|
Delta search toolbar und andere Ads by browser+ Apps hallöchen.... ich benörtige dringend hilfe! bei öffnen meiner Browsers (Opera) kommt immer als startseite delta home search.mein pc ist total verlangsamt! Bei der suche im internet mit google öffnet mir is immer als erstes anzeigen von ads by browser+ apps. Bitte helft mir! |
hi, Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 Ran by Vivien Förster (administrator) on VIVIENFÖRSTER on 22-05-2015 15:47:37 Running from C:\Users\Vivien Förster\Downloads Loaded Profiles: Vivien Förster (Available profiles: Vivien Förster) Platform: Windows 7 Home Premium (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 8 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forum ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe (XTab system) C:\Program Files (x86)\XTab\ProtectService.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Acer) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (FileProperties_CompanyName) C:\Program Files (x86)\fun4u\fun4u_notification_service.exe (browser) C:\Program Files (x86)\Browser+ Apps+\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe (SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe (XTab system) C:\Program Files (x86)\XTab\HPNotify.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe (Chicony) C:\Program Files (x86)\Video Web Camera\traybar.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Chicony) C:\Program Files (x86)\Video Web Camera\CEC_MAIN.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe () C:\Program Files (x86)\Opera\29.0.1795.60\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM-x32\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM-x32\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [503864 2009-07-21] (Conexant Systems, Inc.) HKLM-x32\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-19] (Synaptics Incorporated) HKLM-x32\...\Run: [Acer ePower Management] => C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [828960 2009-08-05] (Acer Incorporated) HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [588648 2009-07-25] (Symantec Corporation) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe [262912 2009-08-21] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [Camera Assistant Software] => C:\Program Files (x86)\Video Web Camera\traybar.exe [630784 2008-12-10] (Chicony) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1194504 2009-08-27] (Dritek System Inc.) HKLM-x32\...\Run: [DXM6Patch_981116] => C:\Windows\p_981116.exe [497376 1998-11-30] (Microsoft Corporation) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-07-18] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2015-02-20] (RealNetworks, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\Run: [Global Registration] => C:\Program Files (x86)\Packard Bell\Registration\GREG.exe [2844704 2009-07-31] (Acer Incorporated) HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\Run: [msnmsgr] => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\Policies\system: [LogonHoursAction] 2 HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: E - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: F - F:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {43251c25-5c40-11df-bb9f-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {43251c29-5c40-11df-bb9f-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {4ce31a24-53a1-11df-b11b-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {4ce31ac2-53a1-11df-b11b-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {4ce31ac4-53a1-11df-b11b-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {527cbcd6-7888-11df-ae27-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {6ca1a154-d8df-11e1-bba2-d10e42d81abb} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\Start.hta HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {9fb638dd-381b-11df-86ee-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {9fb638e4-381b-11df-86ee-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {9ffd5b3d-6799-11e1-bd23-acd1b65a66b9} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\DVR/AutoRun.exe start.exe HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {b920d96d-5504-11df-b689-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\MountPoints2: {cfee75c0-788f-11df-b779-00262d50379d} - E:\setup_vmc_lite.exe /checkApplicationPresence HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2009-07-14] (Microsoft Corporation) AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{16cdf~1\browse~1.dll => "c:\progra~3\browse~1\261339~1.144\{16cdf~1\browse~1.dll" File not found Startup: C:\Users\Vivien Förster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopnotes.lnk [2015-03-09] ShortcutTarget: Desktopnotes.lnk -> C:\Users\Vivien Förster\Downloads\desknote\desktopnotes.exe (No File) Startup: C:\Users\Vivien Förster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk [2010-07-13] ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = delta-homes HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = delta-homes HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = delta-homes HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = delta-homes HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Software\Microsoft\Internet Explorer\Main,Start Page = delta-homes HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = delta-homes HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Software\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = Babylon Search HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} URLSearchHook: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File URLSearchHook: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dsites_14_41_ie&cd=2XzuyEtN2Y1L1QzuyBtDtC0AtDyEtDyByD0CtAtDzy0DyEyBtN0D0Tzu0StCtDtCtBtN1L2XzutAtFyDtFtCtFtBtN1L1 CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCtAzyzyzy0F0D0CtG0FyC0AtBtGtAyD0F0BtG0A0F0CtCtGyCyC0B0DtC0D0AtCtCyE0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyD0D0Cy EyE0FtGzz0FyB0CtGyE0Dzy0EtGzyzyzy0AtG0BzzyDyEtC0FyE0EtCyE0C0C2Q&cr=203866892&ir= SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_dsites_14_41_ie&cd=2XzuyEtN2Y1L1QzuyBtDtC0AtDyEtDyByD0CtAtDzy0DyEyBtN0D0Tzu0StCtDtCtBtN1L2XzutAtFyDtFtCtFtBtN1L1 CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StCtAzyzyzy0F0D0CtG0FyC0AtBtGtAyD0F0BtG0A0F0CtCtGyCyC0B0DtC0D0AtCtCyE0C0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szz0EyD0D0Cy EyE0FtGzz0FyB0CtGyE0Dzy0EtGzyzyzy0AtG0BzzyDyEtC0FyE0EtCyE0C0C2Q&cr=203866892&ir= SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=1&sr=0&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=1410882464&from=tugs&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA&q={searchTerms} SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACPW SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=1&sr=0&q={searchTerms} SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.chatzum.com/?orig=DS&affid=62&cztbid=812862174&q={searchTerms} SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> BrowserMngrDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {1} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms} BHO: Browser+ Apps+ -> {11111111-1111-1111-1111-110611441149} -> C:\Program Files (x86)\Browser+ Apps+\Browser+ Apps+-bho64.dll [2014-09-16] (browser) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-03-04] (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-04] (Oracle Corporation) BHO-x32: Browser+ Apps+ -> {11111111-1111-1111-1111-110611441149} -> C:\Program Files (x86)\Browser+ Apps+\Browser+ Apps+-bho.dll [2014-09-16] (browser) BHO-x32: No Name -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> No File BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll [2014-08-12] (RealDownloader) BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll [2015-04-20] (Thinknice Co. Limited) BHO-x32: Symantec NCO BHO -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll [2009-08-16] (Symantec Corporation) BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\IPSBHO.DLL [2009-08-16] (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-04] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-04] (Oracle Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll [2009-08-16] (Symantec Corporation) Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKU\S-1-5-21-664774285-3076153036-1514180132-1000 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: symres - {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\coIEPlg.dll [2009-08-16] (Symantec Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-02-23] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-02-23] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-02-23] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-02-23] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default FF NewTab: hxxp://www.delta-homes.com/newtab/?type=nt&ts=1430317765&from=ient04290&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA FF DefaultSearchEngine: delta-homes FF SelectedSearchEngine: delta-homes FF Homepage: hxxp://www.delta-homes.com/?type=hp&ts=1430317765&from=ient04290&uid=ST9500325AS_6VE1V5JAXXXX6VE1V5JA FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-27] () FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll [2012-10-22] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-04] (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-27] () FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-04] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-04] (Oracle Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8064.0206 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2009-02-06] (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.4.19 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll [2015-02-20] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.4 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll [2014-08-12] (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.4.19 -> C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll [2015-02-20] (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll [2014-08-12] (RealDownloader) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-09-16] (globalUpdate) FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2014-09-16] (globalUpdate) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-22] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-22] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll [2015-02-20] (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll [2015-02-20] (RealPlayer) FF SearchPlugin: C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default\searchplugins\delta.xml [2013-06-04] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\delta-homes.xml [2015-04-29] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml [2014-09-16] FF Extension: Browser+ Apps - C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default\Extensions\56560a80-995b-47cd-852a-772f3a7ea92b@gmail.com [2015-02-20] FF Extension: fun4u - C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default\Extensions\o698XPPx@gmail.com [2015-04-19] FF Extension: xpath_finderxpath_findercom - C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default\Extensions\xpath_finder@xpath_finder.com [2015-04-19] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-25] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2015-02-20] FF HKLM-x32\...\Firefox\Extensions: [{1B12EF76-2B5E-4DA1-B587-4762D49BFE03}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKU\.DEFAULT\...\Firefox\Extensions: [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] - C:\ProgramData\Browser Manager\2.2.643.41\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension FF Extension: No Name - C:\Users\Vivien Förster\AppData\Roaming\Mozilla\Firefox\Profiles\6dc5r5mz.default\extensions\56560a80-995b-47cd-852a-772f3a7ea92b@gmail.com [not found] StartMenuInternet: FIREFOX.EXE - firefox.exe FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\my-prefs.js [2015-03-25] <==== ATTENTION (Points to *.cfg file) FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\my.cfg [2015-03-25] <==== ATTENTION Chrome: ======= CHR HKU\S-1-5-21-664774285-3076153036-1514180132-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bhphemoobgnikcoofkgackkaimpfmenm] - C:\Users\Vivien Förster\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx [2012-08-01] CHR HKLM-x32\...\Chrome\Extension: [bhphemoobgnikcoofkgackkaimpfmenm] - C:\Users\Vivien Förster\AppData\Local\CRE\bhphemoobgnikcoofkgackkaimpfmenm.crx [2012-08-01] CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Vivien Förster\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [Not Found] Opera: ======= OPR Extension: (Adblock Plus) - C:\Users\Vivien Förster\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2015-02-21] OPR Extension: (Browser+ Apps+) - C:\Users\Vivien Förster\AppData\Roaming\Opera Software\Opera Stable\Extensions\okhbpnfiofnpilolnjeebnidmkopeeda [2014-10-09] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG) R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [844320 2009-08-05] (Acer Incorporated) S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2009-09-26] (Macrovision Europe Ltd.) [] S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-09-16] (globalUpdate) [] <==== ATTENTION S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-09-16] (globalUpdate) [] <==== ATTENTION R2 Greg_Service; C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe [1150496 2009-06-04] (Acer Incorporated) R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158816 2015-04-20] (XTab system) R2 Norton Internet Security; C:\Program Files (x86)\Norton Internet Security\Engine\16.7.0.30\ccSvcHst.exe [117640 2009-08-16] (Symantec Corporation) R2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [62720 2009-08-21] (NewTech Infosystems, Inc.) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2014-08-12] () R2 Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [240160 2009-07-04] (Acer) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH) R1 BHDrvx64; C:\Windows\system32\drivers\NISx64\1007000.01E\BHDrvx64.sys [334384 2009-08-16] (Symantec Corporation) R1 ccHP; C:\Windows\system32\drivers\NISx64\1007000.01E\ccHPx64.sys [583296 2009-08-16] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [475696 2009-08-07] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090712.001\IDSVia64.sys [397360 2009-08-16] (Symantec Corporation) S3 SRTSP; C:\Windows\system32\drivers\NISx64\1007000.01E\SRTSP64.SYS [476720 2009-08-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1007000.01E\SRTSPX64.SYS [32304 2009-08-16] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1007000.01E\SYMEFA64.SYS [402992 2009-08-16] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2009-12-24] (Symantec Corporation) R3 SYMFW; C:\Windows\system32\drivers\NISx64\1007000.01E\SYMFW.SYS [120880 2009-08-16] (Symantec Corporation) R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [31280 2009-08-16] (Symantec Corporation) R3 SYMNDISV; C:\Windows\system32\drivers\NISx64\1007000.01E\SYMNDISV.SYS [56880 2009-08-16] (Symantec Corporation) R1 SYMTDI; C:\Windows\system32\drivers\NISx64\1007000.01E\SYMTDI.SYS [278576 2009-08-16] (Symantec Corporation) S3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.007\ENG64.SYS [X] S3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20090807.007\EX64.SYS [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-22 15:47 - 2015-05-22 15:48 - 00032281 _____ () C:\Users\Vivien Förster\Downloads\FRST.txt 2015-05-22 15:47 - 2015-05-22 15:47 - 00000000 ____D () C:\FRST 2015-05-22 15:46 - 2015-05-22 15:46 - 02108416 _____ (Farbar) C:\Users\Vivien Förster\Downloads\FRST64.exe 2015-05-17 17:41 - 2015-05-17 17:43 - 00000000 ____D () C:\Users\Vivien Förster\Downloads\Desy 2015-05-11 19:02 - 2015-05-22 15:26 - 00000000 ____D () C:\Users\Vivien Förster\Documents\Bewerbungsunterlagen 2015-05-01 17:29 - 2015-05-01 17:29 - 00000000 ____D () C:\Users\Vivien Förster\Downloads\GG 2015-05-01 17:20 - 2015-05-01 18:17 - 46707722 _____ () C:\Users\Vivien Förster\Desktop\Kriegsdenkmäler erzählen.odp 2015-04-29 16:29 - 2015-04-29 16:29 - 00000000 ____D () C:\ProgramData\IHProtectUpDate 2015-04-29 16:29 - 2015-04-29 16:29 - 00000000 ____D () C:\Program Files (x86)\XTab 2015-04-28 19:07 - 2015-04-29 20:50 - 00017725 _____ () C:\Users\Vivien Förster\Documents\quelle gg london.odt ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-05-22 15:46 - 2010-05-01 09:05 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-05-22 15:46 - 2010-05-01 09:05 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-05-22 15:41 - 2010-05-01 09:05 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-05-22 15:41 - 2010-05-01 09:05 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-05-22 15:28 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-05-22 15:28 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-05-22 15:26 - 2014-09-16 17:49 - 00003474 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-6.job 2015-05-22 15:24 - 2009-09-26 16:02 - 01252334 _____ () C:\Windows\WindowsUpdate.log 2015-05-22 15:21 - 2015-04-19 16:54 - 00000004 _____ () C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-05-22 15:21 - 2015-04-19 16:50 - 00001302 _____ () C:\Windows\Tasks\fun4u_notification_service.job 2015-05-22 15:21 - 2015-04-19 16:50 - 00000664 _____ () C:\Windows\Tasks\fun4u_updating_service.job 2015-05-22 15:21 - 2014-09-16 17:50 - 00002776 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-1.job 2015-05-22 15:21 - 2014-09-16 17:50 - 00002450 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-5.job 2015-05-22 15:21 - 2014-09-16 17:50 - 00002114 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-2.job 2015-05-22 15:21 - 2014-09-16 17:50 - 00001406 _____ () C:\Windows\Tasks\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74.job 2015-05-22 15:21 - 2014-09-16 17:49 - 00004500 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-11.job 2015-05-22 15:21 - 2014-09-16 17:49 - 00003818 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-4.job 2015-05-22 15:21 - 2014-09-16 17:49 - 00003818 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-3.job 2015-05-22 15:21 - 2014-09-16 17:49 - 00003474 _____ () C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-7.job 2015-05-22 15:21 - 2014-09-16 17:49 - 00000928 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job 2015-05-22 15:21 - 2010-05-14 15:20 - 00065536 _____ () C:\Windows\system32\Ikeext.etl 2015-05-22 15:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-05-22 15:21 - 2009-07-14 06:51 - 00181882 _____ () C:\Windows\setupact.log 2015-05-22 15:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing 2015-05-21 22:05 - 2009-12-25 11:32 - 00003986 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{0D1B1EDE-B618-4E07-A365-64A854AC9435} 2015-05-20 17:54 - 2014-09-16 17:49 - 00000932 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job 2015-05-20 17:50 - 2015-02-20 12:41 - 00003862 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1424428891 2015-05-20 17:50 - 2014-10-08 18:09 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-05-18 19:20 - 2015-02-20 12:20 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-05-18 18:03 - 2015-03-09 19:03 - 00003368 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-664774285-3076153036-1514180132-1000 2015-05-18 18:03 - 2014-09-08 16:32 - 00003252 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-664774285-3076153036-1514180132-1000 2015-05-18 17:28 - 2013-11-18 18:36 - 00000000 ____D () C:\Users\Vivien Förster\Documents\Feuerwehr [Ausbildung] 2015-05-17 17:28 - 2015-03-07 14:49 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-05-11 19:11 - 2014-11-20 17:27 - 00000000 ____D () C:\Users\Vivien Förster\Documents\JFW 2015-05-11 19:09 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-05-11 19:07 - 2014-12-17 16:42 - 00000000 ____D () C:\Users\Vivien Förster\Documents\Jugendfeuerwehr 2015-05-01 17:52 - 2010-06-27 17:52 - 00020480 _____ () C:\Users\Vivien Förster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-05-01 17:29 - 2013-07-28 17:15 - 00000000 ____D () C:\Users\Vivien Förster\Downloads\Autoversicherung 2015-05-01 17:28 - 2014-02-25 18:36 - 00000000 ____D () C:\Users\Vivien Förster\Documents\GN 13 B 2015-04-30 18:22 - 2015-04-11 16:42 - 46767872 _____ () C:\Users\Vivien Förster\Documents\Kriegsdenkmäler erzählen.odp 2015-04-29 16:29 - 2015-02-20 12:41 - 00001339 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2015-04-29 16:29 - 2015-02-20 12:12 - 00001655 _____ () C:\Users\Vivien Förster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-04-29 16:29 - 2015-02-20 12:12 - 00001633 _____ () C:\Users\Vivien Förster\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-04-29 16:29 - 2014-09-16 17:49 - 00000000 ____D () C:\ProgramData\IePluginServices 2015-04-28 15:59 - 2015-04-19 17:30 - 00000000 ____D () C:\Users\Vivien Förster\Downloads\Literatur 2015-04-27 17:20 - 2015-02-20 12:20 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-04-27 17:20 - 2015-02-20 12:20 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-04-27 17:20 - 2015-02-20 12:20 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-04-27 17:08 - 2010-05-11 16:52 - 00000000 ____D () C:\Users\Vivien Förster\AppData\Roaming\Real 2015-04-27 16:29 - 2012-08-08 19:16 - 66085672 _____ (DVDVideoSoft Ltd. ) C:\Users\Vivien ==================== Files in the root of some directories ======= 2009-08-22 08:07 - 2008-06-11 17:12 - 0776614 _____ () C:\Program Files (x86)\Common Files\packardbell.ico 2015-03-31 10:14 - 2015-03-31 10:14 - 0004387 _____ () C:\Users\Vivien Förster\AppData\Roaming\BgX88AZdj0WaZJQg6qiCpWGLZ 2015-04-03 15:49 - 2015-04-03 15:49 - 1224704 _____ () C:\Users\Vivien Förster\AppData\Roaming\BgX88AZdj0WaZJQg6qiCpWGLZ.exe 2014-09-01 10:18 - 2014-09-01 10:18 - 0002086 _____ () C:\Users\Vivien Förster\AppData\Roaming\CGLTJAG 2014-09-16 17:49 - 2014-09-16 17:49 - 1524128 _____ (browser) C:\Users\Vivien Förster\AppData\Roaming\CGLTJAG.exe 2014-05-26 14:49 - 2014-05-26 14:49 - 0000065 _____ () C:\Users\Vivien Förster\AppData\Roaming\gnuplot_history 2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Users\Vivien Förster\AppData\Roaming\NQOVIKVG 2014-09-16 17:49 - 2014-09-16 17:49 - 1972640 _____ (browser) C:\Users\Vivien Förster\AppData\Roaming\NQOVIKVG.exe 2009-12-31 21:47 - 2009-12-31 21:47 - 0033134 _____ () C:\Users\Vivien Förster\AppData\Roaming\UserTile.png 2009-12-28 17:03 - 2015-02-19 13:36 - 0004234 _____ () C:\Users\Vivien Förster\AppData\Roaming\wklnhst.dat 2010-06-27 17:52 - 2015-05-01 17:52 - 0020480 _____ () C:\Users\Vivien Förster\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2012-06-24 19:22 - 2012-12-20 14:53 - 0007648 _____ () C:\Users\Vivien Förster\AppData\Local\Resmon.ResmonCfg 2009-08-22 08:08 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe Some files in TEMP: ==================== C:\Users\Vivien Förster\AppData\Local\Temp\AskSLib.dll C:\Users\Vivien Förster\AppData\Local\Temp\BackupSetup.exe C:\Users\Vivien Förster\AppData\Local\Temp\bitool.dll C:\Users\Vivien Förster\AppData\Local\Temp\bootstrapper.exe C:\Users\Vivien Förster\AppData\Local\Temp\chatzum_softonic_yahoo_62_v5.exe C:\Users\Vivien Förster\AppData\Local\Temp\dotNetFx40_Client_setup.exe C:\Users\Vivien Förster\AppData\Local\Temp\ffunzip.exe C:\Users\Vivien Förster\AppData\Local\Temp\FileFormatConverters.exe C:\Users\Vivien Förster\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\Vivien Förster\AppData\Local\Temp\FreeStudio.exe C:\Users\Vivien Förster\AppData\Local\Temp\ICReinstall_FreeYouTubeToMP3Converter.exe C:\Users\Vivien Förster\AppData\Local\Temp\iMesh_setup.exe C:\Users\Vivien Förster\AppData\Local\Temp\Installhelper.dll C:\Users\Vivien Förster\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Vivien Förster\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Vivien Förster\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Vivien Förster\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Vivien Förster\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe C:\Users\Vivien Förster\AppData\Local\Temp\jre-8u40-windows-au.exe C:\Users\Vivien Förster\AppData\Local\Temp\post1.exe C:\Users\Vivien Förster\AppData\Local\Temp\post2.dll C:\Users\Vivien Förster\AppData\Local\Temp\post2.exe C:\Users\Vivien Förster\AppData\Local\Temp\SetupDataMngr_iMesh.exe C:\Users\Vivien Förster\AppData\Local\Temp\SHSetup.exe C:\Users\Vivien Förster\AppData\Local\Temp\SRAssetsHelper.dll C:\Users\Vivien Förster\AppData\Local\Temp\stubhelper.dll C:\Users\Vivien Förster\AppData\Local\Temp\tbDVDV.dll C:\Users\Vivien Förster\AppData\Local\Temp\TOBITCLT.DLL C:\Users\Vivien Förster\AppData\Local\Temp\TsuE5B78F95.dll C:\Users\Vivien Förster\AppData\Local\Temp\uninst.exe C:\Users\Vivien Förster\AppData\Local\Temp\uninst1.exe C:\Users\Vivien Förster\AppData\Local\Temp\vcredist_x64.exe C:\Users\Vivien Förster\AppData\Local\Temp\{00748123-85B0-4138-88F6-6A30FBFAD5A6}-GoogleUpdateSetup.exe C:\Users\Vivien Förster\AppData\Local\Temp\{33BA9D65-8150-4FFF-A219-6204BBE0BAB1}-GoogleEarth-Win-Bundle-6.1.0.5001.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 18:15 ==================== End of log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-05-2015 Ran by Vivien Förster at 2015-05-22 15:48:49 Running from C:\Users\Vivien Förster\Downloads Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-664774285-3076153036-1514180132-500 - Administrator - Disabled) Gast (S-1-5-21-664774285-3076153036-1514180132-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-664774285-3076153036-1514180132-1005 - Limited - Enabled) Vivien Förster (S-1-5-21-664774285-3076153036-1514180132-1000 - Administrator - Enabled) => C:\Users\Vivien Förster ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Norton Internet Security (Disabled - Out of date) {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855} AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Norton Internet Security (Disabled - Up to date) {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8} FW: Norton Internet Security (Disabled) {B0F2DB13-C654-2E74-30D4-99C9310F0F2E} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.) Adobe ConnectNow Add-in (HKU\S-1-5-21-664774285-3076153036-1514180132-1000\...\Adobe ConnectNow Add-in) (Version: - ) Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated) Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated) Adobe Flash Player 17 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated) Adobe Photoshop Elements 7.0 (HKLM-x32\...\Adobe Photoshop Elements 7) (Version: 7.0.1 - Adobe Systems Incorporated) Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated) Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 12.1.9.1236 - Avira) Backup Manager Basic (x32 Version: 2.0.0.22 - NewTech Infosystems) Hidden Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation) Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) Hidden ClassPad Manager v3 Professional (90 Day Trial) (HKLM-x32\...\{E8D33536-6ACE-4D34-A51E-08AA48B88305}) (Version: 3.06.1010.2110 - CASIO COMPUTER CO., LTD.) Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.98.9.0 - Conexant) Free Studio version 6.5.0.219 (HKLM-x32\...\Free Studio_is1) (Version: 6.5.0.219 - DVDVideoSoft Ltd.) GIMP 2.8.8 (HKLM\...\GIMP-2_is1) (Version: 2.8.8 - The GIMP Team) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3001 - Packard Bell) ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation) Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation) Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.03 - Packard Bell) Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation) Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla) Nero 9 Essentials (HKLM-x32\...\{8ed5c8a6-2aee-40dd-8df4-26cd57921222}) (Version: - Nero AG) Norton Internet Security (HKLM-x32\...\NIS) (Version: 16.7.0.30 - Symantec Corporation) Norton Online Backup (HKLM-x32\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.36 - Symantec) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.5 - NVIDIA Corporation) NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation) OpenOffice.org 3.2 (HKLM-x32\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org) Opera Stable 29.0.1795.60 (HKLM-x32\...\Opera 29.0.1795.60) (Version: 29.0.1795.60 - Opera Software ASA) Packard Bell InfoCentre (HKLM-x32\...\Packard Bell InfoCentre) (Version: 3.02.3000 - Packard Bell) Packard Bell MyBackup (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.22 - NewTech Infosystems) Packard Bell Power Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3002 - Packard Bell) Packard Bell Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3003 - Packard Bell) Packard Bell Registration (HKLM-x32\...\Packard Bell Registration) (Version: 1.02.3004 - Packard Bell) Packard Bell Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3014 - Packard Bell) PackardBell ScreenSaver (HKLM-x32\...\PackardBell Screensaver) (Version: 1.0.1.0302 - PackardBell) RealDownloader (x32 Version: 1.3.4 - RealNetworks, Inc.) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.4 - RealNetworks) Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.) RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden SAMSUNG Mobile Composite Device Software (HKLM\...\SAMSUNG Mobile Composite Device) (Version: - ) Samsung Mobile Modem Device Software (HKLM\...\Samsung Mobile Modem Device) (Version: - ) SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - ) Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version: - ) SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - ) SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - ) SAMSUNG USB Mobile Device Software (HKLM\...\SAMSUNG USB Mobile Device) (Version: - ) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.2.0 - Synaptics Incorporated) Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler) Video Web Camera (HKLM-x32\...\{12A1B519-5934-4508-ADBD-335347B0DC87}) (Version: 1.7.10.1210 - Chicony Electronics Co.,Ltd.) VLC media player 2.0.3 (HKLM-x32\...\VLC media player) (Version: 2.0.3 - VideoLAN) Welcome Center (HKLM-x32\...\Packard Bell Welcome Center) (Version: 1.00.3005 - Packard Bell) Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8064.0206 - Microsoft Corporation) Windows Live Sync (HKLM-x32\...\{ED636101-1959-4360-8BF7-209436E7DEE4}) (Version: 14.0.8064.206 - Microsoft Corporation) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== Restore Points ========================= 07-03-2015 14:47:28 Installed Adobe Reader XI - Deutsch. 09-03-2015 19:12:30 Windows-Sicherung 16-03-2015 16:38:41 Windows-Sicherung 31-03-2015 17:20:42 Windows-Sicherung 08-04-2015 09:18:36 Windows-Sicherung 14-04-2015 16:23:03 Windows-Sicherung 20-04-2015 09:12:24 Windows-Sicherung 27-04-2015 16:13:27 Windows-Sicherung 10-05-2015 17:52:28 Windows-Sicherung 18-05-2015 16:32:17 Windows-Sicherung ==================== Hosts content: =============================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0B5E9078-00D6-46E7-A132-492014BF2594} - System32\Tasks\{7C10F13F-AC89-4A0D-B563-F461D0BF8A64} => pcalua.exe -a E:\Symantec\Setup.exe -d E:\Symantec Task: {0B773F42-CF5C-40BC-9169-0AAEEAC80253} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Packard Bell\Packard Bell Recovery Management\NotificationCenter\Notification.exe [2009-07-09] (Acer) Task: {247412CF-3314-4DC7-B725-F8315CE0F838} - System32\Tasks\{63E463B4-1E85-4237-A939-1E2BD522F9F3} => pcalua.exe -a C:\Users\VIVIEN~1\AppData\Local\Temp\flash45\install_flash_player_10_ie.exe -d C:\Users\VIVIEN~1\AppData\Local\Temp\flash45 Task: {2D6805A1-50E8-428A-95C7-C0071C2B4B20} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2014-08-12] (RealNetworks, Inc.) Task: {393768D5-AEA6-40F5-94F9-E7AE1044E0EC} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-08-29] (RealNetworks, Inc.) Task: {3CDB1D50-4B7B-49E8-82FD-BE0CDC18617C} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-09-16] (globalUpdate) <==== ATTENTION Task: {41D46187-B393-46B7-A110-DFA8B18020E3} - System32\Tasks\{D3D78B6A-DD96-4D37-83DB-762684D0DA81} => pcalua.exe -a D:\Setup.exe -d D:\ Task: {4EE7AA78-4070-4CE1-93AF-C2EE6081A636} - System32\Tasks\{E2581C57-E1EC-4B99-84F5-B63FCE9143F4} => pcalua.exe -a "C:\Users\Vivien Förster\Downloads\Programme\picturevizII.exe" -d "C:\Users\Vivien Förster\Downloads\Programme" Task: {4FE85442-D3B7-461E-974A-9AE38564E1BA} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION Task: {502D97B7-032A-49F5-A0E4-6B928A59CE7C} - System32\Tasks\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74 => C:\Program Files (x86)\Browser+ Apps+\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74.exe [2014-09-16] (browser) <==== ATTENTION Task: {5DA1F1C1-25AF-4549-B8D6-94EFEFB6E093} - System32\Tasks\fun4u_notification_service => C:\Program Files (x86)\fun4u\fun4u_notification_service.exe [2015-04-19] (FileProperties_CompanyName) <==== ATTENTION Task: {5F228F6C-1127-4D2A-973B-E159BF2726A3} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-08-29] (RealNetworks, Inc.) Task: {60E3E83C-F457-438B-A695-139578CDD4E1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-31] (Google Inc.) Task: {6622ED7E-75EB-4519-8CA5-736BB0A7873B} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-09-16] (globalUpdate) <==== ATTENTION Task: {6844056B-D9F6-438A-B6B6-49889BB49B54} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-7 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-7.exe [2014-09-16] (browser) <==== ATTENTION Task: {690355E9-6E19-4CC5-A04A-2388B0FA1F82} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-31] (Google Inc.) Task: {6E29FA3E-E1DC-4F83-A5CE-C9603D902083} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-4 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-4.exe [2014-09-16] (browser) <==== ATTENTION Task: {77436646-3819-498A-91CB-8392AF2A832B} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-27] (Adobe Systems Incorporated) Task: {831FA999-5AEA-4396-9A9C-576E8018FB79} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-08-12] (RealNetworks, Inc.) Task: {8585CC85-3E10-4AE9-823D-163DAFCE7C76} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-6 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-6.exe [2014-09-16] (browser) <==== ATTENTION Task: {8A7B1808-5828-466D-AABB-48EFB9588328} - System32\Tasks\fun4u_updating_service => C:\Program Files (x86)\fun4u\fun4u_updating_service.exe [2015-04-19] () <==== ATTENTION Task: {8C409447-1252-4D91-BB8A-B17574C31FA6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated) Task: {9284E44A-E874-44B1-9AB3-7040FEFA943B} - System32\Tasks\Opera scheduled Autoupdate 1424428891 => C:\Program Files (x86)\Opera\launcher.exe [2015-05-18] (Opera Software) Task: {980CB0BA-7111-4171-A58A-41648C82E17A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-08-29] (RealNetworks, Inc.) Task: {9E812BC7-BD66-4A71-941A-9EED9CE9A890} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-1 => C:\Program Files (x86)\Browser+ Apps+\Browser+ Apps+-codedownloader.exe [2014-09-16] (browser) <==== ATTENTION Task: {A479DE3F-13C0-4676-9B7D-2188F33E7E19} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-3 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-3.exe [2014-09-16] (browser) <==== ATTENTION Task: {D87A0998-1B1E-42FB-9915-A8A04C25EA83} - System32\Tasks\{76A1236A-482E-4275-B8FF-CE866AC6AF3A} => pcalua.exe -a C:\WINDOWS\st6unst.exe -c -n "C:\Program Files (x86)\klimastation\ST6UNST.000" Task: {DF01132C-DEDB-4B11-9448-2A6BCC6B9CCA} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-08-29] (RealNetworks, Inc.) Task: {F12F6994-FF28-41E3-8939-BB63964F9119} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-2 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-2.exe [2014-09-16] (browser) <==== ATTENTION Task: {F3FFA104-D1E4-4D99-AE62-DEBB539D39F8} - System32\Tasks\{FCAB26D8-4A18-4D2D-BD4C-027DF20EFF7F} => pcalua.exe -a "C:\Program Files (x86)\Common Files\DVDVideoSoft\Uninstall.exe" Task: {F6EAF365-2867-428E-8DBD-8F011373F3AC} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-664774285-3076153036-1514180132-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-08-12] (RealNetworks, Inc.) Task: {F9089BA6-A82D-423E-BB2D-AAC37EE25E9C} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-5 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-5.exe [2014-09-16] (browser) <==== ATTENTION Task: {F9651EC9-590E-4210-B759-8F1D1377E4B8} - System32\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-11 => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-11.exe [2014-09-16] (browser) <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-1.job => C:\Program Files (x86)\Browser+ Apps+\Browser+ Apps+-codedownloader.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-11.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-11.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-2.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-2.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-3.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-3.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-4.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-4.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-5.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-5.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-5_user.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-5.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-6.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-6.exe <==== ATTENTION Task: C:\Windows\Tasks\58bdf064-05ee-4829-b90e-14cee42c2e5c-7.job => C:\Program Files (x86)\Browser+ Apps+\58bdf064-05ee-4829-b90e-14cee42c2e5c-7.exe <==== ATTENTION Task: C:\Windows\Tasks\a3557447-7d25-4247-9e1e-82f951ca4503.job => C:\Program Files (x86)\Browser+ Apps+\a3557447-7d25-4247-9e1e-82f951ca4503.exe <==== ATTENTION Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\BgX88AZdj0WaZJQg6qiCpWGLZ.job => C:\Users\Vivien Fýÿrster\AppData\Roaming\BgX88AZdj0WaZJQg6qiCpWGLZ.exe <==== ATTENTION Task: C:\Windows\Tasks\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74.job => C:\Program Files (x86)\Browser+ Apps+\c8db5b52-1d3c-47ad-83a8-1fa7c93c4d74.exe/agentregpath='Browser+ Apps+' /appid=64449 /srcid='002142' /subid='0' /zdata='0' /bic=4BE8F0A212EB4063BE450E573E89C989IE /verifier=ebe7a61988f1a539f5cfda5156a95198 /installerversion=1_35_09_16 /installationtime=1410882543 /statsdomain=http:/stats.newclientonlinestorage.com /errorsdomain=http:/errors.newclientonlinestorage.com /extensionname='Information' /torpedoiesleeps=1000 /torpedoieplugins=93-0,102-0,104-0,184-0 /monetizationdomain=http:/logs.newclientonlinestorage.com <==== ATTENTION Task: C:\Windows\Tasks\CGLTJAG.job => C:\Users\Vivien Fýÿrster\AppData\Roaming\CGLTJAG.exe <==== ATTENTION Task: C:\Windows\Tasks\fun4u_notification_service.job => C:\Program Files (x86)\fun4u\fun4u_notification_service.exeá/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='fun4u' /appid='73143' /srcid='2913' /bic='8bfb33d088b8dd6ade9424134b4fd0e7' /verifier='3344b45c1c7fc68a883011b4cf18243d' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif <==== ATTENTION Task: C:\Windows\Tasks\fun4u_updating_service.job => C:\Program Files (x86)\fun4u\fun4u_updating_service.exe¦ /campid=2913 /verid=1 /url=http:/cdn.buildomserv.com/txt/@CAMPID@/@VER@/file.txt /appid=73143 /taskname=fun4u_updating_service /funurl=http:/stats.buildomserv.com <==== ATTENTION Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\NQOVIKVG.job => C:\Users\Vivien Fýÿrster\AppData\Roaming\NQOVIKVG.exe <==== ATTENTION ==================== Loaded Modules (Whitelisted) ============== 2014-08-12 12:34 - 2014-08-12 12:34 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe 2015-05-20 17:50 - 2015-05-20 17:50 - 00479352 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\opera_crashreporter.exe 2012-08-10 15:15 - 2012-07-18 18:04 - 00398288 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll 2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\sqlite3.dll 2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\ACE.dll 2010-05-04 15:36 - 2010-05-04 15:36 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll 2010-03-24 21:51 - 2010-07-13 14:46 - 00166400 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll 2009-09-27 01:47 - 2009-04-03 01:03 - 00072200 _____ () C:\Program Files (x86)\Launch Manager\CdDirIo.dll 2015-05-20 17:50 - 2015-05-20 17:49 - 01576568 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\libglesv2.dll 2015-05-20 17:50 - 2015-05-20 17:49 - 00081016 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\libegl.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) AlternateDataStreams: C:\ProgramData\Temp:0B9176C0 AlternateDataStreams: C:\ProgramData\Temp:1D32EC29 AlternateDataStreams: C:\ProgramData\Temp:4CF61E54 AlternateDataStreams: C:\ProgramData\Temp:4D066AD2 AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F AlternateDataStreams: C:\ProgramData\Temp:93DE1838 AlternateDataStreams: C:\ProgramData\Temp:AB689DEA AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D AlternateDataStreams: C:\ProgramData\Temp:E3C56885 ==================== Safe Mode (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys => ""="FSFilter Activity Monitor" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SymEFA.sys => ""="FSFilter Activity Monitor" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-664774285-3076153036-1514180132-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Vivien Förster\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 192.168.2.1 ==================== MSCONFIG/TASK MANAGER Error getting == (Currently there is no automatic fix for this section.) ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [{9E2E4DAC-DBA5-4A46-887E-433C61E5B2BC}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE FirewallRules: [{1DCAA4C0-AFBC-407A-9597-D899FEE90784}] => (Allow) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{F89096D1-848C-4353-9A7C-7490AE5124B7}] => (Allow) C:\Program Files (x86)\Adobe\Photoshop Elements 7.0\AdobePhotoshopElementsMediaServer.exe FirewallRules: [{008B604B-E06A-40E1-9E9C-7441BDAA1265}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe FirewallRules: [TCP Query User{4AA2B8C6-5089-4923-8625-11C4014D1E94}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe FirewallRules: [UDP Query User{186C0888-2C21-416A-A528-D22D7538495D}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe FirewallRules: [TCP Query User{CD90BB8E-A2BA-4CCC-939F-85937E5AE766}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe FirewallRules: [UDP Query User{F947FC81-538A-441B-B1B3-6091FCFC2612}C:\program files (x86)\google\google earth\client\googleearth.exe] => (Allow) C:\program files (x86)\google\google earth\client\googleearth.exe FirewallRules: [TCP Query User{C89683FC-ECA4-4FD6-ABD0-77B2DCB1DB86}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files (x86)\google\google earth\plugin\geplugin.exe FirewallRules: [UDP Query User{7ED01374-CAA5-43D8-982C-5CEE7F43B3EA}C:\program files (x86)\google\google earth\plugin\geplugin.exe] => (Allow) C:\program files (x86)\google\google earth\plugin\geplugin.exe FirewallRules: [{F6ABDDC0-91E2-4B8D-B2DE-8A68F8449264}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsasvr.exe FirewallRules: [{CA635094-2441-4E0A-AF73-C54DB510E221}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsasvr.exe FirewallRules: [{AECB0DB1-85F9-47FC-B993-F5535890F55F}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsvsvr.exe FirewallRules: [{7E7CD9A8-3F30-4D07-B037-C91222382AB8}] => (Allow) C:\Program Files (x86)\Samsung\Samsung New PC Studio\npsvsvr.exe FirewallRules: [{F3231212-0B1B-4B99-B4BD-9EA4C430C107}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe FirewallRules: [{15697BEC-A640-412B-ABC7-304598EBBEC1}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe FirewallRules: [{9AD7DDA4-F3DB-406A-8B4F-77468573AF67}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe FirewallRules: [{4A5294FB-5F7E-4B61-BEB4-AF4FE70EAD94}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe FirewallRules: [{CAE09B8D-1649-4EE6-B70F-D7C419228F3A}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe FirewallRules: [{46A0F119-E937-408B-8A08-26C22E626FAB}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe FirewallRules: [{D4F26090-AB5B-4275-9D42-2BB01CA91C1F}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe FirewallRules: [{448D5741-59B9-4E61-9DAF-9790D5E1B5A9}] => (Allow) C:\Program Files (x86)\Logitech\Vid HD\Vid.exe FirewallRules: [{0187DED7-020D-4DE4-9CF0-A1725BFFE710}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe FirewallRules: [{14A1916C-2EFB-43AA-96B4-ECAF552B81EC}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe FirewallRules: [{8AD0B072-D93B-48D9-8D3F-D43375F63EEF}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe FirewallRules: [{33AEE9F8-554B-4AAB-88CA-FED1FDD8AB6A}] => (Allow) C:\Program Files (x86)\iMesh Applications\iMesh\iMesh.exe FirewallRules: [{F7C213E0-A571-4877-BFAB-76583F57E668}] => (Allow) C:\Program Files (x86)\Shareaza Applications\Shareaza\Shareaza.exe FirewallRules: [TCP Query User{CA2BE147-6C5B-4F1C-8222-7AA67EEE6AA6}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe FirewallRules: [UDP Query User{41FE26F8-85A1-497E-9675-819A2B06D072}C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe] => (Allow) C:\program files (x86)\myphoneexplorer\myphoneexplorer.exe ==================== Faulty Device Manager Devices ============= Name: Microsoft-Adapter für Miniports virtueller WiFis Description: Microsoft-Adapter für Miniports virtueller WiFis Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: vwifimp Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31) Resolution: Update the driver ==================== Event log errors: ========================= Application errors: ================== Error: (05/20/2015 05:49:41 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . Error: (04/28/2015 03:52:52 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . Error: (04/14/2015 04:51:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: recordingmanager.exe, Version: 1.3.4.3, Zeitstempel: 0x53ea5e97 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x004735a8 ID des fehlerhaften Prozesses: 0x10c8 Startzeit der fehlerhaften Anwendung: 0xrecordingmanager.exe0 Pfad der fehlerhaften Anwendung: recordingmanager.exe1 Pfad des fehlerhaften Moduls: recordingmanager.exe2 Berichtskennung: recordingmanager.exe3 Error: (04/10/2015 03:56:32 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . Error: (03/30/2015 04:56:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . Error: (03/10/2015 06:19:16 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . Error: (03/09/2015 07:58:01 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm iexplore.exe, Version 8.0.7600.16385 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 10dc Startzeit: 01d05a92785086f1 Endzeit: 20 Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe Berichts-ID: c68244c4-c685-11e4-9b74-de0126e813a8 Error: (03/09/2015 07:04:09 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm realplay.exe, Version 16.0.4.19 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: cf4 Startzeit: 01d05a8ad2756b3b Endzeit: 40 Anwendungspfad: C:\Program Files (x86)\Real\RealPlayer\realplay.exe Berichts-ID: 407726ec-c67e-11e4-9b74-de0126e813a8 Error: (03/04/2015 05:43:51 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm soffice.bin, Version 3.2.9498.500 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: ef0 Startzeit: 01d05690cd0e1448 Endzeit: 31 Anwendungspfad: C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin Berichts-ID: 31b9ae0e-c285-11e4-8c4c-bab724b723b2 Error: (02/25/2015 06:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Die Daten sind unzulässig. . System errors: ============= Error: (05/20/2015 06:17:55 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (05/18/2015 07:19:32 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (05/17/2015 05:17:15 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (05/10/2015 07:37:54 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (04/29/2015 05:03:37 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (04/19/2015 05:50:21 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (04/19/2015 04:54:14 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: Das System wurde zuvor am 19.04.2015 um 16:53:05 unerwartet heruntergefahren. Error: (04/10/2015 03:52:21 PM) (Source: DCOM) (EventID: 10010) (User: ) Description: {995C996E-D918-4A8C-A302-45719A6F4EA7} Error: (03/31/2015 05:12:32 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EASYBOX", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{B495D123-3E40-4D95-973A-9ACBCFB6281E}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (03/31/2015 05:11:15 PM) (Source: Disk) (EventID: 11) (User: ) Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Microsoft Office: ========================= Error: (05/20/2015 05:49:41 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. Error: (04/28/2015 03:52:52 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. Error: (04/14/2015 04:51:10 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: recordingmanager.exe1.3.4.353ea5e97unknown0.0.0.000000000c0000005004735a810c801d076bff0cea1f8C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exeunknownaff59ffb-e2b5-11e4-8b21-89f039da55b0 Error: (04/10/2015 03:56:32 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. Error: (03/30/2015 04:56:28 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. Error: (03/10/2015 06:19:16 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. Error: (03/09/2015 07:58:01 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: iexplore.exe8.0.7600.1638510dc01d05a92785086f120C:\Program Files (x86)\Internet Explorer\iexplore.exec68244c4-c685-11e4-9b74-de0126e813a8 Error: (03/09/2015 07:04:09 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: realplay.exe16.0.4.19cf401d05a8ad2756b3b40C:\Program Files (x86)\Real\RealPlayer\realplay.exe407726ec-c67e-11e4-9b74-de0126e813a8 Error: (03/04/2015 05:43:51 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: soffice.bin3.2.9498.500ef001d05690cd0e144831C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin31b9ae0e-c285-11e4-8c4c-bab724b723b2 Error: (02/25/2015 06:37:01 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 4107) (User: ) Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabDie Daten sind unzulässig. ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz Percentage of memory in use: 48% Total physical RAM: 4090.93 MB Available physical RAM: 2092.85 MB Total Pagefile: 8180 MB Available Pagefile: 5900.88 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: (Packard Bell) (Fixed) (Total:453.94 GB) (Free:358.29 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: CDB2CDB2) Partition 1: (Not Active) - (Size=11.7 GB) - (Type=27) Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=453.9 GB) - (Type=07 NTFS) ==================== End of log ============================ |
 So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Scan mit Combofix
|
Code: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 22-05-2015 |
Bitte noch Combofix aus obiger Anleitung :) |
bei der ausführung kommt immer "versuche einen neuen systemwiederherstellungspunkt zu erstellen" was soll ich tun? |
Bleibt er dort hängen? Ist dein AV Programm abgeschaltet? |
AV ist abgeschaltet.. hängt dort jedesmal |
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
Code: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015 |
mbam teil 1 Code: Malwarebytes Anti-Malware |
mbam teil 2 Code: Registrierungswerte: 241 |
mbam teil 2 Code: Registrierungswerte: 241 |
mbam teil 3 Code: Dateien: 306Code: Dateien: 306 |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 19:35 Uhr. |
Copyright ©2000-2025, Trojaner-Board
