805888 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._gdi_.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00811008 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._windows_.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 01062400 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._controls_.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00735232 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._misc_.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00128512 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_elementtree.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00127488 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pyexpat.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00557056 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\pysqlite2._sqlite.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00007168 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\hashobjs_ext.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00087552 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_ctypes.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00119808 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32file.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00108544 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32security.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00018432 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32event.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00038912 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32inet.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00070656 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._html2.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00167936 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32gui.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00011264 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32crypt.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00027136 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\_multiprocessing.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00686080 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\unicodedata.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00122368 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._wizard.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00010240 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\select.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00024064 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32pipe.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00025600 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32pdh.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00525640 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\windows._lib_cacheinvalidation.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00035840 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32process.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00017408 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32profile.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00022528 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\win32ts.pyd

2014-10-20 16:55 - 2014-10-20 16:55 - 00078336 _____ () C:\Users\Miriam II\AppData\Local\temp\_MEI44642\wx._animate.pyd

2014-08-03 21:18 - 2014-09-27 02:23 - 03715184 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2014-05-14 21:51 - 2013-07-23 17:28 - 00039424 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_date_time-vc110-mt-1_49.dll

2014-05-14 21:51 - 2013-07-23 17:28 - 00049152 _____ () C:\Program Files\Trend Micro\Titanium\UIFramework\boost_thread-vc110-mt-1_49.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Temp:5C321E34
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: CLMLServer => "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

MSCONFIG\startupreg: HotkeyApp => "C:\Program Files\Launch Manager\HotkeyApp.exe"

MSCONFIG\startupreg: LMgrVolOSD => "C:\Program Files\Launch Manager\OSD.exe"

MSCONFIG\startupreg: sbsdk-server => "C:\Program Files\SMART Technologies\Education Software\sbsdk-server\NodeLauncher.exe"

MSCONFIG\startupreg: SMART Board Service => "C:\Program Files\SMART Technologies\Education Software\SMARTBoardService.exe" -d

MSCONFIG\startupreg: SMART Floating Tools => "C:\Program Files\SMART Technologies\Education Software\FloatingTools.exe"

MSCONFIG\startupreg: SMART Ink => "C:\Program Files\SMART Technologies\Education Software\SMARTInk.exe" -a

MSCONFIG\startupreg: SMART Tray Tools => "C:\Program Files\SMART Technologies\Education Software\SMARTTrayIcon.exe"

MSCONFIG\startupreg: SMARTNotification => "C:\Program Files\SMART Technologies\Education Software\SMARTNotification.exe"

MSCONFIG\startupreg: Wbutton => "C:\Program Files\Launch Manager\Wbutton.exe"

MSCONFIG\startupreg: WinampAgent => "C:\Program Files\Winamp\winampa.exe"
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-634998973-2183486359-2024787897-500 - Administrator - Disabled)

Finn (S-1-5-21-634998973-2183486359-2024787897-1003 - Limited - Enabled) => C:\Users\Finn.Medion-PC

Gast (S-1-5-21-634998973-2183486359-2024787897-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-634998973-2183486359-2024787897-1002 - Limited - Enabled)

Medion (S-1-5-21-634998973-2183486359-2024787897-1000 - Administrator - Enabled) => C:\Users\Medion

Miriam II (S-1-5-21-634998973-2183486359-2024787897-1004 - Limited - Enabled) => C:\Users\Miriam II
 

==================== Faulty Device Manager Devices =============
 

Name: Photosmart B110 series

Description: Photosmart B110 series

Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}

Manufacturer: HP

Service: 

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: SMART Virtual TabletPC

Description: SMART Virtual TabletPC

Class Guid: {745a17a0-74d3-11d0-b6fe-00a0c90f57da}

Manufacturer: SMART Technologies ULC

Service: SMARTVTabletPCx86

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 

Name: Photosmart B110 series

Description: Photosmart B110 series

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: HP

Service: StillCam

Problem: : This device is disabled. (Code 22)

Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (10/20/2014 04:55:18 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1192846
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1192846
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 21762
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 21762
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 20733
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 20733
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

System errors:

=============

Error: (10/20/2014 04:55:18 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 

Error: (10/20/2014 04:54:51 PM) (Source: EventLog) (EventID: 6008) (User: )

Description: Das System wurde zuvor am ‎20.‎10.‎2014 um 16:36:47 unerwartet heruntergefahren.
 

Error: (10/20/2014 04:32:43 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
 

Error: (10/20/2014 01:14:50 PM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "O2BOX",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{1246FD9E-6FC8-4FDD-A385-0B718CE4076E-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 

Error: (10/20/2014 10:47:25 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 

Error: (10/20/2014 00:37:39 AM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 

Error: (10/19/2014 11:36:44 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 

Error: (10/19/2014 09:31:13 PM) (Source: bowser) (EventID: 8003) (User: )

Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "O2BOX",

der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{1246FD9E-6FC8-4FDD-A385-0B718CE4076E-Transport zu sein scheint.

Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
 

Error: (10/19/2014 08:30:33 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "Windows Search" wurde nicht richtig gestartet.
 

Error: (10/19/2014 08:25:29 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 
 

Microsoft Office Sessions:

=========================

Error: (10/20/2014 04:55:18 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1192846
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1192846
 

Error: (10/20/2014 04:32:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 21762
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 21762
 

Error: (10/20/2014 04:12:29 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 20733
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 20733
 

Error: (10/20/2014 04:12:28 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 
 

CodeIntegrity Errors:

===================================

  Date: 2013-07-08 01:02:14.997

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:14.717

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:14.447

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:14.177

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:13.907

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:13.637

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:13.367

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:02:13.097

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:00:30.441

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2013-07-08 01:00:30.181

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\microsoft shared\ink\tiptsf.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Pentium(R) Dual-Core CPU T4500 @ 2.30GHz

Percentage of memory in use: 44%

Total physical RAM: 3004.87 MB

Available physical RAM: 1661.01 MB

Total Pagefile: 6008.03 MB

Available Pagefile: 4169.45 MB

Total Virtual: 2047.88 MB

Available Virtual: 1915.38 MB
 

==================== Drives ================================
 

Drive c: (Boot) (Fixed) (Total:266.99 GB) (Free:59.04 GB) NTFS

Drive d: (Recover) (Fixed) (Total:30 GB) (Free:22.44 GB) NTFS
 

==================== MBR & Partition Table ==================
 

==================== End Of Log ============================

Hier die Files von Malewarebytes (Teil 1):

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Database version: v2013.07.26.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.17358

Miriam II :: MEDION-PC [limited]
 

18.10.2014 21:30:00

mbam-log-2014-10-18 (21-30-00).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 257259

Time elapsed: 32 minute(s), 7 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 32

HKCR\f (PUP.Funmoods) -> No action taken.

HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> No action taken.

HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> No action taken.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> No action taken.

HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> No action taken.

HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> No action taken.

HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> No action taken.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> No action taken.

HKCR\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\funmoods.funmoodsHlpr.1 (PUP.Funmoods) -> Delete on reboot.

HKCR\funmoods.funmoodsHlpr (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Delete on reboot.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.Funmoods) -> Delete on reboot.

HKCR\esrv.funmoodsESrvc.1 (PUP.Funmoods) -> Delete on reboot.

HKCR\esrv.funmoodsESrvc (PUP.Funmoods) -> Delete on reboot.

HKCR\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\escort.escortIEPane.1 (PUP.Funmoods) -> Delete on reboot.

HKCR\escort.escortIEPane (PUP.Funmoods) -> Delete on reboot.

HKCR\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.Funmoods) -> Delete on reboot.

HKCR\funmoods.dskBnd.1 (PUP.Funmoods) -> Delete on reboot.

HKCR\funmoods.dskBnd (PUP.Funmoods) -> Delete on reboot.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.Funmoods) -> Delete on reboot.

HKCR\funmoodsApp.appCore.1 (PUP.Funmoods) -> Delete on reboot.

HKCR\funmoodsApp.appCore (PUP.Funmoods) -> Delete on reboot.

HKCR\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9} (PUP.Funmoods) -> Quarantined and deleted successfully.
 

Registry Values Detected: 3

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data:  -> No action taken.

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> No action taken.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot.
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 4

c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> No action taken.
 

Files Detected: 12

C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.Funmoods) -> No action taken.

C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> No action taken.

C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> No action taken.

C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.Funmoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.Funmoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.Funmoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.Funmoods) -> Delete on reboot.

c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot.
 

(end)

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Database version: v2013.07.26.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.17358

Miriam II :: MEDION-PC [limited]
 

18.10.2014 22:38:18

mbam-log-2014-10-18 (22-38-18).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 256097

Time elapsed: 26 minute(s), 11 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 11

HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot.

HKCR\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot.
 

Registry Values Detected: 3

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data:  -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot.
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 4

c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot.
 

Files Detected: 12

C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bbjciahceamgodcoidkjpchnokgfpphh_0.localstorage (PUP.Funmoods) -> Quarantined and deleted successfully.

c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot.

C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_cjpglkicenollcignonpgiafdgfeehoj_0.localstorage (PUP.FunMoods) -> Quarantined and deleted successfully.

C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot.
 

(end)

Hier die Files von Malewarebytes (Teil 2):

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Database version: v2013.07.26.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.17358

Miriam II :: MEDION-PC [limited]
 

19.10.2014 21:24:22

mbam-log-2014-10-19 (21-24-22).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 256171

Time elapsed: 29 minute(s), 46 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 11

HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot.

HKCR\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot.
 

Registry Values Detected: 3

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data:  -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot.
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 4

c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot.
 

Files Detected: 10

c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot.
 

(end)

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Database version: v2013.07.26.05
 

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 11.0.9600.17358

Miriam II :: MEDION-PC [limited]
 

20.10.2014 00:08:00

mbam-log-2014-10-20 (00-08-00).txt
 

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 256683

Time elapsed: 25 minute(s), 47 second(s)
 

Memory Processes Detected: 0

(No malicious items detected)
 

Memory Modules Detected: 0

(No malicious items detected)
 

Registry Keys Detected: 11

HKCR\Typelib\{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3} (PUP.Funmoods) -> Delete on reboot.

HKCR\Interface\{23D8EEF7-0E13-4000-B9C4-6603C1E912D1} (PUP.Funmoods) -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\bbjciahceamgodcoidkjpchnokgfpphh (PUP.Funmoods) -> Delete on reboot.

HKLM\SOFTWARE\Google\Chrome\Extensions\cjpglkicenollcignonpgiafdgfeehoj (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\InstallCore\funmoods (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706} (PUP.FunMoods) -> Delete on reboot.

HKCR\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} (PUP.FunMoods) -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\funmoods (PUP.FunMoods) -> Delete on reboot.
 

Registry Values Detected: 3

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data:  -> Quarantined and deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} (PUP.Funmoods) -> Data: Funmoods Toolbar -> Delete on reboot.

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs|Tabs (PUP.FunMoods) -> Data: hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q&cr=494165744&ir= -> Delete on reboot.
 

Registry Data Items Detected: 0

(No malicious items detected)
 

Folders Detected: 4

c:\users\medion\appdata\locallow\funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0 (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh (PUP.FunMoods) -> Delete on reboot.
 

Files Detected: 10

c:\users\medion\appdata\roaming\funmoods\updateproc\updatetask.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\FavIcon.ico (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsApp.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsEng.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodssrv.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\funmoodsTlbr.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\Sqlite3.dll (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninst.dat (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\uninstall.exe (PUP.FunMoods) -> Delete on reboot.

C:\Program Files\Funmoods\1.8.27.0\bh\funmoods.dll (PUP.FunMoods) -> Delete on reboot.
 

(end)

Und last but not least Trend Micro:
Letzte Suche:

Code:

Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von

20.10.2014 11:19,ADW_LINKY,Spyware,C:\Program Files\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:19,ADW_LINKY,Spyware,C:\Program Files\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:20,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:21,ADW_LINKY,Spyware,C:\Program Files\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:22,ADW_LINKY,Spyware,C:\Program Files\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange

20.10.2014 11:31,ADW_SIDETAB,Spyware,C:\Program Files\SupTab\DpInterface32.dll,Entfernt,Echtzeitsuche

Viren:

Code:

Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von,Von,An,Betreff,Protokoll

24.07.2014 17:22,HEU_AEGISCS010,Bedrohung,C:\Windows\Temp\_E8F7.exe,Entfernt,Echtzeitsuche,

24.07.2014 17:22,HEU_AEGISCS010,Bedrohung,c:\windows\system32\dlprotectsvc.exe,Entfernt,Echtzeitsuche,

25.07.2014 22:02,TROJ_GEN.R0CCC0OGO14,Malware,C:\Program Files\LPT\srptsl.exe,Entfernt,Echtzeitsuche,

03.08.2014 20:28,HEU_AEGISCS010,Bedrohung,C:\Windows\Temp\_65D3.exe,Entfernt,Echtzeitsuche,

03.08.2014 20:28,HEU_AEGISCS010,Bedrohung,c:\windows\system32\dlprotectsvc.exe,Entfernt,Echtzeitsuche,

20.08.2014 11:14,TROJ_GEN.R0C1C0OHH14,Malware,C:\program files\lpt\smartbar.monetization.proxy.proxyremover.exe,Entfernt,Echtzeitsuche,

21.08.2014 20:42,JS_URYLINK.A,Bedrohung,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\chrome\FirefoxExtensionMain.js,Entfernt,Echtzeitsuche,

22.08.2014 15:57,TROJ_GEN.R0C1C0OHH14,Malware,C:\program files\lpt\Smartbar.Monetization.Proxy.ProxyRemover.exe,Entfernt,Suchauftrag in Warteschlange,

14.10.2014 00:27,TROJ_SPNR.0CJA14,Bedrohung,C:\program files\mypc backup\MyPC Backup.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:09,TROJ_SPNR.25IN14,Bedrohung,C:\Users\Medion\AppData\Local\Temp\is-RIGBI.tmp\InstallManager.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:10,TROJ_SPNR.25IN14,Bedrohung,C:\Users\Medion\AppData\Local\Temp\is-RIGBI.tmp\InstallManagerNS.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\JS\ta.js,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:13,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\bg.js,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:14,JS_URYLINK.A,Bedrohung,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\chrome\FirefoxExtensionMain.js,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 13:41,TROJ_GEN.R047C0VJ814,Malware,C:\Users\Medion\AppData\Local\fst_de_76\Download\setup_recover_fst_de_173.exe,Entfernt,Suchauftrag in Warteschlange,

Spyware:

Code:

Datum/Uhrzeit,Name der Bedrohung,Infizierte Datei,Maßnahme,Entdeckt von,Von,An,Betreff,Protokoll

21.08.2014 20:39,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.DLL,Entfernt,Echtzeitsuche,

21.08.2014 20:39,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.DLL,Entfernt,Echtzeitsuche,

21.08.2014 20:42,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.exe,Entfernt,Echtzeitsuche,

21.08.2014 20:42,ADW_LINKY,S-1-5-21-634998973-2183486359-2024787897-1000\Software\Microsoft\Windows\CurrentVersion\Run,Entfernt,Echtzeitsuche,

21.08.2014 20:42,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_28.dll,Entfernt,Echtzeitsuche,

21.08.2014 20:43,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_29.dll,Entfernt,Echtzeitsuche,

21.08.2014 20:43,ADW_LINKY,C:\users\medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_30.dll,Entfernt,Echtzeitsuche,

22.08.2014 15:57,ADW_LINKY,C:\program files\lpt\linmsl.exe,Entfernt,Suchauftrag in Warteschlange,

22.08.2014 16:00,ADW_LINKY,C:\program files\lpt\srptm.exe,Entfernt,Suchauftrag in Warteschlange,

22.08.2014 16:01,ADW_LINKY,C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll,Entfernt,Suchauftrag in Warteschlange,

27.08.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_26.dll,Entfernt,Echtzeitsuche,

27.08.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_27.dll,Entfernt,Echtzeitsuche,

03.09.2014 17:02,ADW_INSTALLCORE,C:\Users\Finn.Medion-PC\AppData\Local\temp\is1275519350\uninstaller.exe,Entfernt,Echtzeitsuche,

03.09.2014 17:02,ADW_INSTALLCORE,C:\Users\Finn.Medion-PC\AppData\Local\temp\is1275519350\uninstaller.exe,Entfernt,Echtzeitsuche,

06.09.2014 10:28,ADW_EOREZO,C:\program files\fst_de_76\unins000.exe,Entfernt,Suchauftrag in Warteschlange,

06.09.2014 10:28,ADW_EOREZO,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:53,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyRemover.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:54,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\linmsl.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:55,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:56,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptm.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srptsl.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\BrowserHelper.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ChromeHost.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:57,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Lrcnta.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\MACTrackBarLib.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\NDde.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:58,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 16:59,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:00,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:01,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO2.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension2.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:02,ADW_URYLINK,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\JS\documentEvents.js,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:02,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_30.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:03,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sgml.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smta.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spsm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spusm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:04,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srau.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbhu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbs.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srbu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sreu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srgu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srns.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srom.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:05,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srprl.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srpu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsbs.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsbsau.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srsl.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sruhs.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:06,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srus.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\srut.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\tr\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.DMP.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:07,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:08,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Common\ServicesPlugins\spup.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:09,ADW_ELEX,C:\Users\Medion\AppData\Local\Temp\fullpackage_temp1399044609\tmp\wpm.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:12,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ar\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\es\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\fr\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:14,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\he\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\it\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\lrcnt.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\nl\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:15,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\pt\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\ru\Smartbar.Resources.LanguageSettings.resources.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sidb.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\siem.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sipb.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\sismlp.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smti.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:16,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\smtu.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:17,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spbe.dll,Entfernt,Suchauftrag in Warteschlange,

17.10.2014 17:17,ADW_LINKY,C:\Users\Medion\AppData\Local\Smartbar\Application\spbl.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:19,ADW_LINKY,C:\Program Files\LPT\lrrot.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:19,ADW_LINKY,C:\Program Files\LPT\Newtonsoft.Json.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Proxy.Lib.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\ProxySettings.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Common.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Communication.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Communication.NamedPipe.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Infrastructure.Utilities.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Monetization.Proxy.ProxyService.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:20,ADW_LINKY,C:\Program Files\LPT\Smartbar.Personalization.Common.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\sppsm.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\spusm.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srbs.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srbu.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\sreu.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srpdm.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:21,ADW_LINKY,C:\Program Files\LPT\srprl.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srpt.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srptc.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\srut.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\Resources\ntdis_32.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:22,ADW_LINKY,C:\Program Files\LPT\Resources\ntdis_64.dll,Entfernt,Suchauftrag in Warteschlange,

20.10.2014 11:31,ADW_SIDETAB,C:\Program Files\SupTab\DpInterface32.dll,Entfernt,Echtzeitsuche,

Wo ich das hier gerade lese,
ich dachte SMARTBAR hätte ich am 17.10.14 deinstalliert (weiß nicht, ob das relevant ist).

Unsere Tools brauchen immer Adminrechte.

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Funmoods

Installer

LPT System Updater Service

MyPC Backup

NewPlayer

PriceSparrow

Securita Scout

The Sea App

Yahoo Community Smartbar
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,
hier die Logfile von Adwcleaner:

Code:

# AdwCleaner v4.001 - Bericht erstellt am 21/10/2014 um 22:56:21

# DB v2014-10-21.1

# Aktualisiert 20/10/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)

# Benutzername : Medion - MEDION-PC

# Gestartet von : C:\Users\Medion\Downloads\AdwCleaner_4.001.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : AddonsHelper

[#] Dienst Gelöscht : globalUpdate

[#] Dienst Gelöscht : globalUpdatem

Dienst Gelöscht : SearchAnonymizer

[#] Dienst Gelöscht : KMService
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Allin1Convert_8h

Ordner Gelöscht : C:\ProgramData\apn

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\Temp\apn

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\apn

Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\Temp\apn

Ordner Gelöscht : C:\Program Files\AppGraffiti

Ordner Gelöscht : C:\ProgramData\AskPartnerNetwork

Ordner Gelöscht : C:\Program Files\Common Files\AVG Secure Search

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\BabSolution

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Program Files\Browser App

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender

Ordner Gelöscht : C:\Users\Mika\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Delta

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DesktopIconForAmazon

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DigitalSites

Ordner Gelöscht : C:\ProgramData\DNSErrorHelper

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\DSite

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\DSite

Ordner Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\iw38tv23.default\FoxTab

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FrEeSoFtOdAy

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\FromDocToPDF_65

Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Funmoods

[!] Ordner Gelöscht : C:\Program Files\globalUpdate

Ordner Gelöscht : C:\Users\Medion\AppData\Local\globalUpdate

Ordner Gelöscht : C:\Windows\system32\config\systemprofile\AppData\Roaming\HELPER

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\HELPER

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\HELPER

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\LocalLow\HPAppData

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\HPAppData

Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\HPAppData

Ordner Gelöscht : C:\Users\Miriam II\AppData\LocalLow\HPAppData

Ordner Gelöscht : C:\ProgramData\IePluginService

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\iLivid

Ordner Gelöscht : C:\Program Files\Inbox Toolbar

Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Inbox Toolbar

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\Inbox Toolbar

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\InetStat

Ordner Gelöscht : C:\Program Files\LPT

Ordner Gelöscht : C:\Users\Medion\AppData\Local\LPT

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\mt_ffx

Ordner Gelöscht : C:\Program Files\MyPC Backup

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\OCS

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\OCS

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open it!

Ordner Gelöscht : C:\Program Files\openit

Ordner Gelöscht : C:\Users\Mika\AppData\Local\PackageAware

Ordner Gelöscht : C:\Users\Miriam II\AppData\Roaming\pdfforge

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RebateInformer

[#] Ordner Gelöscht : C:\Program Files\RebateInformer

Ordner Gelöscht : C:\Program Files\RegClean Pro

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\Security Systems

Ordner Gelöscht : C:\Program Files\SiteRanker

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\LocalLow\SiteRanker

Ordner Gelöscht : C:\Users\Miriam II\AppData\LocalLow\SiteRanker

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Temp\Smartbar

Ordner Gelöscht : C:\Users\Medion\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Program Files\SupTab

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\SupTab

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Systweak

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Systweak

Ordner Gelöscht : C:\Users\Miriam II\AppData\Roaming\Systweak

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\torch

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\torch

Ordner Gelöscht : C:\ProgramData\torchcrashhandler

Ordner Gelöscht : C:\ProgramData\WPM

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Zwinky_5q

Ordner Gelöscht : C:\ProgramData\Allmyapps

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Allmyapps

Ordner Gelöscht : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Allmyapps

Ordner Gelöscht : C:\Program Files\fst_de_76

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Local\fst_de_76

Ordner Gelöscht : C:\Users\Medion\AppData\Local\fst_de_76

Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\fst_de_76

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\5qffxtbr@Zwinky_5q.com

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\65ffxtbr@FromDocToPDF_65.com

Ordner Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\Extensions\8hffxtbr@Allin1Convert_8h.com

Ordner Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\iw38tv23.default\Extensions\isreaditlater@ideashower.com

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm

Ordner Gelöscht : C:\Users\Miriam II\AppData\Local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm

Ordner Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg

Datei Gelöscht : C:\Users\Medion\AppData\Local\CRE\plmlpkfpkijnlijgalnjaacllnjmoamo.crx

Datei Gelöscht : C:\Users\Finn.Medion-PC\iLivid.lnk

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\iLivid.lnk

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qtrax Player.lnk

Datei Gelöscht : C:\Windows\system32\roboot.exe

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Torch.lnk

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Torch.lnk

Datei Gelöscht : C:\Windows\system32\srvany.exe

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\bprotector_extensions.sqlite

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\bprotector_prefs.js

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\invalidprefs.js

Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\11-suche.xml

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\searchplugins\ask-search.xml

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\ask-search.xml

Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\ask-search.xml

Datei Gelöscht : C:\Users\Finn.Medion-PC\AppData\Roaming\Mozilla\Firefox\Profiles\gvq84p8s.default-1375801334932\searchplugins\ask-web-search.xml

Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\avg-secure-search.xml

Datei Gelöscht : C:\Users\Mika\AppData\Roaming\Mozilla\Firefox\Profiles\y50zck82.default\searchplugins\Conduit.xml

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\funmoods.xml

Datei Gelöscht : C:\Program Files\Mozilla Firefox\browser\searchplugins\sweet-page.xml

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\Web Search.xml

Datei Gelöscht : C:\Users\Miriam II\AppData\Roaming\Mozilla\Firefox\Profiles\621ymm82.default-1400327359563\searchplugins\Web Search.xml

Datei Gelöscht : C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\user.js

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_app.mam.conduit.com_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\user data\default\local storage\hxxp_pricegong.conduitapps.com_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_storage.conduit.com_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www1.delta-search.com_0.localstorage

Datei Gelöscht : C:\Users\Medion\AppData\Local\Google\Chrome\user data\default\bprotector web data
 

***** [ Tasks ] *****
 

Task Gelöscht : Dealply

Task Gelöscht : DSite

Task Gelöscht : Funmoods

Task Gelöscht : globalUpdateUpdateTaskMachineCore

Task Gelöscht : RunAsStdUser Task
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\Desktop\Search.lnk

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Search.lnk

Verknüpfung Desinfiziert : C:\Users\Medion\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [quick_start@gmail.com]

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\knkakpihealnpggeceajhaonlmgdkaip

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [InetStat]

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [NTRedirect]

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [qtraxnotification]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BackupStack_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayerUpdater_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\pdfforgeToolbar-stub-1_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchSettings_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\smartbar_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Ocs_SM]

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10

Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [fst_de_76]

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_icolorfolder_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_icolorfolder_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vuescan_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_vuescan_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9B6B03F1-16CF-4491-BBBB-E872802DD717}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{968EDCE0-C10A-47BB-B3B6-FDF09F2A417D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3F2DC1E7-A56F-49D8-B0CF-DB2300594497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B424109-6F99-4306-8F2B-0B2BB1C8C415}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C0EB0A9-265F-4D9D-AF96-0EF2403A73E8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9DF046E1-80F7-43E0-80C0-0AD696799C8F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D0FD0502-5878-441D-A3C0-9A4531C526CB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3E46008-1902-41A7-91C7-26EC6E0B66D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : HKCU\Software\BABSOLUTION

Schlüssel Gelöscht : HKCU\Software\Ciuvo

Schlüssel Gelöscht : HKCU\Software\dsiteproducts

Schlüssel Gelöscht : HKCU\Software\FreeSoftToday

Schlüssel Gelöscht : HKCU\Software\GlobalUpdate

Schlüssel Gelöscht : HKCU\Software\InetStat

Schlüssel Gelöscht : HKCU\Software\InstallCore

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\qtrax

Schlüssel Gelöscht : HKCU\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\smartbarbackup

Schlüssel Gelöscht : HKCU\Software\smartbarlog

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\systweak

Schlüssel Gelöscht : HKCU\Software\Tutorials

Schlüssel Gelöscht : HKCU\Software\TutoTag

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Plus-HD-2.3

Schlüssel Gelöscht : HKLM\SOFTWARE\Driver-Soft

Schlüssel Gelöscht : HKLM\SOFTWARE\FrEeSoFtOdAy

Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\Plus-HD-2.3

Schlüssel Gelöscht : HKLM\SOFTWARE\Speedchecker Limited

Schlüssel Gelöscht : HKLM\SOFTWARE\SupTab

Schlüssel Gelöscht : HKLM\SOFTWARE\supWPM

Schlüssel Gelöscht : HKLM\SOFTWARE\sweet-pageSoftware

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials

Schlüssel Gelöscht : HKLM\SOFTWARE\Wpm

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DSite

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Opener Packages

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2AA44AF4-C116-4219-B800-4573E7E6D421}_is1

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4BB7A109-FDB5-45E3-9DB9-ECB2EA7B80EE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Browser App

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\openit open it!

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchAnonymizer

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2E0D3DD9E5E4B74CA43BCE77815E287

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17344
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [CustomizeSearch]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v32.0.3 (x86 de)
 
 

-\\ Google Chrome v38.0.2125.104
 
 

*************************
 

AdwCleaner[R0].txt - [32736 octets] - [21/10/2014 22:50:00]

AdwCleaner[S0].txt - [30986 octets] - [21/10/2014 22:56:21]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [31047 octets] ##########

JRT:

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.3.3 (10.21.2014:1)

OS: Windows 7 Home Premium x86

Ran by Medion on 21.10.2014 at 23:06:16,80

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}
 
 
 

~~~ Files
 

Successfully deleted: [File] "C:\Users\Medion\appdata\locallow\microsoft\silverlight\outofbrowser\index\portal.qtrax.com"

Successfully deleted: [File] C:\Windows\prefetch\DRIVERSUPPORT.EXE-42650329.pf

Successfully deleted: [File] "C:\Windows\wininit.ini"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\Users\Medion\AppData\Roaming\zip opener packages"

Successfully deleted: [Folder] "C:\Windows\system32\ai_recyclebin"
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\Medion\AppData\Roaming\mozilla\firefox\profiles\q5jk1lre.default\prefs.js
 

user_pref("browser.startup.homepage", "hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-BrMH_rldG-cmPeCyWdj

user_pref("extensions.ORJ-SPE.previous-keyword-url", "\"hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StK217RbjR1YFa37oBy_U-nTnTbDTt8PVUCrSqw53XSneJUimbGn_unx1EGMD8ZJ2GBRh-Br

user_pref("extensions.delta.admin", false);

user_pref("extensions.delta.aflt", "babsst");

user_pref("extensions.delta.appId", "{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}");

user_pref("extensions.delta.autoRvrt", "false");

user_pref("extensions.delta.dfltLng", "de");

user_pref("extensions.delta.excTlbr", false);

user_pref("extensions.delta.ffxUnstlRst", true);

user_pref("extensions.delta.id", "c6f9f0ad0000000000000025d32f37e3");

user_pref("extensions.delta.instlDay", "15914");

user_pref("extensions.delta.instlRef", "sst");

user_pref("extensions.delta.newTab", false);

user_pref("extensions.delta.prdct", "delta");

user_pref("extensions.delta.prtnrId", "delta");

user_pref("extensions.delta.rvrt", "false");

user_pref("extensions.delta.smplGrp", "none");

user_pref("extensions.delta.tlbrId", "base");

user_pref("extensions.delta.tlbrSrchUrl", "");

user_pref("extensions.delta.vrsn", "1.8.22.0");

user_pref("extensions.delta.vrsnTs", "1.8.22.012:20:08");

user_pref("extensions.delta.vrsni", "1.8.22.0");

user_pref("extensions.delta_i.babExt", "");

user_pref("extensions.delta_i.babTrack", "affID=119357&tsp=4957");

user_pref("extensions.delta_i.srcExt", "ss");

user_pref("extensions.ffxtlbr@delta.com.install-event-fired", true);

user_pref("extensions.ffxtlbr@funmoods.com.install-event-fired", true);

user_pref("extensions.funmoods.aflt", "ironpubd");

user_pref("extensions.funmoods.appId", "{EA28B360-05E0-4F93-8150-02891F1D8D3C}");

user_pref("extensions.funmoods.cd", "2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1Czu1L1C1F1G1E2Y1S1Q");

user_pref("extensions.funmoods.cr", "494165744");

user_pref("extensions.funmoods.dfltLng", "");

user_pref("extensions.funmoods.dfltSrch", true);

user_pref("extensions.funmoods.dnsErr", true);

user_pref("extensions.funmoods.excTlbr", false);

user_pref("extensions.funmoods.hmpg", true);

user_pref("extensions.funmoods.hmpgUrl", "hxxp://searchfunmoods.com/?f=1&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtFtC

user_pref("extensions.funmoods.id", "00262DBFE53BF0AD");

user_pref("extensions.funmoods.instlDay", "16316");

user_pref("extensions.funmoods.instlRef", "");

user_pref("extensions.funmoods.newTabUrl", "hxxp://searchfunmoods.com/?f=2&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyEtF

user_pref("extensions.funmoods.prdct", "funmoods");

user_pref("extensions.funmoods.prtnrId", "funmoods");

user_pref("extensions.funmoods.srchPrvdr", "Funmoods");

user_pref("extensions.funmoods.tlbrId", "base");

user_pref("extensions.funmoods.tlbrSrchUrl", "hxxp://searchfunmoods.com/?f=3&a=ironpubd&cd=2XzuyEtN2Y1L1QzutDtDtByCtB0D0B0F0EyDtA0B0FtD0A0DtN0D0Tzu0CzyyByBtN1L2XzutBtFtBtFtCyE

user_pref("extensions.funmoods.vrsn", "1.8.27.0");

user_pref("extensions.funmoods.vrsni", "1.8.27.0");

user_pref("extensions.funmoods_i.hmpg", true);

user_pref("extensions.funmoods_i.newTab", false);

user_pref("extensions.funmoods_i.smplGrp", "none");

user_pref("extensions.funmoods_i.vrsnTs", "1.8.27.017:1:16");

user_pref("extensions.helperbar.SmartbarDisabled", false);

user_pref("extensions.helperbar.SmartbarStateMinimaized", false);

user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[{\\\"ExcludeDomains\\\":[\\\"snap.do\\\",\\\"snapdo.com\\\",\\\".search.yahoo.com\\\\\\/yhs\\\\\\/search?hspart=lk

user_pref("extensions.inboxcomtoolbar@inbox.com.install-event-fired", true);

user_pref("extensions.toolbar_ORJ-SPE@apn.ask.com.install-event-fired", true);

user_pref("extensions.toolbar_ORJ-ST-SPE@apn.ask.com.install-event-fired", true);

Emptied folder: C:\Users\Medion\AppData\Roaming\mozilla\firefox\profiles\q5jk1lre.default\minidumps [14 files]
 
 
 

~~~ Chrome
 

Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\bbjciahceamgodcoidkjpchnokgfpphh

Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\cjpglkicenollcignonpgiafdgfeehoj

Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\kljkanaekoongefljnjbghkgjjocmikm

Successfully deleted: [Folder] C:\Users\Medion\appdata\local\Google\Chrome\User Data\Default\Extensions\mkcedibhemacmilmkpndpkoidlnmgngg
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 21.10.2014 at 23:08:19,44

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und eine neue FRST file:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-10-2014

Ran by Medion (administrator) on MEDION-PC on 21-10-2014 23:11:55

Running from C:\Users\Miriam II\Downloads

Loaded Profile: Medion (Available profiles: Medion & Finn & Miriam II)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-UpdaterService.exe

(Teruten) C:\Windows\System32\FsUsbExService.Exe

(Nero AG) C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe

() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

(Secunia) C:\Program Files\Secunia\PSI\psia.exe

(Secunia) C:\Program Files\Secunia\PSI\sua.exe

(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe

(Crawler.com) C:\Program Files\Spyware Terminator\st_rsser.exe

(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe

(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

() C:\Program Files\HTC\HTC Sync Manager\HTC Sync\adb.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-Agent.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)

HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [436800 2013-07-15] (BillP Studios)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps] => "C:\Users\Medion\AppData\Roaming\Allmyapps\Allmyapps.exe" startup

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps Update] => "C:\Users\Medion\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk

ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)

Startup: C:\Users\Miriam II\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Miriam II\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

BootExecute: autocheck autochk * sdnclean.exe

GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION

GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1003\User: Group Policy restriction detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

ProxyServer: :0

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default

FF NewTab: chrome://quick_start/content/index.html

FF Keyword.URL: user_pref("keyword.URL", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)

FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]

FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]

FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension

FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]

FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\cliqz@cliqz.com
 

Chrome: 

=======

CHR Profile: C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]

CHR Extension: (Google Docs) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-19]

CHR Extension: (Google Drive) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-19]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-20]

CHR Extension: (YouTube) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-19]

CHR Extension: (Google-Suche) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-19]

CHR Extension: (Google Tabellen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]

CHR Extension: (Google Wallet) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-19]

CHR Extension: (Google Mail) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-19]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]

R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]

R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]

R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)

R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]

R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)

R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)

R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)

R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)

S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]

S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]

S2 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)

R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)

R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)

S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)

R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)

R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)

R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)

R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)

R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)

R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]

U2 TMAgent; No ImagePath

S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]

S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-21 23:11 - 2014-10-21 23:11 - 00000000 ____D () C:\Users\Miriam II\Downloads\FRST-OlderVersion

2014-10-21 23:08 - 2014-10-21 23:08 - 00006213 _____ () C:\Users\Medion\Desktop\JRT.txt

2014-10-21 23:05 - 2014-10-21 23:05 - 01706144 _____ (Thisisu) C:\Users\Medion\Downloads\JRT.exe

2014-10-21 23:01 - 2014-10-21 23:01 - 00031128 _____ () C:\Users\Medion\Desktop\AdwCleaner[S0].txt

2014-10-21 22:48 - 2014-10-21 22:57 - 00000000 ____D () C:\AdwCleaner

2014-10-21 22:47 - 2014-10-21 22:47 - 01962496 _____ () C:\Users\Medion\Downloads\AdwCleaner_4.001.exe

2014-10-21 21:41 - 2014-10-21 21:41 - 00000048 _____ () C:\Users\Public\Documents\_rgpl

2014-10-21 21:35 - 2014-10-21 21:35 - 00000420 _____ () C:\Users\Medion\Desktop\Letzte Suche.csv

2014-10-21 20:31 - 2014-10-21 20:31 - 00001226 _____ () C:\Users\Medion\Desktop\Revo Uninstaller.lnk

2014-10-21 20:31 - 2014-10-21 20:31 - 00000000 ____D () C:\Program Files\VS Revo Group

2014-10-21 20:29 - 2014-10-21 20:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Medion\Downloads\revosetup95.exe

2014-10-20 21:21 - 2014-10-20 21:21 - 00000000 ____D () C:\Users\Medion\AppData\Local\com

2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-10-20 21:14 - 2014-10-20 21:15 - 01209696 _____ () C:\Users\Medion\Downloads\Player_Setup.exe

2014-10-20 20:44 - 2014-10-20 20:44 - 00007805 _____ () C:\Users\Miriam II\Desktop\GMER.txt

2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\Program Files\7-Zip

2014-10-20 20:34 - 2014-10-20 20:35 - 01110476 _____ () C:\Users\Miriam II\Downloads\7z920.exe

2014-10-20 19:32 - 2014-10-20 19:32 - 00007805 _____ () C:\Users\Medion\Desktop\gmer.txt

2014-10-20 19:11 - 2014-10-20 19:30 - 00007805 _____ () C:\Users\Medion\Desktop\gmer.log

2014-10-20 17:30 - 2014-10-20 17:30 - 00146376 _____ () C:\Windows\Minidump\102014-18891-01.dmp

2014-10-20 17:15 - 2014-10-20 17:16 - 00380416 _____ () C:\Users\Miriam II\Downloads\Gmer-19357.exe

2014-10-20 17:06 - 2014-10-20 17:07 - 00043008 _____ () C:\Users\Miriam II\Downloads\Addition.txt

2014-10-20 17:04 - 2014-10-21 23:11 - 00025145 _____ () C:\Users\Miriam II\Downloads\FRST.txt

2014-10-20 11:46 - 2014-10-21 23:11 - 00000000 ____D () C:\FRST

2014-10-20 11:44 - 2014-10-21 23:11 - 01102336 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe

2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log

2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable

2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe

2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe

2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys

2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action

2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim

2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-21 23:09 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-21 23:09 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-21 23:02 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype

2014-10-21 23:01 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub

2014-10-21 22:59 - 2014-08-20 19:46 - 00065536 _____ () C:\Windows\system32\Ikeext.etl

2014-10-21 22:59 - 2014-07-17 22:09 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-21 22:59 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-21 22:59 - 2009-07-14 06:39 - 00177515 _____ () C:\Windows\setupact.log

2014-10-21 22:59 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing

2014-10-21 22:58 - 2011-04-06 10:26 - 01945789 _____ () C:\Windows\WindowsUpdate.log

2014-10-21 22:58 - 2010-05-05 19:37 - 00340790 _____ () C:\Windows\PFRO.log

2014-10-21 22:57 - 2014-07-02 17:57 - 00001041 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2014-10-21 22:57 - 2014-07-02 17:57 - 00001011 _____ () C:\Users\Medion\Desktop\Search.lnk

2014-10-21 22:57 - 2013-07-26 12:24 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-21 22:57 - 2013-07-26 12:24 - 00001011 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-10-21 22:57 - 2012-05-13 12:57 - 00000000 ____D () C:\Users\Medion\AppData\Local\CRE

2014-10-21 22:57 - 2011-04-19 18:23 - 00000000 ____D () C:\Users\Finn.Medion-PC

2014-10-21 22:57 - 2011-04-06 10:28 - 00001154 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-10-21 22:18 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-21 22:14 - 2014-07-17 22:09 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-21 22:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-10-21 22:03 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam

2014-10-21 22:02 - 2011-11-28 14:24 - 00000000 ____D () C:\Program Files\BFDemos

2014-10-21 21:26 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

2014-10-21 16:42 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub

2014-10-21 16:42 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive

2014-10-21 16:42 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator

2014-10-20 22:24 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-10-20 21:17 - 2014-03-14 21:14 - 00000000 ___RD () C:\Program Files\Skype

2014-10-20 21:17 - 2011-04-14 21:52 - 00000000 ____D () C:\ProgramData\Skype

2014-10-20 19:11 - 2011-04-14 19:57 - 00144760 _____ () C:\Users\Medion\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-20 17:30 - 2014-05-17 09:08 - 355499801 _____ () C:\Windows\MEMORY.DMP

2014-10-20 17:30 - 2014-05-17 09:08 - 00000000 ____D () C:\Windows\Minidump

2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion

2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-10-19 23:41 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans

2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2

2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache

2014-10-18 16:31 - 2014-08-03 20:00 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Local\HTC MediaHub

2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe

2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment

2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam

2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft

2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-09-24 16:39 - 2011-05-02 16:27 - 00147064 _____ () C:\Users\Finn.Medion-PC\AppData\Local\GDIPFONTCACHEV1.DAT

2014-09-22 07:59 - 2014-09-07 21:20 - 00000000 ____D () C:\FreeOCR
 

Files to move or delete:

====================

C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
 
 

Some content of TEMP:

====================

C:\Users\Finn.Medion-PC\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel0.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel1.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel2.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel3.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel4.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel5.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\propsys.dll

C:\Users\Finn.Medion-PC\AppData\Local\Temp\Softonic_DE_1-5-1.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\zodr8l3a.dll

C:\Users\Medion\AppData\Local\Temp\0acncs1a.eea.exe

C:\Users\Medion\AppData\Local\Temp\1sv0noim.wxt.exe

C:\Users\Medion\AppData\Local\Temp\27353uninstall.exe

C:\Users\Medion\AppData\Local\Temp\amazonicon_v4.exe

C:\Users\Medion\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\Medion\AppData\Local\Temp\APNSetup.exe

C:\Users\Medion\AppData\Local\Temp\awtcmhrt.uzg.exe

C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe

C:\Users\Medion\AppData\Local\Temp\dlLogic.exe

C:\Users\Medion\AppData\Local\Temp\dltr.exe

C:\Users\Medion\AppData\Local\Temp\erb3vygz.wnz.exe

C:\Users\Medion\AppData\Local\Temp\foxy_security_games.exe

C:\Users\Medion\AppData\Local\Temp\GCVerifier.dll

C:\Users\Medion\AppData\Local\Temp\iodhz2td.rks.exe

C:\Users\Medion\AppData\Local\Temp\Quarantine.exe

C:\Users\Medion\AppData\Local\Temp\sdanircmdc.exe

C:\Users\Medion\AppData\Local\Temp\sdapskill.exe

C:\Users\Medion\AppData\Local\Temp\sdaspwn.exe

C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe

C:\Users\Medion\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Medion\AppData\Local\Temp\Sqlite3.dll

C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe

C:\Users\Medion\AppData\Local\Temp\Uni000.exe

C:\Users\Medion\AppData\Local\Temp\vdoiuwkh.d1k.exe

C:\Users\Medion\AppData\Local\Temp\verifier.exe

C:\Users\Medion\AppData\Local\Temp\vfxpnvpx.lx3.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-18 19:03
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Hier auch noch die letzten Funde meines Antivirenprogramms:

Code:

Datum/Uhrzeit,Bedrohung,Quelle,Betroffene Dateien,Maßnahme,Entdeckt von

21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srpts.exe,Entfernt,Suchauftrag in Warteschlange

21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srpts.exe\LPT System Updater Service,Entfernt,Suchauftrag in Warteschlange

21.10.2014 21:12,ADW_LINKY,Spyware,C:\Program Files\LPT\srptsl.exe,Entfernt,Suchauftrag in Warteschlange

Mir sind noch ein paar merkwürdige Dinge aufgefallen, weiß aber nicht, ob sie damit zu tun haben. Ich erhalte seit einiger Zeit viel Spam Mail bei Web.de, die oftmals auch nicht mehr gefiltert wird und die Anzeige bei Web.de, in welchem Ordner ich wieviele Mails habe funktioniert auch nicht mehr.

Könnte es außerdem sein, dass mein USB Stick irgendwie "infiziert" ist? Wie kann ich das rausfinden?
Und danke schonmal für deine Unterstützung!!!

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hier erst einmal die Datei vom ESET Online Scanner, der Rest folgt später:

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=ff641632f80ca14a9b430fec46ce388f

# engine=20732

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-10-23 08:36:40

# local_time=2014-10-23 10:36:40 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Trend Micro Titanium Maximum Security'

# compatibility_mode=522 16777213 100 100 13800327 39460085 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776574 100 94 13956156 165684591 0 0

# scanned=381164

# found=143

# cleaned=0

# scan_time=48366

sh=EE244845CFA7A49B0F132DCC445C1242C18D3D62 ft=1 fh=70011a227b9a957f vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$RPQN3C9.exe"

sh=6CB7EDCB0A91B062D58DFE0A29CFC0B4D6183E8B ft=0 fh=0000000000000000 vn="Win32/Toolbar.Inbox.F evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$R00GRG1\inboxcomtoolbar@inbox.com\chrome\ibxcomtb.jar"

sh=C88DAF3FB5D3FEC090233FF251F7F0CFC73EF4CD ft=1 fh=b74c7f4df627386b vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1000\$R00GRG1\{360b78b6-c3fc-2ea6-f4ba-de50ae0f654c}\components\SmartbarFireFoxRemotePlugin_25.dll"

sh=2DD5BDE756E0BB974BCCE667F751C23864C8263C ft=1 fh=b3c5f9c4ee1e944b vn="Win32/Systweak.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R1EYK3M.exe"

sh=49AD16EE101B0868E912C0E37FB563EA0223EA93 ft=1 fh=ee0c85606970fc46 vn="Variante von Win32/InstallCore.BY evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7NAJVV.exe"

sh=DA799A2FD66779F06710E32DB8EF47E191B6A49D ft=1 fh=0cf0cf82fa885ec8 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R8J2YQ6.exe"

sh=8504F4DA17CD7655F8810F926E65C17C243775D5 ft=1 fh=c55a7210254106bd vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RDXJAC5.exe"

sh=C8BA34DE7E149E399AE067F0AB7CB32F7B26073B ft=1 fh=88c6f98c6bfe1303 vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RPCV5OC.exe"

sh=C59A0F9B108BCEFFA575AB5213C01F017A4E1DB8 ft=1 fh=fdc2ab70d49428dd vn="Variante von Win32/BearShare.A evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RX0UDA1.exe"

sh=EA60BDF6885668B3850E90C22787F6325E9D5D4F ft=1 fh=b2dc02befa885ec8 vn="Variante von Win32/WinloadSDA.D evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$RXRHNQ6.exe"

sh=C2B092661C554CEB9840D7D4ADE57789C34E760B ft=1 fh=4455832a986c7da8 vn="Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\39ffxtbr-bs@MapsGalaxy_39.com\content\MapsGalaxy.exe"

sh=AF4C20715941FB0D57489961D016985F92A85915 ft=1 fh=cf9add68b7bd5237 vn="Win32/AdInstaller evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\4zffxtbr-bs@VideoDownloadConverter_4z.com\content\VideoDownloadConvert.exe"

sh=CE952316F32FBFACD185A7FBFB5DD80CF139B588 ft=1 fh=bbdb2b13e6859285 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF10.dll"

sh=76859686AAE43C4936DB38AF5A4CFCEBF1C5D8E7 ft=1 fh=0cdcbca1ef2fa072 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF11.dll"

sh=FD3A3958DD391EB24D798F83E24A20D185C2D104 ft=1 fh=2cd17cb8a2a36929 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF12.dll"

sh=1027184B10A39863C163826BF7D96FAE8E92EA8A ft=1 fh=bebbe8dd24b6a730 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF13.dll"

sh=2B9E55CE81271D2ECEC4C2109F5B37AB27357AB7 ft=1 fh=30d8fb64cac640b4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF14.dll"

sh=3335F080CFC5FFF0F1A29EE16E278B96B0B2C99D ft=1 fh=09616668c2bad301 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF15.dll"

sh=035433E4F356326305847E8042F9A8213667ECE8 ft=1 fh=3f1d11b3fbd30c8f vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF16.dll"

sh=78E1175D3B5FAFE801143F886E99BC4C61B76148 ft=1 fh=f5a2ce90f98a273e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF17.dll"

sh=B2F4EBA790A500E77BC673AF51C1626B2A70D929 ft=1 fh=f6d874e392515f34 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF18.dll"

sh=15BEE16AB7F879A12CB5F170BB3F81E3862CE422 ft=1 fh=0e7e5a9610955a04 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF19.dll"

sh=7011E2D4C12C496987F444DB82C977AB18018F80 ft=1 fh=0b8de1410b750dda vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF2.dll"

sh=54E6A42753E1B9DBC598000135285815C63B4FF8 ft=1 fh=f94c07323e660a05 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF20.dll"

sh=EB3C98B5269DD96862AC70DB18035AAC68C13795 ft=1 fh=42f5374305ec982c vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF21.dll"

sh=CE09251CA2CFDC983596143C50AB99A57C29320C ft=1 fh=0f31bd59f6c93aa7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF22.dll"

sh=70086FAF6B55F9DB1F06EF715B46113F3EA946FE ft=1 fh=d98ca3cc50789476 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF23.dll"

sh=D51FD2FBFB7F00DE472801EB3EFF7F3F05C20C60 ft=1 fh=526913395cd65610 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF4.dll"

sh=574F4296E2048CB17BF5CC0A749C0935949DF052 ft=1 fh=469916f870b7eec8 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF5.dll"

sh=A138B3F78FBABBE9409FF4768918C15F91B7F38A ft=1 fh=fa48ffb3cce66494 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF6.dll"

sh=F3913185A15C5A4E74453F48B8A6608C44A569E5 ft=1 fh=cafe2486b0135de4 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF7.dll"

sh=F13A94AC388DE6F8DEBE598E34E6C7F2049C2AD0 ft=1 fh=ab73217a39b6db51 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF8.dll"

sh=7020452B6F0452EFFFB982FE3B4ED81599439F65 ft=1 fh=83441fdf9c7a3202 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{80F56243-ACAC-F15F-2657-CCF247FCAE31}\components\DatamngrHlpFF9.dll"

sh=2B713A73040F00633A991E136AFF78BABE7CC9BA ft=1 fh=0f6747bf62384b27 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF10.dll"

sh=356BCA5D80A3966EDD5567E20CE36DE8D92BB324 ft=1 fh=393ea35f7a5039cd vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF11.dll"

sh=9E69EA60F131A8C538B6CC8516C61D4417521E78 ft=1 fh=87133386ec2897f0 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF12.dll"

sh=17F82BF6A267935356954B1ACBBBE9137CF02D1B ft=1 fh=8b7dce85d61e459e vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF13.dll"

sh=2452843E6738117A5B700C967206BEBA85F80A35 ft=1 fh=a4c9d32b9f1b0681 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF14.dll"

sh=4646E1636B2D34D124ACA040C42D5A714A27E935 ft=1 fh=b9e66c7544aeda25 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF15.dll"

sh=9897AEE786D03739C203095FF638B4C9E3BF70CB ft=1 fh=227385daa4eee916 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF16.dll"

sh=595B61E6508DFD56837758CADD8309B3F3E12B2B ft=1 fh=338bb5c453cd4cc7 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF17.dll"

sh=15B0FE06E8A7F70C8ECB9AECAD84A75B495B3F9F ft=1 fh=4215c06544d614ff vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF18.dll"

sh=FD1D2A1DCA5218B6D69448DD2592F6695F6FE53A ft=1 fh=0dd8138c73c31dae vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF19.dll"

sh=E5165D753ECB75CAF5602C975A02B8560F4A357F ft=1 fh=8d53df379ab7d6b3 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF2.dll"

sh=29DF9A2CD0A6EC0C2FD7C23F5EADD76232E1DD5D ft=1 fh=fd57dec1f82049b5 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF20.dll"

sh=607DDFC19A18CD580B64E12549640ACEE127A9CE ft=1 fh=8199e7e1b51562e9 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF21.dll"

sh=1411655FC03ED9BEC5E061FDDB7981E9926DE477 ft=1 fh=23e093a06d2fdbb1 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF22.dll"

sh=9FA61ED37A78F3DB47AF256BF8153F50098E42BE ft=1 fh=e761c91b08df672d vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF23.dll"

sh=338EC4415F8F0EE17406CBE4C6215B9895B0B505 ft=1 fh=085f8d6070140a28 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF4.dll"

sh=9BB9757701322F4653A8EB3BAEDDB0D9ECD402B4 ft=1 fh=3f4d8d96e7c6f404 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF5.dll"

sh=EB85CECA9EEB234E09FB629C1DE3ADC8ABD4FCBE ft=1 fh=08513e6dc8e44648 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF6.dll"

sh=56F53D2002348208DAFDDA5AAB6C8F3958F03248 ft=1 fh=b522cb188b038203 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF7.dll"

sh=C8CCE323F2393437706E8D0B51187C16E5BCD517 ft=1 fh=a17433176ef1c406 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF8.dll"

sh=3023B377F3E647CB7411246B90CDA78D74528317 ft=1 fh=5ed0f826a030ce84 vn="Variante von Win32/Toolbar.SearchSuite.Q evtl. unerwünschte Anwendung" ac=I fn="C:\$RECYCLE.BIN\S-1-5-21-634998973-2183486359-2024787897-1003\$R7IUTUW\extensions\{C9A9F8AD-4684-4E9F-A2A1-D88D1DEE44A2}\components\DatamngrHlpFF9.dll"

sh=02F80A5EFE9C47FFC9688ADD77D038671D09BB8B ft=1 fh=95ad321b505380d3 vn="Variante von Win32/Toolbar.CrossRider.AW evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Browser App\Uninstall.exe.vir"

sh=A850D23AD98C56A2952EE9DDFDFF334FFD82B957 ft=1 fh=599b84254fa99bb8 vn="Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Browser App\utils.exe.vir"

sh=FA82D6954AC54809F67D65FF5A39E9858FBE64C4 ft=1 fh=eea51c81a368967b vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\fst_de_76\fst_de_76.exe.vir"

sh=524ED1264811258D64BA2BE8B48005C6D1935713 ft=1 fh=19b60c262a337e59 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\DpInterface64.dll.vir"

sh=72971E4B87542575A876B36FB87879B416F4EC88 ft=1 fh=eb8c71c588367618 vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\DpInterfacef32.dll.vir"

sh=01C9B3D0E073B824021B29F1FD957A8643DF6931 ft=1 fh=9d9cb38b273b86fe vn="Variante von Win32/ELEX.AR evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\RSHP.exe.vir"

sh=F34BB16FA7EEF85B106A7C3A3FDEEE95ECF18001 ft=1 fh=7bd5299d4d87abc5 vn="Win32/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SearchProtect32.dll.vir"

sh=FB15CD6ADCD9BDFBF68D5DF5EAEA02BF329F8D4F ft=1 fh=dfa2b1c2f56e7303 vn="Win64/Thinknice.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SearchProtect64.dll.vir"

sh=B733C40B96BCA6CC139230D0F7C4E51CEC12CF35 ft=1 fh=08ea3c71e6c55c1b vn="Win32/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SpAPPSv32.dll.vir"

sh=D6F9F256C03B81C01D6CFF28D2D966F59F786AC3 ft=1 fh=3a3e287aa52ff7e5 vn="Variante von Win64/Thinknice.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SpAPPSv64.dll.vir"

sh=BFFE82D82714D7C2C078D7027BA093F66028CD50 ft=1 fh=5663110f243ad63b vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Finn.Medion-PC\AppData\Local\iLivid\Helper.dll.vir"

sh=F1B646921B04861D62E433D00052DABD42BFBBAD ft=1 fh=422c75c0df1448ad vn="Variante von Win32/Toolbar.SearchSuite.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Finn.Medion-PC\AppData\Local\iLivid\Uninstall.exe.vir"

sh=2FBD906A786E4DC8E7FD951493AE469F2E640B24 ft=1 fh=b7fcb82db5407d37 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\upfst_de_76.exe.vir"

sh=C00396DCC821996A03380C91533802882A17A7F1 ft=1 fh=bc33f9dfe31f89e4 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majfst.exe.vir"

sh=C623F54CAB59A739E2DF58905AE44293D62A9E5B ft=1 fh=f9568ab585748cf5 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majfst_gentlede.exe.vir"

sh=4C150C4D71A46B09B13314A284DAF2BFD6E3DAFB ft=1 fh=1ee738fec9d27fa1 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\fst_de_76\Download\majmp_gentleeu.exe.vir"

sh=2552432501BB1817A86FB4CD141C2AA1B8E34650 ft=1 fh=d4b3877a3411dcbb vn="Variante von Win32/Speedchecker.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Local\Temp\OCS\Downloads\3fb4024f7caf3a01809ef819569822ba\10806ff987a45c60eaa975e4aab3d1a1\pcspeedup.exe.vir"

sh=E0814D0F17EE1122F6D3507DC676030F8E1CC133 ft=1 fh=0e0f46db8e6ee8c4 vn="Win32/Toolbar.Babylon.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\BabSolution\Shared\BabMaint.exe.vir"

sh=BE3A5951F9D566E9C0B10B41781E42A3A8562B12 ft=1 fh=bfe637157b287a9d vn="Variante von Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\BabSolution\Shared\enhancedNT.dll.vir"

sh=BD310B4FE9F62360DF0001FBFE46CAD8225E7DDB ft=1 fh=1f0ad2adf900abdf vn="Variante von Win32/RiskWare.Astori.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\InetStat\inetstat.exe.vir"

sh=EC7EC5D60C5A578BC9953115D368BECD05BA14B2 ft=1 fh=ecbff00cc7dcc0fd vn="Variante von Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Medion\AppData\Roaming\SupTab\SupTab.dll.vir"

sh=F3F91E0B76EF58119652FDCD93902F8F295959D5 ft=1 fh=701dd8335a58b5ae vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"

sh=D7FD907C3FAD3C161F00D773D199BCD7FDA5D39A ft=1 fh=2633daedce4e79c1 vn="Variante von Win32/Systweak.N evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\ADRHelper.dll"

sh=563D9ADE59AF78202113BA23F3B3B6D55F09FEAC ft=1 fh=5b088e17a69223e2 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\AdvancedDiskRecovery.exe"

sh=CBE99E078C0A7CCA56988F65678A131AE0A88C64 ft=1 fh=80a6e745a93cc281 vn="Variante von Win32/Systweak.M evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\Advanced Disk Recovery\Network.dll"

sh=6506F2C746CB98CC8A93D4466B2DBC0E7502CDAF ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\ProgramData\Spybot - Search & Destroy\Recovery\DealPly10.zip"

sh=6506F2C746CB98CC8A93D4466B2DBC0E7502CDAF ft=0 fh=0000000000000000 vn="Win32/Bagle.gen.zip Wurm" ac=I fn="C:\Users\All Users\Spybot - Search & Destroy\Recovery\DealPly10.zip"

sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\ICReinstall_ZipExtractorSetup.exe"

sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\YfEsob1O.exe.part"

sh=61D62F5BE1FC947C9ACC61F260E2E44A230AA7AF ft=1 fh=049cf51099fb3b2c vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\is1590112554\DeltaTB.exe"

sh=E894D6F9F5A33D186D7759BF61D463975A0C244E ft=1 fh=dafad1154282da69 vn="Variante von Win32/DealPly.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\is1590112554\dp.exe"

sh=9E000F793452E8E9887DA45CA42F87667017553B ft=1 fh=358962b414b27b14 vn="Win32/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nsa1AD2.tmp\Helper.dll"

sh=DC14547C089F47D4A61ECBAB5E1EC36319A58AAD ft=1 fh=1c398b16d35a224b vn="Win32/Toolbar.SearchSuite.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nscBEC4.tmp\Helper.dll"

sh=BC99A693F771E64DF87BBA8FA352F94C9E75AE7F ft=1 fh=66a07435c4c1d0a2 vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nskD681.tmp\Helper.dll"

sh=BFFE82D82714D7C2C078D7027BA093F66028CD50 ft=1 fh=5663110f243ad63b vn="Variante von Win32/Toolbar.SearchSuite.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\AppData\Local\temp\nsw7FDF.tmp\Helper.dll"

sh=D08BD350E0531B2DDDC4E81A69B001B2D0550003 ft=1 fh=f6585e7df79a84bc vn="Win32/Toolbar.SearchSuite evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\iLividSetup-r887-n-bf.exe"

sh=C1F9091072EE8DE34FACD06D3CF59E6FFE89D6C1 ft=1 fh=57d847f4c74487d2 vn="Variante von Win32/InstallIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\mediaplayer_d599114.exe"

sh=FF17474D978D3D40B25E55D01B72AF83B803C542 ft=1 fh=432cea435834e99b vn="Variante von Win32/InstallCore.AZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\Minecraft.exe"

sh=9A34CA7020397481A60785BE69663D99DA890EDB ft=1 fh=fbc1c3de74ac175d vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_fiesta-online(1).exe"

sh=9A34CA7020397481A60785BE69663D99DA890EDB ft=1 fh=fbc1c3de74ac175d vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_fiesta-online.exe"

sh=9DC73A452ED6992EE6ADC285A8E8D97A6DE1B7EA ft=1 fh=92bdd2019f869f39 vn="Win32/SoftonicDownloader.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\SoftonicDownloader_fuer_openarena.exe"

sh=2441625BDB687035A7D2F976B293539031679F85 ft=1 fh=ab5a4f667b4dace9 vn="Win32/InstallCore.BN evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Finn.Medion-PC\Downloads\ZipExtractorSetup.exe"

sh=0A12774E4D19A9867069C8D3CD3E380D7CB2F59C ft=1 fh=c950eacd9b1cc265 vn="Win32/Wajam.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\26X8T3Q5\WajamChecker[1].exe"

sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX4TV03G\sp-downloader[1].exe"

sh=A2853D27C2378B9065DEB3C69C5CF608F7C2EE1D ft=1 fh=620a1940836c8b2c vn="Win32/Wajam.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FX4TV03G\wajam_download[1].exe"

sh=9A485800A5B8864DB8B09D1C35F9DCF2C6D24FC9 ft=1 fh=09535bb5f69dbeba vn="JS/Superfish.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RE23NNJI\FastPlayerSetup[1].exe"

sh=A01CAE4A9C48BEB8A490C3E88CB03F9B95C31671 ft=1 fh=5c1219a5576ddaa1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RE23NNJI\sp-downloader[1].exe"

sh=08A0F0FDF49B86F8FD0547594BDC3F7455330836 ft=1 fh=e3ad9ceca28a6528 vn="MSIL/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe"

sh=BD310B4FE9F62360DF0001FBFE46CAD8225E7DDB ft=1 fh=1f0ad2adf900abdf vn="Variante von Win32/RiskWare.Astori.A Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe"

sh=405722F95E77DFD774E00CE3B9ABFA9C5EB2177A ft=1 fh=1a57d4714e847f48 vn="Variante von Win32/ELEX.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe"

sh=405722F95E77DFD774E00CE3B9ABFA9C5EB2177A ft=1 fh=1a57d4714e847f48 vn="Variante von Win32/ELEX.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\29c2217fff8359d2c648e0ce94c6c82b\sweetpage_294wld.exe"

sh=9A485800A5B8864DB8B09D1C35F9DCF2C6D24FC9 ft=1 fh=09535bb5f69dbeba vn="JS/Superfish.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\5F86tmp\fastplayersetup.exe"

sh=A2853D27C2378B9065DEB3C69C5CF608F7C2EE1D ft=1 fh=620a1940836c8b2c vn="Win32/Wajam.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\6082tmp\wajam_download.exe"

sh=1A9C2CE8C1F539AC8546D67C9F924AEA8D2A84C2 ft=1 fh=d348c3328e970e39 vn="Win32/MyPCBackup.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\9FB0tmp\cloud_backup_setup.exe"

sh=8E7D9F1AEB7A9F9F544CE537DA336E2FD9D8EB89 ft=1 fh=e5f85f840a14464b vn="Variante von Win32/Toolbar.Babylon.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\BExternal.dll"

sh=E2BA5F8A7BD2BAF32FF31730BAD873C8E7957030 ft=1 fh=6e8622963c31f56a vn="Variante von Win32/Toolbar.Babylon.P evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\BUSolution.dll"

sh=C48D1C278D0434F3BBAF273134265DBA5F720003 ft=1 fh=bedeb8cbd68127e1 vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\BE87F1FD-BAB0-7891-8634-F4B0DDAD5465\Latest\IEHelper.dll"

sh=BE3A5951F9D566E9C0B10B41781E42A3A8562B12 ft=1 fh=bfe637157b287a9d vn="Variante von Win32/Toolbar.Babylon.W evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\busCFD4\enhancedNT.dll"

sh=282501AA2FA177D942282F8E2EB5E1D25CA17AED ft=1 fh=170a29edd91c8b10 vn="Variante von Win32/ELEX.AV evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\fullpackage_temp1399044609\tmp\SupTab.exe"

sh=9B1F0EEE614F804B5F3A5D453E622887561CA67D ft=1 fh=963483e35a072738 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-760M2.tmp\package_secprotwhite_installer_multilang.exe"

sh=78B7784F26F659C15584E94D3AFCA2B9E4713388 ft=1 fh=e00c3651e0f9a968 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-7TC6A.tmp\gentlemjmp_ieu.exe"

sh=FC7EE82134C066AA506993947B136ACCF820AB62 ft=1 fh=680b986437d00b66 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-M4BNK.tmp\gentlemjfst_ide.exe"

sh=04E76210641FD4DD0BDD4740F4CBF4D9CE6CA61F ft=1 fh=7b6578cfa001935f vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-OAJBJ.tmp\gentlemjfst_ide.exe"

sh=B719CF8DFB677DA920526CAAB3969F52614B480A ft=1 fh=a71701400b5f8e85 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-OBUU1.tmp\package_regclean_installer_multilang.exe"

sh=FEC182DA4F4421E2A39C0F61F294FC9BC3120F06 ft=1 fh=ed696abae9df72b1 vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-RLD4K.tmp\package_regclean_installer_multilang.exe"

sh=AAB69675FBE99009D8D23FD1F53445314C73CFAC ft=1 fh=a16dc0ffdb2dee5d vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-RLD4K.tmp\package_secprotkeys_installer_multilang.exe"

sh=08D53FE023E306F28F75FF8C47757FF82BDE7E31 ft=1 fh=7f78c331c1ef865d vn="Win32/AdWare.EoRezo.AW Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is-VRLRM.tmp\gentlemjfst_ide.exe"

sh=61D62F5BE1FC947C9ACC61F260E2E44A230AA7AF ft=1 fh=049cf51099fb3b2c vn="Variante von Win32/Toolbar.Babylon.E evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\DeltaTB.exe"

sh=E894D6F9F5A33D186D7759BF61D463975A0C244E ft=1 fh=dafad1154282da69 vn="Variante von Win32/DealPly.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\dp.exe"

sh=CBA067E7431BD177E93A8D585A5E15DA3E6AEDEE ft=1 fh=de9f46930f8cb608 vn="Win32/WebCake.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\is357113909\Setup-D502DD2B71B5.exe"

sh=42385D001D8895D030AC6A69777429B38A36EE33 ft=1 fh=f4db516d96fa1fb1 vn="Win32/Packed.VMDetector.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsd8C1A.tmp\nsvmd.dll"

sh=EBA5B4F9BF67F500BDB7D882843F14C1C6DD3748 ft=1 fh=c71c00119068a4e7 vn="Variante von Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsqCBF8.tmp\InstallerUtils.dll"

sh=53E11BE4BAF194722E9B78297134D28A62A929C7 ft=1 fh=5cfe05ba4fa99274 vn="Variante von Win32/Packed.VMDetector.I evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\AppData\Local\Temp\nsqCBF8.tmp\InstallerUtils2.dll"

sh=6BAD27D0A44A8B3DB8810E9D058F272D63BF47C5 ft=1 fh=95d748b786eee0d6 vn="Variante von Win32/SoftPulse.O evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Medion\Downloads\Player_Setup.exe"

sh=A6C2FFBE6DC47703332C4CC0B0B633AFB88DFD71 ft=1 fh=d165f6180e2e9d3a vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\bsplayer257.1051EN_clip.exe"

sh=563E1B707747F87BD96829B81E92CA1EE04E83FD ft=1 fh=421b349ff9c9cc9b vn="Win32/InstallMonetizer.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeOCR-5.02.exe"

sh=1C72D724B7045DA93AAF595D8BCD0D8D6C396B70 ft=1 fh=1346f15d448954b3 vn="Variante von Win32/Toolbar.Conduit.AI evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeSoundRecorder.exe"

sh=8547D1E5EACE099ECFE5EDBF6958FA077650894B ft=1 fh=61435738673b6524 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(1).exe"

sh=07CF040FEFA25DFDA4287BAB632EAB806E294695 ft=1 fh=0db8f293d4a19d8f vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(2).exe"

sh=596D78A7F03D1DAEE86BCCE8DD7713AA60E8F9E4 ft=1 fh=8eaf1d336ac02ccc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter(3).exe"

sh=2C4EB8EB07C36FCCEEF9B7947D302110770E283C ft=1 fh=5f86e2b26a146a3a vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter.exe"

sh=BEB2872C5EE9890C656B293C5EFBAD0220B4E538 ft=1 fh=3852d8d68dbe73c3 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\FreeYouTubeToMP3Converter31014.exe"

sh=6CF8A9F031B45F70BE3E66E7ACC7449CDA15FA34 ft=1 fh=2de4b6f517306153 vn="Win32/Toolbar.Widgi evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\PDFCreator-1_2_3_setup.exe"

sh=9434866971DD357600C9F2B1E31B7893C3A070F0 ft=1 fh=4f14aeb246e47811 vn="Win32/InstallMonetizer.AQ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\PDFCreator-1_7_1_setup.exe"

sh=946CFC9752B40BF2554A4B93E485B438DDCCDAA7 ft=1 fh=df61aa7cad693a34 vn="Win32/SoftonicDownloader.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Downloads\SoftonicDownloader_fuer_icolorfolder.exe"

sh=723D315206A52C4CE6BE51080EAE93F13ACDBD86 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Dropbox\Desktop\Alte Firefox-Daten\xrnq0niu.default\extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com\extensionData\plugins\194_retargeting_bi_m.js.js"

sh=DEBF208882FC35746679473CE0C804521CEC67CC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Miriam II\Dropbox\Desktop\Alte Firefox-Daten\xrnq0niu.default\extensions\7125a285-7e68-47aa-9d72-e81874f4d47e@d3fcdb92-135d-4a8a-8cf6-11e3b57c5fda.com\extensionData\plugins\91_monetizationLoader.js.js"

sh=5BA2A1AB903E6B0FAC7FD1B0BC4B4F32262BAC67 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\19c650.msi"

sh=9B57C1B23D98E4E31E8DC947B3ED587A0CA19C39 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\19c656.msi"

Hier Security Check, wobei ich nicht weiß, ob dabei wichtig ist, dass ich meinen Administrator Account eigentlich nie nutze. Ich hatte mal irgrendwo gelesen, dass es sicherer wäre, man würde einen zweiten Account ohne Administrator Rechte anlegen, von dem man arbeitet (stimmt das überhaupt?).
Nutze also eigentlich immer den anderen Account (Miriam II). Sollte ich da auch noch Security Check laufen lassen, oder checkt das alle Accounts (sorry, keine Ahnung von Computern :pfeiff: ).

Code:

 Results of screen317's Security Check version 0.99.89  

 Windows 7 Service Pack 1 x86 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Trend Micro Titanium Maximum Security   

 Antivirus up to date!   
 `````````Anti-malware/Other Utilities Check:````````` 

 Spyware Terminator 2012   

 Secunia PSI (3.0.0.7011)   

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java 7 Update 67  

 Adobe Flash Player         15.0.0.152  

 Adobe Reader XI  

 Mozilla Firefox 32.0.3 Firefox out of Date!  

 Mozilla Thunderbird (17.0.) 

 Google Chrome 37.0.2062.124  

 Google Chrome 38.0.2125.104  
 ````````Process Check: objlist.exe by Laurent````````  

 WinPatrol winpatrol.exe 

 BillP Studios WinPatrol WinPatrol.exe  

 Trend Micro Titanium plugin TMAS\TMAS_WLM\TMAS_WLMMon.exe 

 Trend Micro AMSP coreServiceShell.exe  

 Trend Micro UniClient UiFrmWrk uiWatchDog.exe 

 Trend Micro AMSP coreFrameworkHost.exe  

 Trend Micro UniClient UiFrmWrk uiSeAgnt.exe 
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-10-2014

Ran by Medion (administrator) on MEDION-PC on 23-10-2014 14:42:48

Running from C:\Users\Medion\Downloads

Loaded Profiles: Medion & Miriam II (Available profiles: Medion & Finn & Miriam II)

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-LogRotatorService.exe

(BlueStack Systems, Inc.) C:\Program Files\BlueStacks\HD-UpdaterService.exe

(Teruten) C:\Windows\System32\FsUsbExService.Exe

(Nero AG) C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe

() C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe

(Secunia) C:\Program Files\Secunia\PSI\psia.exe

(Secunia) C:\Program Files\Secunia\PSI\sua.exe

(SMART Technologies) C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe

(Crawler.com) C:\Program Files\Spyware Terminator\st_rsser.exe

(Telefónica I+D) C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe

(TomTom) C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE

(BillP Studios) C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe

(Akamai Technologies, Inc.) C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\GROOVE.EXE

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495728 2010-03-30] (IDT, Inc.)

HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)

HKLM\...\Run: [BlueStacks Agent] => C:\Program Files\BlueStacks\HD-Agent.exe [819984 2014-03-13] (BlueStack Systems, Inc.)

HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [143792 2013-10-09] (Trend Micro Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)

HKLM\...\Run: [WLM] => C:\Program Files\Trend Micro\Titanium\Plugin\TMAS\TMAS_WLM\TMAS_WLMMon.exe [44152 2013-07-23] (Trend Micro Inc.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [720064 2013-04-22] (Microsoft Corporation)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [MobileDocuments] => C:\Program Files\Common Files\Apple\Internet Services\ubd.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [WinPatrol] => C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe [436800 2013-07-15] (BillP Studios)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps] => "C:\Users\Medion\AppData\Roaming\Allmyapps\Allmyapps.exe" startup

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Allmyapps Update] => "C:\Users\Medion\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe" check startup

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Medion\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.)

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-634998973-2183486359-2024787897-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [SpywareTerminatorUpdate] => C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [TomTomHOME.exe] => C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe [248176 2014-06-05] (TomTom)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [WEB.DE Application {sync-000021}] => C:\Users\Miriam II\AppData\Local\WEB.DE Application {sync-000021}\webde_onlinespeicher.exe [792576 2014-06-04] (1&1 Mail & Media GmbH)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [1und1DispatcherCorp] => C:\Users\Miriam II\AppData\Local\1und1UpdaterCorpE\SchedDispatcher.exe [220808 2013-05-29] (1&1 Mail & Media GmbH)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [22734160 2014-08-08] (Google)

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [LogonHoursAction] 2

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\Policies\system: [DontDisplayLogonHoursWarnings] 1

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb65-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {362dbb86-accf-11e1-b782-00262dbfe53b} - F:\AutoRun.exe

HKU\S-1-5-21-634998973-2183486359-2024787897-1004\...\MountPoints2: {b636cf64-b326-11e1-b7d9-00262dbfe53b} - F:\AutoRun.exe

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft SharePoint Workspace.lnk

ShortcutTarget: Microsoft SharePoint Workspace.lnk -> C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 1] -> {02B2B772-B8A8-4DA4-9B18-42551A54A1A8} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 2] -> {0575AB16-E932-4160-8936-4DBE195BDBD7} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 3] -> {0E9EF89A-96D3-4DE6-B2F8-E9548AA5321E} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ 1&1 Sync Overlay 4] -> {1A4AFFE1-B2F9-483D-B627-D9A339DBFD34} => C:\Program Files\Common Files\1&1 Sync\1&1SyncShellExtension_1_0_0_1_20140611230547711.dll (1&1 Mail & Media GmbH)

ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File

ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google)

BootExecute: autocheck autochk * sdnclean.exe

GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1004\User: Group Policy restriction detected <======= ATTENTION

GroupPolicyUsers\S-1-5-21-634998973-2183486359-2024787897-1003\User: Group Policy restriction detected <======= ATTENTION

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

ProxyServer: :0

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

BHO: TSToolbarBHO -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

BHO: SMART Notebook Download Utility -> {67BCF957-85FC-4036-8DC4-D4D80E00A77B} -> C:\Program Files\SMART Technologies\Education Software\NotebookPlugin.dll (SMART Technologies ULC.)

BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll No File

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\TmBpIe32.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.)

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default

FF NewTab: chrome://quick_start/content/index.html

FF Keyword.URL: user_pref("keyword.URL", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/OfficeLive,version=1.4 -> C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.7 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.0.8 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)

FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-images.xml

FF SearchPlugin: C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\searchplugins\google-maps.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011-08-17]

FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1173\8.0.1173\firefoxextension [2014-09-04]

FF HKLM\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension

FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-05-14]

FF HKLM\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension

FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-05-15]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Medion\AppData\Roaming\Mozilla\Firefox\Profiles\q5jk1lre.default\extensions\cliqz@cliqz.com
 

Chrome: 

=======

CHR Profile: C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Präsentationen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]

CHR Extension: (Google Docs) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-19]

CHR Extension: (Google Drive) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-19]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-10-20]

CHR Extension: (YouTube) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-19]

CHR Extension: (Google-Suche) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-19]

CHR Extension: (Google Tabellen) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]

CHR Extension: (Google Wallet) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-19]

CHR Extension: (Google Mail) - C:\Users\Medion\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-19]
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [402192 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [385808 2014-03-13] (BlueStack Systems, Inc.)

R2 BstHdUpdaterSvc; C:\Program Files\BlueStacks\HD-UpdaterService.exe [770832 2014-03-13] (BlueStack Systems, Inc.)

S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1074480 2013-09-14] (Flexera Software LLC)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2009-03-31] (Teruten) [File not signed]

R2 HTCMonitorService; C:\Program Files\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2013-11-18] (Nero AG)

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]

R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]

S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)

R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]

R2 SMARTHelperService; C:\Program Files\SMART Technologies\Education Software\SMARTHelperService.exe [539952 2013-10-18] (SMART Technologies)

R2 ST2012_Svc; C:\Program Files\Spyware Terminator\st_rsser.exe [587912 2013-04-03] (Crawler.com)

R2 STacSV; c:\program files\idt\wdm\STacSV.exe [225382 2010-03-30] (IDT, Inc.)

R2 TGCM_ImportWiFiSvc; C:\Program Files\o2\Mobile Connection Manager\ImpWiFiSvc.exe [200624 2010-09-29] (Telefónica I+D)

S3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [113152 2009-03-04] (Wistron Corp.) [File not signed]

R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]

S4 vToolbarUpdater15.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.3.0\ToolbarUpdater.exe [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [113424 2014-03-13] (BlueStack Systems)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-03-31] () [File not signed]

S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)

S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV32.sys [105984 2009-10-27] (QUALCOMM Incorporated)

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-07-03] (Secunia)

R3 SMARTMouseFilterx86; C:\Windows\System32\DRIVERS\SMARTMouseFilterx86.sys [8192 2013-10-18] (SMART Technologies)

R3 SMARTVHidMini2000x86; C:\Windows\System32\DRIVERS\SMARTVHidMini2000x86.sys [7680 2013-03-07] (SMART Technologies)

S3 SMARTVTabletPCx86; C:\Windows\System32\DRIVERS\SMARTVTabletPCx86.sys [15872 2013-03-07] (SMART Technologies ULC)

R1 sp_rsdrv2; C:\Windows\system32\drivers\sp_rsdrv2.sys [32768 2011-06-21] () [File not signed]

S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI)

S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation)

S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation)

R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [103416 2013-12-03] (Trend Micro Inc.)

R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [290376 2013-12-03] (Trend Micro Inc.)

R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC32.sys [40736 2013-07-01] (Trend Micro Inc.)

R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [85280 2013-06-13] (Trend Micro Inc.)

R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [83864 2013-12-03] (Trend Micro Inc.)

R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [282272 2013-05-22] (Trend Micro Inc.)

R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [92304 2012-05-02] (Trend Micro Inc.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)

S3 catchme; \??\C:\Users\Medion\AppData\Local\Temp\catchme.sys [X]

S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]

U2 TMAgent; No ImagePath

S3 uxddrv; \??\E:\DIAGNOSE\WSTGER32\2PART\uxddrv86.sys [X]

S3 XDva401; \??\C:\Windows\system32\XDva401.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-23 14:42 - 2014-10-23 14:42 - 00000000 ____D () C:\Users\Medion\Downloads\FRST-OlderVersion

2014-10-23 14:25 - 2014-10-23 14:25 - 00854448 _____ () C:\Users\Medion\Desktop\SecurityCheck.exe

2014-10-22 21:01 - 2014-10-22 21:02 - 02347384 _____ (ESET) C:\Users\Medion\Downloads\esetsmartinstaller_deu.exe

2014-10-21 23:25 - 2014-10-22 10:53 - 00000000 ____D () C:\Users\Medion\Desktop\trojaner board II

2014-10-21 23:20 - 2014-10-21 23:21 - 00038166 _____ () C:\Users\Medion\Downloads\Addition.txt

2014-10-21 23:19 - 2014-10-23 14:42 - 00026605 _____ () C:\Users\Medion\Downloads\FRST.txt

2014-10-21 23:18 - 2014-10-23 14:42 - 01103360 _____ (Farbar) C:\Users\Medion\Downloads\FRST.exe

2014-10-21 23:11 - 2014-10-21 23:11 - 00000000 ____D () C:\Users\Miriam II\Downloads\FRST-OlderVersion

2014-10-21 23:05 - 2014-10-21 23:05 - 01706144 _____ (Thisisu) C:\Users\Medion\Downloads\JRT.exe

2014-10-21 22:48 - 2014-10-21 22:57 - 00000000 ____D () C:\AdwCleaner

2014-10-21 22:47 - 2014-10-21 22:47 - 01962496 _____ () C:\Users\Medion\Downloads\AdwCleaner_4.001.exe

2014-10-21 21:41 - 2014-10-21 21:41 - 00000048 _____ () C:\Users\Public\Documents\_rgpl

2014-10-21 20:31 - 2014-10-21 20:31 - 00000000 ____D () C:\Program Files\VS Revo Group

2014-10-21 20:29 - 2014-10-21 20:30 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Medion\Downloads\revosetup95.exe

2014-10-20 21:21 - 2014-10-20 21:21 - 00000000 ____D () C:\Users\Medion\AppData\Local\com

2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-10-20 21:17 - 2014-10-20 21:17 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-10-20 21:14 - 2014-10-20 21:15 - 01209696 _____ () C:\Users\Medion\Downloads\Player_Setup.exe

2014-10-20 20:44 - 2014-10-20 20:44 - 00007805 _____ () C:\Users\Miriam II\Desktop\GMER.txt

2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2014-10-20 20:36 - 2014-10-20 20:36 - 00000000 ____D () C:\Program Files\7-Zip

2014-10-20 20:34 - 2014-10-20 20:35 - 01110476 _____ () C:\Users\Miriam II\Downloads\7z920.exe

2014-10-20 17:30 - 2014-10-20 17:30 - 00146376 _____ () C:\Windows\Minidump\102014-18891-01.dmp

2014-10-20 17:15 - 2014-10-20 17:16 - 00380416 _____ () C:\Users\Miriam II\Downloads\Gmer-19357.exe

2014-10-20 17:06 - 2014-10-20 17:07 - 00043008 _____ () C:\Users\Miriam II\Downloads\Addition.txt

2014-10-20 17:04 - 2014-10-21 23:13 - 00044365 _____ () C:\Users\Miriam II\Downloads\FRST.txt

2014-10-20 11:46 - 2014-10-23 14:42 - 00000000 ____D () C:\FRST

2014-10-20 11:44 - 2014-10-21 23:11 - 01102336 _____ (Farbar) C:\Users\Miriam II\Downloads\FRST.exe

2014-10-20 11:41 - 2014-10-20 11:42 - 00000474 _____ () C:\Users\Miriam II\Downloads\defogger_disable.log

2014-10-20 11:41 - 2014-10-20 11:41 - 00000000 _____ () C:\Users\Medion\defogger_reenable

2014-10-20 11:39 - 2014-10-20 11:40 - 00050477 _____ () C:\Users\Miriam II\Downloads\Defogger.exe

2014-10-20 10:53 - 2014-10-20 10:53 - 01054912 _____ (Adobe) C:\Users\Miriam II\Downloads\install_flashplayer15x32au_mssd_aaa_aih.exe

2014-10-16 14:10 - 2014-10-10 03:44 - 00396288 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-10-16 14:10 - 2014-10-10 03:44 - 00230912 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2014-10-16 14:10 - 2014-10-10 03:39 - 00302592 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-10-16 14:10 - 2014-09-29 02:41 - 02379264 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-10-16 14:09 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-10-16 14:09 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-10-16 14:09 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-10-16 14:09 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-10-16 14:09 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-10-16 14:09 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-10-16 14:09 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-10-16 14:09 - 2014-09-19 03:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-10-16 14:09 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-10-16 14:09 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-10-16 14:09 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-10-16 14:09 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-10-16 14:09 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-10-16 14:09 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-10-16 14:09 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-10-16 14:09 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-10-16 14:09 - 2014-09-19 02:50 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-10-16 14:09 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-10-16 14:09 - 2014-09-19 02:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-10-16 14:09 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-10-16 14:09 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-10-16 14:09 - 2014-09-19 02:20 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-10-16 14:09 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-10-16 14:09 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-10-16 14:09 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-10-16 14:09 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-10-16 14:09 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-10-16 14:09 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll

2014-10-16 14:09 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 02744320 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-10-16 14:08 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll

2014-10-16 14:08 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-10-16 14:08 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00304128 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe

2014-10-16 14:08 - 2014-07-17 03:39 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-10-16 14:08 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-10-16 14:08 - 2014-07-17 03:03 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys

2014-10-16 14:08 - 2014-07-17 03:02 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-10-16 14:08 - 2014-07-09 03:29 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-10-16 14:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-10-16 14:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-10-16 14:07 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll

2014-10-03 07:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-10-01 22:17 - 2014-10-01 22:17 - 00006787 _____ () C:\Users\Miriam II\Downloads\print.action

2014-09-30 07:54 - 2014-09-30 07:55 - 00000000 ____D () C:\Users\Medion\AppData\Local\Skyrim

2014-09-23 19:53 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-10-23 14:36 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\tracing

2014-10-23 14:20 - 2014-07-17 22:09 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-10-23 14:20 - 2014-07-17 22:09 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-10-23 14:19 - 2011-04-14 21:53 - 00000000 ____D () C:\Users\Medion\AppData\Roaming\Skype

2014-10-23 14:18 - 2012-03-31 16:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-10-23 14:18 - 2011-04-06 10:26 - 01997620 _____ () C:\Windows\WindowsUpdate.log

2014-10-22 20:52 - 2010-05-05 18:08 - 00006264 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-10-22 17:25 - 2013-07-18 17:46 - 00000000 ____D () C:\ProgramData\Spyware Terminator

2014-10-22 17:24 - 2014-07-25 15:05 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\HTC MediaHub

2014-10-22 17:24 - 2014-07-17 22:24 - 00000000 ___RD () C:\Users\Miriam II\Google Drive

2014-10-22 17:23 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-10-22 17:23 - 2009-07-14 06:34 - 00018928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-10-22 17:15 - 2014-08-20 19:46 - 00720896 _____ () C:\Windows\system32\Ikeext.etl

2014-10-22 17:15 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-10-22 17:15 - 2009-07-14 06:39 - 00177627 _____ () C:\Windows\setupact.log

2014-10-22 10:34 - 2013-04-30 09:27 - 00000000 ____D () C:\Users\Medion\AppData\Local\Deployment

2014-10-22 10:30 - 2014-07-25 15:10 - 00000000 ____D () C:\Users\Medion\AppData\Local\HTC MediaHub

2014-10-21 22:58 - 2010-05-05 19:37 - 00340790 _____ () C:\Windows\PFRO.log

2014-10-21 22:57 - 2014-07-02 17:57 - 00001041 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2014-10-21 22:57 - 2014-07-02 17:57 - 00001011 _____ () C:\Users\Medion\Desktop\Search.lnk

2014-10-21 22:57 - 2013-07-26 12:24 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

2014-10-21 22:57 - 2013-07-26 12:24 - 00001011 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-10-21 22:57 - 2012-05-13 12:57 - 00000000 ____D () C:\Users\Medion\AppData\Local\CRE

2014-10-21 22:57 - 2011-04-19 18:23 - 00000000 ____D () C:\Users\Finn.Medion-PC

2014-10-21 22:57 - 2011-04-06 10:28 - 00001154 _____ () C:\Users\Medion\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-10-21 22:09 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\Microsoft.NET

2014-10-21 22:03 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Steam

2014-10-21 22:02 - 2011-11-28 14:24 - 00000000 ____D () C:\Program Files\BFDemos

2014-10-21 21:26 - 2010-05-05 17:57 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

2014-10-20 22:24 - 2014-09-19 17:09 - 00002125 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-10-20 21:17 - 2014-03-14 21:14 - 00000000 ___RD () C:\Program Files\Skype

2014-10-20 21:17 - 2011-04-14 21:52 - 00000000 ____D () C:\ProgramData\Skype

2014-10-20 19:11 - 2011-04-14 19:57 - 00144760 _____ () C:\Users\Medion\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-20 17:30 - 2014-05-17 09:08 - 355499801 _____ () C:\Windows\MEMORY.DMP

2014-10-20 17:30 - 2014-05-17 09:08 - 00000000 ____D () C:\Windows\Minidump

2014-10-20 11:41 - 2011-04-06 10:28 - 00000000 ____D () C:\Users\Medion

2014-10-20 10:56 - 2013-01-19 15:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-10-19 17:26 - 2011-09-05 21:15 - 00000000 ____D () C:\Users\Miriam II\Documents\Eigene Scans

2014-10-18 23:29 - 2011-04-26 14:29 - 00144760 _____ () C:\Users\Miriam II\AppData\Local\GDIPFONTCACHEV1.DAT

2014-10-18 22:13 - 2009-07-14 06:33 - 00484552 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-10-18 21:45 - 2011-11-28 15:01 - 00000000 ____D () C:\ProgramData\Schreib- und Leselabor 2

2014-10-18 19:12 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache

2014-10-18 16:31 - 2014-08-03 20:00 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Local\HTC MediaHub

2014-10-17 17:15 - 2014-07-02 17:57 - 00209432 _____ () C:\Windows\RegBootClean.exe

2014-10-17 16:42 - 2009-07-14 04:37 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-10-17 16:38 - 2014-05-01 00:36 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-10-17 16:38 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\de-DE

2014-10-17 02:23 - 2010-05-05 18:53 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-10-17 02:13 - 2013-07-27 10:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-10-17 01:10 - 2010-05-05 19:33 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-10-13 10:49 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\system32\NDF

2014-10-12 23:04 - 2009-07-14 06:53 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-10-02 09:55 - 2012-09-30 20:29 - 00000000 ____D () C:\Users\Miriam II\AppData\Local\Deployment

2014-09-30 07:41 - 2014-07-18 20:36 - 00000000 ____D () C:\Program Files\Common Files\Steam

2014-09-27 21:05 - 2012-09-26 17:18 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-09-27 02:23 - 2014-08-03 21:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-09-26 16:52 - 2012-11-18 19:32 - 00000000 ____D () C:\Users\Finn.Medion-PC\AppData\Roaming\.minecraft

2014-09-24 17:18 - 2012-03-31 16:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-09-24 17:18 - 2011-05-18 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-09-24 16:39 - 2011-05-02 16:27 - 00147064 _____ () C:\Users\Finn.Medion-PC\AppData\Local\GDIPFONTCACHEV1.DAT
 

Files to move or delete:

====================

C:\Users\Finn.Medion-PC\Minecraft Ram Launcher.exe
 
 

Some content of TEMP:

====================

C:\Users\Finn.Medion-PC\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel0.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel1.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel2.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel3.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel4.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\i4jdel5.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\propsys.dll

C:\Users\Finn.Medion-PC\AppData\Local\Temp\Softonic_DE_1-5-1.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Finn.Medion-PC\AppData\Local\Temp\zodr8l3a.dll

C:\Users\Medion\AppData\Local\Temp\0acncs1a.eea.exe

C:\Users\Medion\AppData\Local\Temp\1sv0noim.wxt.exe

C:\Users\Medion\AppData\Local\Temp\27353uninstall.exe

C:\Users\Medion\AppData\Local\Temp\amazonicon_v4.exe

C:\Users\Medion\AppData\Local\Temp\amazoninstallernircmdc.exe

C:\Users\Medion\AppData\Local\Temp\APNSetup.exe

C:\Users\Medion\AppData\Local\Temp\awtcmhrt.uzg.exe

C:\Users\Medion\AppData\Local\Temp\BackupSetup.exe

C:\Users\Medion\AppData\Local\Temp\dlLogic.exe

C:\Users\Medion\AppData\Local\Temp\dltr.exe

C:\Users\Medion\AppData\Local\Temp\erb3vygz.wnz.exe

C:\Users\Medion\AppData\Local\Temp\foxy_security_games.exe

C:\Users\Medion\AppData\Local\Temp\GCVerifier.dll

C:\Users\Medion\AppData\Local\Temp\iodhz2td.rks.exe

C:\Users\Medion\AppData\Local\Temp\Quarantine.exe

C:\Users\Medion\AppData\Local\Temp\sdanircmdc.exe

C:\Users\Medion\AppData\Local\Temp\sdapskill.exe

C:\Users\Medion\AppData\Local\Temp\sdaspwn.exe

C:\Users\Medion\AppData\Local\Temp\sdyfmtve.0ap.exe

C:\Users\Medion\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Medion\AppData\Local\Temp\Sqlite3.dll

C:\Users\Medion\AppData\Local\Temp\sweetpage_294wld.exe

C:\Users\Medion\AppData\Local\Temp\Uni000.exe

C:\Users\Medion\AppData\Local\Temp\vdoiuwkh.d1k.exe

C:\Users\Medion\AppData\Local\Temp\verifier.exe

C:\Users\Medion\AppData\Local\Temp\vfxpnvpx.lx3.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-10-18 19:03
 

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Probleme haben nachgelassen, wobei ich das noch nicht mit absoluter Sicherheit sagen kann, bin gerade zu wenig am Computer.
Auf jeden Fall will scheinbar eure Seite meine Bankdaten haben (laut Trend Micro). Schau heute Abend nochmal, ob die Probleme wieder auftauchen.
Gruß
Mika

Zitat:

Auf jeden Fall will scheinbar eure Seite meine Bankdaten haben (laut Trend Micro). Schau heute Abend nochmal, ob die Probleme wieder auftauchen.

Kannste davon einen Screenshot machen?

download ordner in deinem normalen Account leeren.

Firefox udpaten.

Wie füge ich den Screenshot denn hier ein?
Alles andere habe ich erledigt und es gibt keine unerwünschte Werbung mehr :-) !!!
Meine Internetverbindung spinnt immer noch manchmal rum.
Gruß
Mika

unten erweitert klicken, dann Anhänge verwalten :)

Hier die Screenshots, ich habe zwei gemacht, weil anscheinend innerhalb ein paar Minuten sehr häufig nach den Bankdaten gefragt wird. Ist auch unabhängig davon, ob noch ein anderes Fenster geöffnet ist.
Gruß
Mika

Das hat nix mit der Seite zu tun. Das ist ne Meldung von Trend Micro wenn Du einen Browser öffnest.

In welchem Browser kommt das?

Firefox, aber auch nicht bei jdem Account. Habe bei einem Adblocker und Noscript installiert, da passiert das nicht.
Muss ich noch irgendetwas tun oder müsste jetzt alles weg sein?
Gruß
Mika

Revo Uninstaller - Download - Filepony
damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.mozilla.org/de/kb/fi...einfach-loesen

Und ein FRST log aus dem besagten Account bitte.