Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet (https://www.trojaner-board.de/170119-windows-8-1-start-dauert-sehr-lange-danach-oeffnen-fenster-pc-100-ausgelastet.html)

arev 21.08.2015 19:56
Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet
 
Windows 8.1 Start dauert sehr lange. Danach öffnen sich Fenster und der PC ist zu 100% ausgelastet.
Ich kann den PC überhaupt nicht mehr nutzen.
In allen Browsern wurden die Suchmaschinen ausgewechselt.
Es haben sich sehr viele Programme neu installiert.
Diese Programme habe ich aber nicht selber heruntergeladen zumindest nicht wissentlich.
Ich möchte nicht so gerne Windows neu installieren da ich einen originalen Windows 8 Rechner habe und auf Windows 81 zukommen muss ich wieder die große Schleife über Windows 8 machen.
Vielen Dank für eure Hilfe

schrauber 21.08.2015 20:30
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

arev 22.08.2015 09:12
Frst.txt
 
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:21-08-2015
durchgeführt von VeraHagge (Administrator) auf BINE-VERA (21-08-2015 16:54:15)
Gestartet von C:\Users\VeraHagge\Downloads
Geladene Profile: VeraHagge & Administrator (Verfügbare Profile: VeraHagge & Administrator)
Platform: Windows 8.1 Connected (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
() C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\hnspF5E6.tmp
() C:\Program Files\shopperz22072015\csrcc.exe
() C:\Program Files\shopperz22072015\Jmahzov.exe
() C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe
() C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\jnszDA4E.tmp
(XTab system) C:\Program Files (x86)\MiuiTab\ProtectService.exe
() C:\Windows\SysWOW64\nethtsrv.exe
(Kromtech) C:\Program Files\Kromtech\PCKAV\PCKAVService.exe
() C:\Windows\SysWOW64\netupdsrv.exe
() C:\Program Files\shopperz22072015\Jvpmajlij.exe
(Search Module Ltd.) C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe
(ShopperPro) C:\Program Files\Common Files\ShopperPro\spbiu.exe
() C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\knsy42C5.tmp
(WS) C:\Program Files (x86)\WordShark_1.10.0.20\Service\wssvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Tuto4PC) C:\Program Files (x86)\DailyPCClean\DPCCSchedule.exe
(Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe
(Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe
(Buca Apps) C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe
(SecurityUtility) C:\ProgramData\SecurityUtility\SecurityUtility.exe
() C:\Program Files\shopperz22072015\Huyde.exe
() C:\Program Files\shopperz22072015\Huyde64.exe
(SecurityUtility) C:\ProgramData\SecurityUtility\SecurityUtility.exe
(SearchProtect) C:\Program Files (x86)\MiuiTab\CmdShell.exe
() C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe
(XTab system) C:\Program Files (x86)\MiuiTab\HPNotify.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe
(Kromtech) C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe
() C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe
() C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe
() C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(SoftBrain Technologies Ltd.) C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\rec_de_57\rec_de_57.exe
(SoftBrain Technologies Ltd.) C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebApp.exe
() C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
konnte nicht auf den Prozess zugreifen -> sgminer.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe
(Tuto4PC) C:\Program Files (x86)\DailyPCClean\DailyPCClean.exe
() C:\Program Files (x86)\Optimizer Pro 3.99\OptimizerPro.exe
(Avanquest Software) C:\Program Files (x86)\OneSafe PC Cleaner\OneSafePCCleaner.exe
() C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe
(DTools LIMITED) C:\ProgramData\eWinManProe\ProtectWindowsManager.exe
() C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe
(Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe
(Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe
() C:\Program Files (x86)\baidu\pps.exe
() C:\Program Files (x86)\baidu\Bind.exe
(Smart Applications) C:\Program Files (x86)\speed browser\Application\browser.exe
(iQIYI.COM) C:\IQIYI Video\Common\QyKernel.exe
() C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe
(Microsoft Corporation) C:\Windows\System32\Taskmgr.exe
(Cinema PlusV14.07) C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe
() C:\Users\VeraHagge\AppData\Local\Temp\nseBB78.tmp\setup.exe
() C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Goobzo LTD) C:\Program Files (x86)\ShopperPro\ShopperPro.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Unique Solutions) C:\ProgramData\rKRjrFKiDD\JwTtFpw.exe
(Unique Solutions) C:\ProgramData\rKRjrFKiDD\dat\DmlQqncMGlH.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
() C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe
() C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe
() C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe
(WS) C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe
(Microsoft Corporation) C:\Windows\System32\sc.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TAOFrame.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe
(Farbar) C:\Users\VeraHagge\Downloads\FRST64(1).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-22] (Realtek Semiconductor)
HKLM\...\Run: [shopperz22072015] => C:\Program Files\shopperz22072015\Huyde.exe [434040 2015-07-22] ()
HKLM\...\Run: [shopperz2207201564] => C:\Program Files\shopperz22072015\Huyde64.exe [464760 2015-07-22] ()
HKLM\...\Run: [prtstart] => C:\Program Files\shopperz22072015\dr_inst.exe [140664 2015-07-22] ()
HKLM\...\Run: [3D BubbleSound] => "C:\Program Files\BubbleSound\3D BubbleSound.exe"
HKLM\...\Run: [gpuminer] => C:\Users\VeraHagge\AppData\Roaming\cpuminer\sgminer\sgminer.cmd [96 2015-05-02] ()
HKLM\...\Run: [cpuminer] => C:\WINDOWS\system32\cpuminer-gw64.exe [1423136 2015-08-07] ()
HKLM\...\Run: [Windesk Winsearch] => C:\Program Files (x86)\WindeskWinsearch\Windesk Winsearch.exe [1061256 2015-04-08] (Windesk Winsearch)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-08-12] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)
HKLM-x32\...\Run: [mbot_de_012010041] => [X]
HKLM-x32\...\Run: [SmartWeb] => C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe [270368 2015-02-17] (SoftBrain Technologies Ltd.)
HKLM-x32\...\Run: [gmsd_de_005010041] => [X]
HKLM-x32\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [3225088 2015-07-26] ()
HKLM-x32\...\Run: [rec_de_57] => C:\Program Files (x86)\rec_de_57\rec_de_57.exe [3979408 2015-07-27] ()
HKLM-x32\...\Run: [gmsd_de_005010057] => C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe [3984016 2015-08-10] ()
HKLM-x32\...\Run: [gmsd_de_005010066] => C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe [3978384 2015-08-20] ()
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe [355296 2015-08-21] (Tencent)
HKLM-x32\...\RunOnce: [upgmsd_de_005010057.exe] => C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe [3346064 2015-08-10] ()
HKLM-x32\...\RunOnce: [upgmsd_de_005010066.exe] => C:\Users\VeraHagge\AppData\Local\gmsd_de_005010066\upgmsd_de_005010066.exe [3336848 2015-08-20] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Boost] => C:\Program Files (x86)\Boost\Boost.exe [445328 2015-06-17] (Boost Shopping)
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [OffersWizard update] => C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe [982016 2015-08-10] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [PCKeeper2] => C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe [915976 2015-05-25] (Kromtech)
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [PCKeeper Antivirus] => C:\Program Files\Kromtech\PCKAV\PCKAV.exe [332896 2015-07-17] (Kromtech)
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [DesktopSearch] => C:\ProgramData\DesktopSearch\DesktopSearch.exe -ros -tray
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe [148112 2015-07-23] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [GoogleChromeAutoLaunch_550A9DCE601CA31D56B975602575A14B] => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe [770048 2015-05-11] (Crossbrowse)
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [DeskBar] => C:\Users\VeraHagge\AppData\Local\DeskBar\dblaunch.exe [239104 2015-07-28] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [3225088 2015-07-26] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [InetStat] => C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe [840206 2015-07-28] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Shop-wit] => C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe [656128 2015-07-30] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [Super Optimizer] => C:\Program Files (x86)\Super Optimizer\SupOptLauncher.exe [676400 2015-07-31] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [apphide] => C:\Program Files (x86)\baidu\pps.exe [77824 2015-08-12] ()
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\Run: [HCDNClient] => C:\IQIYI Video\Common\QyKernel.exe [576104 2015-05-12] (iQIYI.COM)
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe -h
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [PCKeeper2] => C:\Program Files\Kromtech\PCKeeper\PCKeeper.exe [915976 2015-05-25] (Kromtech)
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\...\Run: [PCKeeper Antivirus] => C:\Program Files\Kromtech\PCKAV\PCKAV.exe [332896 2015-07-17] (Kromtech)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC64LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [247032 2015-08-03] (Client Connect LTD)
AppInit_DLLs:  C:\ProgramData\SecurityUtility\SecurityUtility64.dll => C:\ProgramData\SecurityUtility\SecurityUtility64.dll Datei nicht gefunden
AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\SEARCH~1\bin\VC32LO~1.DLL => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC32Loader.dll [219896 2015-08-03] (Client Connect LTD)
AppInit_DLLs-x32:  C:\ProgramData\SecurityUtility\SecurityUtility32.dll => C:\ProgramData\SecurityUtility\SecurityUtility32.dll [817152 2015-05-26] (SecurityUtility)
Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk [2015-07-26]
ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Crossbrowse)
Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk [2015-07-23]
ShortcutTarget: MyPC Backup.lnk -> C:\Program Files (x86)\OLBPre\OLBPre.exe ()
Startup: C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartWeb.lnk [2015-07-26]
ShortcutTarget: SmartWeb.lnk -> C:\Users\VeraHagge\AppData\Local\SmartWeb\SmartWebHelper.exe (SoftBrain Technologies Ltd.)
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMGCShellExt64.dll [2015-08-21] (Tencent)
GroupPolicy: Gruppenrichtline auf Chrome erkannt <======= ACHTUNG
CHR HKLM\SOFTWARE\Policies\Google: Richtlinienbeschränkung <======= ACHTUNG

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=92280131_hao_pg
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=92280131_hao_pg
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.hyrican.de
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=de-DE&Src=WD8&Tid=000328B0&OHP=http%3A%2F%2Flocaloem.msn.com,http%3A%2F%2Fwww.hyrican.de&OSP=http%3A%2F%2Fwww.bing.com%2Fsearch%3FPC%3DWCUG%26FORM%3DWCUGDF%26q%3D%7BsearchTerms%7D
URLSearchHook: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 - (Kein Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - Keine Datei
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
SearchScopes: HKLM -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1439231666&z=aeb741c33c361dc8880bb4eg1z3cet6obc1gcwft7c&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
SearchScopes: HKLM-x32 -> {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=b7672bac-eee2-4450-a0fc-afe69bcdc811&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {057F30DD-B52D-4722-895C-938EAD155A71} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {11C97485-3FF2-4457-A2F9-A0D103BEB765} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {184B4FA8-A1E8-4E20-9AA6-52E49443792C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {1BDF2369-538A-43C6-BC28-F6CEE7FC101D} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {1F71DD35-87E5-4AB8-B4C1-66B978B95397} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {2318B3E7-A682-4673-99C3-48E723D68584} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {29C3476D-89F3-4BC9-BCB4-95D3F43025D9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {2F3D2C83-A0B1-4974-8323-2B7119C602BD} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {3064EF31-AB79-4F98-854D-8D1CC55E9FD0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {35AB5128-2AB2-4FF4-A571-C96D846671BC} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {3C45BDFD-C268-4180-9B4C-3D04D0A1B1CC} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {405F9A19-29E6-4549-A406-A06C66B045CF} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {484047E0-22D1-4088-A063-B19DBC4C07D8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {4EDC63C2-ADA9-4124-8572-78C9C242C78C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {50FFA973-7C7A-4246-970E-5A8F751BDEC7} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5264C23E-EB63-4609-B5B7-AF4FA32C2E0D} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {57DDD6F6-E855-4012-9C56-5A6E7F3B8341} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5A205862-6A60-49BC-98E0-9F94038BB509} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5E15329E-AC33-4854-BD1E-72D7E804E0C9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {5EAE81E7-7A5F-42C1-A8A8-C06637421BFA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {60C4FE33-8626-4FFF-BAA6-87203B805B3F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {626A71DA-8EBC-4906-894D-9E5EFABB96FA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {652C6314-A5DD-4495-9702-6F4FB2CDD1D3} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {69362D5A-0373-4BB8-9DF1-AEAF0D4D0008} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {70446E69-B3BD-4EF8-AABF-FEB092C86F64} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {72511F50-3731-4843-9AA9-A0768E6C56B9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {777AE081-BA32-4A7B-A743-0120E787FB99} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {7F4EFF06-7032-458e-AE16-1C1D8255C28A} URL = hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {837C3F4D-E4FA-4BA0-BBB9-038E4AB9DF7F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {84930819-BDF6-4618-B9E3-EE2369EB96AB} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {880D922A-AB3A-47CF-A2A0-4874114BD441} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {89E21140-DB28-4977-9549-D86ED009E9D3} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {8BD3FD3A-A717-43E3-8DFF-2111EF14DBA2} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {94012578-1D0A-4FD5-B277-1A5D754749D9} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {981756DC-CBE8-4CC2-97F9-E2E45ECF3598} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {998AF2BF-D297-48B7-8476-FA8EE2B70AD2} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {9DB9FE33-B0C5-4D1E-8549-8768545F858C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {A2A73F41-6602-4F45-BFF4-B1EC9CAC4517} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {A5C8AC00-5065-4804-B73F-B0BA2FC4B65F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {B156A8F5-1821-4D62-BA1E-EA463FB24B21} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BBB7BE18-9AF7-4D4A-855F-B056B851D4DF} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BC3169B8-22BB-49FE-9D99-A0D0F40AE3C0} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BEA7FEEB-4BE0-451B-995A-B61A4BF6F0B1} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {BF5BAEAD-5FF5-4C5D-BC99-732209C768D8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {C46AB282-F3D2-41B8-A49A-52BBAD05884C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {C8E344FF-66E1-4B0D-BF13-6B30205CBF21} URL = hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {CB52B59C-F5E8-4EFC-A19A-F1732B183BF8} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {D48BC3F2-5109-4660-BAB6-7612738EF947} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E24CDA9F-E6D6-4A97-ABDC-8B8143018B92} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E2EB6FC6-2977-4DB1-9D98-2CC94CD63BC6} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E2ED86BC-EDD1-4A34-AA7C-52C2606C452C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E44E33FC-0DFF-458F-A8A6-02BAFC4C3E14} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EB2B76A5-848A-4EE3-B65D-0607DE69FE37} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EC099E9B-4DDE-4F92-8D0D-E633C6CACADA} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {EFF25583-5088-43DF-8179-B12F17328E87} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {F4B869AF-2472-464E-AEAE-E2852651CB1F} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {F6F6209F-E89D-45FD-AD59-34878C61A3F1} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {FF215A2A-39B9-4DFC-B40F-5D3163BD5BBE} URL = hxxp://www.mystartsearch.com/web/?utm_source=b&utm_medium=cmi&utm_campaign=install_ie&utm_content=ds&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&ts=1439231789&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-500 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-500 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSWebMon64.dat [2015-08-21] (Tencent)
BHO: adTech Class -> {934B156A-3D17-3981-B78A-5C138F423AD6} -> C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_64.dll [2015-08-05] ()
BHO: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro64.dll [2015-07-26] (Goobzo Ltd.)
BHO-x32: GoodTab Class -> {1F91A9A1-01BA-4c81-863D-3BA0751E1419} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-08-04] (Good Co. Limited)
BHO-x32: adTech Class -> {934B156A-3D17-3981-B78A-5C138F423AD6} -> C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_32.dll [2015-08-05] ()
BHO-x32: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro.dll [2015-07-26] (Goobzo Ltd.)
BHO-x32: °®ÆæÒÕÖúÊÖ -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> C:\IQIYI Video\Common\Accelerator\IEHelper.dll [2015-04-29] (爱奇艺)
Toolbar: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> Kein Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Keine Datei
Winsock: Catalog9 01 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9 02 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9 03 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9 04 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9 15 C:\WINDOWS\SysWOW64\LavasoftTcpService.dll [342016 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9-x64 01 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9-x64 02 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9-x64 03 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9-x64 04 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited)
Winsock: Catalog9-x64 15 C:\WINDOWS\system32\LavasoftTcpService64.dll [422400 2015-06-22] (Lavasoft Limited)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [NameServer] 52.18.92.32,8.8.8.8
Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{bbed3e08-0b41-11e3-8249-806e6f6e6963}: [NameServer] 52.18.92.32,8.8.8.8
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.oursurfing.com/?type=sc&ts=1436658449&z=13abf1ab21cdeb884a3e887gdz3c4qbqbweb3z8zdc&from=pjr&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT

FireFox:
========
FF ProfilePath: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516
FF NewTab: hxxp://www.mystartsearch.com/newtab/?type=nt&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
FF DefaultSearchEngine: mystartsearch
FF SelectedSearchEngine: mystartsearch
FF Homepage: hxxp://www.mystartsearch.com/?type=hp&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
FF Keyword.URL: hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-21] ()
FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] ()
FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-21] ()
FF Plugin-x32: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] ()
FF Plugin-x32: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-17] (Oracle Corporation)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\npQMExtensionsMozilla.dll [2015-08-21] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-07-26] (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [2015-07-26] (globalUpdate)
FF Plugin HKU\S-1-5-21-3742509177-3204372618-1584296459-1002: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\istartsurf.xml [2015-07-31]
FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\smod.xml [2015-07-27]
FF SearchPlugin: C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\yahoo-ysp.xml [2015-07-17]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml [2015-08-13]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2015-08-21]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\StartWeb.xml [2015-07-14]
FF Extension: PPriiCeLeess - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\22JDQ@j.org [2015-07-26]
FF Extension: Lights Cinema 1.3betaV14.07 - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com [2015-08-10]
FF Extension: deskCut - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\deskCutv2@gmail.com [2015-08-10]
FF Extension: HD4Good - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com [2015-07-31]
FF Extension: youtubeadblocker - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\hRGDtVG@B.org [2015-07-26]
FF Extension: buyfastt - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\tIxgdvdh@u.org [2015-07-31]
FF Extension: Shopper-Pro - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [2015-08-21]
FF Extension: Super Web Accelerator ! - C:\Program Files (x86)\Mozilla Firefox\distribution\bundles\firefox [2015-08-10]
FF HKLM\...\Firefox\Extensions: [{318d2d55-9ce3-446e-8640-a43be68a550f}] - C:\Program Files\shopperz22072015\Firefox
FF Extension: shopperz22072015 - C:\Program Files\shopperz22072015\Firefox [2015-07-26]
FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\PremierOpinion\firefox
FF HKLM-x32\...\Firefox\Extensions: [searchffv2@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\uphfrov1.default\extensions\searchffv2@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\extensions\defsearchp@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\extensions\deskCutv2@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [{318d2d55-9ce3-446e-8640-a43be68a550f}] - C:\Program Files\shopperz22072015\Firefox
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.mystartsearch.com/?type=sc&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\all-iminent.js [2015-07-26]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-07-17]

Chrome:
=======
CHR dev: Chrome dev build erkannt! <======= ACHTUNG
CHR HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jlcgehabolcakkjhgmgpkagpolbjlhfa] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [adpeheiliennogfclcgmchdfdmafjegc] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ehhlaekjfiiojlddgndcnefflngfmhen] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fjbbjfdilbioabojmcplalojlmdngbjl] - C:\Users\VeraHagge\AppData\Local\Temp\swlfiles\smileyswelovetoolbar.crx <nicht gefunden>
CHR HKLM-x32\...\Chrome\Extension: [nociobghckdhokecfeajdpimjeapnopn] - https://clients2.google.com/service/update2/crx

Opera:
=======
OPR Extension: (HD4Good) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\hedklcodpbdbhomhhpmkogffkjneikhi [2015-07-12]
OPR Extension: (Sale Clipper) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\miincmhponinjhaaagepklkeadfamabi [2015-07-12]
OPR Extension: (PremierOpinion) - C:\Users\VeraHagge\AppData\Roaming\Opera Software\Opera Stable\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle [2015-07-12]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 088c3b28; c:\Program Files (x86)\LibrarySystem\LibrarySystem.dll [2239488 2015-07-31] () [Datei ist nicht signiert]
R2 57e40902; c:\Program Files (x86)\wincheck\wincheck.dll [3196928 2015-07-26] () [Datei ist nicht signiert]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-08-12] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 c31ed948; c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll [2570896 2015-07-26] () <==== ACHTUNG
R2 comyninu; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\hnspF5E6.tmp [161792 2015-07-26] () [Datei ist nicht signiert]
R2 csrcc; C:\Program Files\shopperz22072015\csrcc.exe [1448824 2015-07-22] ()
R2 d0ce99eb-258e-401b-b95b-9e860f91a566; C:\Program Files\shopperz22072015\Jmahzov.exe [285560 2015-07-22] ()
R2 EZ Software Updater; C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe [221696 2015-02-17] () [Datei ist nicht signiert] <==== ACHTUNG
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [68608 2015-07-26] (globalUpdate) [Datei ist nicht signiert] <==== ACHTUNG
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [68608 2015-07-26] (globalUpdate) [Datei ist nicht signiert] <==== ACHTUNG
R2 hyverumu; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\jnszDA4E.tmp [209920 2015-07-26] () [Datei ist nicht signiert]
R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125112 2015-08-04] (XTab system)
R2 JwTtFpw; C:\ProgramData\rKRjrFKiDD\JwTtFpw.exe [2731488 2015-07-26] (Unique Solutions)
R2 NetHttpService; C:\WINDOWS\SysWOW64\nethtsrv.exe [350720 2015-07-30] () [Datei ist nicht signiert]
R2 PCKAVService; C:\Program Files\Kromtech\PCKAV\PCKAVService.exe [192816 2015-07-17] (Kromtech)
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe [297608 2015-08-21] (Tencent)
R2 RsMgrSvc; C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe [184088 2015-05-21] (Beijing Rising Information Technology Co., Ltd.)
R2 ServiceUpdater; C:\WINDOWS\SysWOW64\netupdsrv.exe [190976 2015-07-30] () [Datei ist nicht signiert]
R2 shopperz22072015 Updater; C:\Program Files\shopperz22072015\Jvpmajlij.exe [174968 2015-07-22] ()
R2 SMUpd; C:\Program Files\Common Files\Goobzo\GBUpdate\smu.exe [2865152 2015-07-26] (Search Module Ltd.) [Datei ist nicht signiert]
R2 SPBIUpd; C:\Program Files\Common Files\ShopperPro\spbiu.exe [2346416 2015-07-26] (ShopperPro)
R3 TAOFrame; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TAOFrame.exe [293728 2015-08-21] (Tencent)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 wesiciku; C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009\knsy42C5.tmp [708608 2015-07-31] () [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\eWinManProe\ProtectWindowsManager.exe [708264 2015-08-21] (DTools LIMITED) <==== ACHTUNG
R2 wssvc_1.10.0.20; C:\Program Files (x86)\WordShark_1.10.0.20\Service\wssvc.exe [300120 2015-07-06] (WS)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S5 3ware; C:\Windows\System32\drivers\3ware.sys [108896 2013-08-22] (LSI)
R5 ACPI; C:\Windows\System32\drivers\ACPI.sys [533824 2014-10-07] (Microsoft Corporation)
R5 acpiex; C:\Windows\System32\Drivers\acpiex.sys [79712 2013-08-22] (Microsoft Corporation)
S5 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
S5 agp440; C:\Windows\System32\drivers\agp440.sys [62304 2013-08-22] (Microsoft Corporation)
S5 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
S5 amdsata; C:\Windows\System32\drivers\amdsata.sys [79200 2013-08-22] (Advanced Micro Devices)
S5 amdsbs; C:\Windows\System32\drivers\amdsbs.sys [259424 2013-08-22] (AMD Technologies Inc.)
S5 amdxata; C:\Windows\System32\drivers\amdxata.sys [25952 2013-08-22] (Advanced Micro Devices)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
S5 arcsas; C:\Windows\System32\drivers\arcsas.sys [114016 2013-08-22] (PMC-Sierra, Inc.)
R5 atapi; C:\Windows\System32\drivers\atapi.sys [26464 2013-08-22] (Microsoft Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices)
S5 b06bdrv; C:\Windows\System32\drivers\bxvbda.sys [531296 2013-08-22] (Broadcom Corporation)
R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [61336 2015-06-18] (Cherimoya Ltd)
R5 CLFS; C:\Windows\System32\drivers\CLFS.sys [377152 2015-03-04] (Microsoft Corporation)
R5 CNG; C:\Windows\System32\Drivers\cng.sys [561928 2015-03-30] (Microsoft Corporation)
R5 disk; C:\Windows\System32\drivers\disk.sys [100192 2013-08-22] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
S5 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S5 EhStorClass; C:\Windows\System32\drivers\EhStorClass.sys [82784 2013-08-22] (Microsoft Corporation)
S5 EhStorTcgDrv; C:\Windows\System32\drivers\EhStorTcgDrv.sys [114016 2013-08-22] (Microsoft Corporation)
R5 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [79192 2014-03-18] (Microsoft Corporation)
R5 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [354112 2014-08-26] (Microsoft Corporation)
U5 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [30048 2013-08-22] (Microsoft Corporation)
R5 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [589656 2014-07-18] (Microsoft Corporation)
S5 gagp30kx; C:\Windows\System32\drivers\gagp30kx.sys [65888 2013-08-22] (Microsoft Corporation)
S5 HpSAMD; C:\Windows\System32\drivers\HpSAMD.sys [64352 2013-08-22] (Hewlett-Packard Company)
S5 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [24416 2013-08-22] (Microsoft Corporation)
S5 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-10] (Intel Corporation)
S5 iaStorV; C:\Windows\System32\drivers\iaStorV.sys [412000 2013-08-22] (Intel Corporation)
S5 intelide; C:\Windows\System32\drivers\intelide.sys [18272 2013-08-22] (Microsoft Corporation)
R5 intelpep; C:\Windows\System32\drivers\intelpep.sys [39744 2014-10-13] (Microsoft Corporation)
S5 isapnp; C:\Windows\System32\drivers\isapnp.sys [21856 2013-08-22] (Microsoft Corporation)
R5 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [100672 2014-10-29] (Microsoft Corporation)
R5 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [178008 2015-06-28] (Microsoft Corporation)
S5 LSI_SAS; C:\Windows\System32\drivers\lsi_sas.sys [109408 2013-08-22] (LSI Corporation)
S5 LSI_SAS2; C:\Windows\System32\drivers\lsi_sas2.sys [93536 2013-08-22] (LSI Corporation)
S5 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
S5 LSI_SSS; C:\Windows\System32\drivers\lsi_sss.sys [82784 2013-08-22] (LSI Corporation)
S5 megasas; C:\Windows\System32\drivers\megasas.sys [56672 2013-08-22] (LSI Corporation)
S5 megasr; C:\Windows\System32\drivers\megasr.sys [575840 2013-08-22] (LSI Corporation, Inc.)
R5 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [101720 2015-07-16] (Microsoft Corporation)
R5 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [17248 2013-08-22] (Microsoft Corporation)
R5 Mup; C:\Windows\System32\Drivers\mup.sys [78688 2013-08-22] (Microsoft Corporation)
S5 mvumis; C:\Windows\System32\drivers\mvumis.sys [63840 2013-08-22] (Marvell Semiconductor, Inc.)
R5 NDIS; C:\Windows\System32\drivers\ndis.sys [1113944 2015-07-14] (Microsoft Corporation)
R1 nethfdrv; C:\WINDOWS\system32\drivers\nethfdrv.sys [46160 2015-07-30] (nethfdrv)
S5 nvraid; C:\Windows\System32\drivers\nvraid.sys [150368 2013-08-22] (NVIDIA Corporation)
S5 nvstor; C:\Windows\System32\drivers\nvstor.sys [168288 2013-08-22] (NVIDIA Corporation)
S5 nv_agp; C:\Windows\System32\drivers\nv_agp.sys [124768 2013-08-22] (Microsoft Corporation)
R5 partmgr; C:\Windows\System32\drivers\partmgr.sys [88896 2014-10-15] (Microsoft Corporation)
R5 pci; C:\Windows\System32\drivers\pci.sys [280384 2014-07-24] (Microsoft Corporation)
R5 pciide; C:\Windows\System32\drivers\pciide.sys [14688 2013-08-22] (Microsoft Corporation)
S5 pcmcia; C:\Windows\System32\drivers\pcmcia.sys [114528 2013-08-22] (Microsoft Corporation)
R5 pcw; C:\Windows\System32\drivers\pcw.sys [50016 2013-08-22] (Microsoft Corporation)
R5 pdc; C:\Windows\System32\drivers\pdc.sys [86336 2014-10-13] (Microsoft Corporation)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMUdisk64.sys [62264 2015-08-21] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQSysMonX64.sys [127800 2015-08-21] (电脑管家)
R5 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [249688 2014-03-18] (Microsoft Corporation)
S5 sbp2port; C:\Windows\System32\drivers\sbp2port.sys [107872 2013-08-22] (Microsoft Corporation)
S5 SiSRaid2; C:\Windows\System32\drivers\SiSRaid2.sys [44896 2013-08-22] (Silicon Integrated Systems Corp.)
S5 SiSRaid4; C:\Windows\System32\drivers\sisraid4.sys [81760 2013-08-22] (Silicon Integrated Systems)
R3 SMUpdd; C:\Program Files\Common Files\Goobzo\GBUpdate\smw.sys [41632 2015-07-26] ()
R5 spaceport; C:\Windows\System32\drivers\spaceport.sys [415040 2014-10-29] (Microsoft Corporation)
R3 SPBIUpdd; C:\Program Files\Common Files\ShopperPro\spbiw.sys [41632 2015-07-26] ()
R2 SPDRIVER_1.42.1.2188; C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.sys [52384 2015-07-26] ()
S5 stexstor; C:\Windows\System32\drivers\stexstor.sys [31072 2013-08-22] (Promise Technology, Inc.)
R5 storahci; C:\Windows\System32\drivers\storahci.sys [107872 2013-08-22] (Microsoft Corporation)
S5 storflt; C:\Windows\System32\drivers\vmstorfl.sys [49944 2014-10-29] (Microsoft Corporation)
S5 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2014-03-18] (Microsoft Corporation)
S5 storvsc; C:\Windows\System32\drivers\storvsc.sys [45888 2013-08-22] (Microsoft Corporation)
R2 TAOAccelerator; C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys [99640 2015-08-21] (Tencent)
R1 TAOKernelDriver; C:\Windows\System32\Drivers\TAOKernel64.sys [174392 2015-08-21] (Tencent Technology(Shenzhen) Company Limited)
R5 Tcpip; C:\Windows\System32\drivers\tcpip.sys [2476376 2015-06-11] (Microsoft Corporation)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2015-08-21] (电脑管家)
R1 TSCPM; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\tscpm64.sys [42296 2015-08-21] (电脑管家)
S1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSDefenseBT64.sys [28472 2015-08-21] (Tencent)
R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TSSysKit64.sys [87352 2015-08-21] (电脑管家)
S5 uagp35; C:\Windows\System32\drivers\uagp35.sys [64864 2013-08-22] (Microsoft Corporation)
S5 uliagpkx; C:\Windows\System32\drivers\uliagpkx.sys [65888 2013-08-22] (Microsoft Corporation)
R5 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [37728 2013-08-22] (Microsoft Corporation)
S5 viaide; C:\Windows\System32\drivers\viaide.sys [19808 2013-08-22] (VIA Technologies, Inc.)
S5 vmbus; C:\Windows\System32\drivers\vmbus.sys [97048 2014-10-29] (Microsoft Corporation)
R5 volmgr; C:\Windows\System32\drivers\volmgr.sys [73568 2013-08-22] (Microsoft Corporation)
R5 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [377696 2013-08-22] (Microsoft Corporation)
R5 volsnap; C:\Windows\System32\drivers\volsnap.sys [310080 2014-06-19] (Microsoft Corporation)
S5 vsmraid; C:\Windows\System32\drivers\vsmraid.sys [168800 2013-08-22] (VIA Technologies Inc.,Ltd)
S5 VSTXRAID; C:\Windows\System32\drivers\vstxraid.sys [305504 2013-08-22] (VIA Corporation)
R5 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [839488 2013-08-22] (Microsoft Corporation)
R5 WFPLWFS; C:\Windows\System32\DRIVERS\wfplwfs.sys [136512 2014-10-29] (Microsoft Corporation)
R5 Wof; C:\Windows\System32\Drivers\Wof.sys [157016 2014-05-06] (Microsoft Corporation)
R1 wsfd_vw_1_10_0_20; C:\Windows\System32\drivers\wsfd_vw_1_10_0_20.sys [57728 2015-07-06] (WS)
S3 ZeoScanner; C:\Windows\System32\DRIVERS\zeoscanner.sys [25208 2015-07-17] (Windows (R) Win 7 DDK provider)
S2 APXACC; \SystemRoot\system32\DRIVERS\appexDrv.sys [X]
S3 SPPD; \??\C:\WINDOWS\system32\drivers\SPPD.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-21 16:57 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\TXQMPC
2015-08-21 16:57 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\KingSoft
2015-08-21 16:55 - 2015-08-21 16:55 - 00000000 ____D C:\ProgramData\Rising
2015-08-21 16:55 - 2015-08-21 16:55 - 00000000 ____D C:\Program Files (x86)\Rising
2015-08-21 16:54 - 2015-08-21 16:56 - 00061735 _____ C:\Users\VeraHagge\Downloads\FRST.txt
2015-08-21 16:54 - 2015-08-21 16:54 - 00000000 ____D C:\Program Files\Common Files\Tencent
2015-08-21 16:54 - 2015-08-21 16:51 - 00099640 _____ (Tencent) C:\WINDOWS\system32\Drivers\TAOAccelerator64.sys
2015-08-21 16:53 - 2015-08-21 16:51 - 00174392 _____ (Tencent Technology(Shenzhen) Company Limited) C:\WINDOWS\system32\Drivers\TAOKernel64.sys
2015-08-21 16:52 - 2015-08-21 16:52 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2015-08-21 16:52 - 2015-08-21 16:51 - 00087864 _____ (电脑管家) C:\WINDOWS\system32\Drivers\TFsFltX64.sys
2015-08-21 16:51 - 2015-08-21 16:57 - 00000000 ____D C:\ProgramData\Tencent
2015-08-21 16:51 - 2015-08-21 16:54 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Tencent
2015-08-21 16:51 - 2015-08-21 16:51 - 00000000 ____D C:\Program Files (x86)\Tencent
2015-08-21 16:49 - 2015-08-21 16:32 - 02173952 _____ (Farbar) C:\Users\VeraHagge\Downloads\FRST64(1).exe
2015-08-21 16:49 - 2015-08-21 16:31 - 00380416 _____ C:\Users\VeraHagge\Downloads\Gmer-19357.exe
2015-08-21 16:42 - 2015-08-21 16:54 - 00000000 ____D C:\FRST
2015-08-21 16:41 - 2015-08-21 16:41 - 00000000 _____ C:\Users\VeraHagge\defogger_reenable
2015-08-21 16:25 - 2015-08-21 16:25 - 00000376 _____ C:\WINDOWS\Tasks\APSnotifierPP2.job
2015-08-21 16:24 - 2015-08-21 16:53 - 00000378 _____ C:\WINDOWS\Tasks\APSnotifierPP1.job
2015-08-21 16:24 - 2015-08-21 16:25 - 00002816 _____ C:\WINDOWS\System32\Tasks\APSnotifierPP1
2015-08-21 16:24 - 2015-08-21 16:24 - 00001068 _____ C:\Users\VeraHagge\Desktop\AnyProtect.lnk
2015-08-21 16:24 - 2015-08-21 16:24 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-08-21 16:21 - 2015-08-21 16:21 - 00613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsbBBED.tmp
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SysassistByHotWheel
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\gmsd_de_005010066
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\qycache
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\Program Files (x86)\gmsd_de_005010066
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\ppsfile
2015-08-21 16:14 - 2015-08-21 16:18 - 00000000 ____D C:\IQIYI Video
2015-08-21 16:14 - 2015-08-21 16:14 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\IQIYI Video
2015-08-21 16:14 - 2015-08-21 16:14 - 00000000 ____D C:\Users\Public\QiYi
2015-08-21 16:13 - 2015-08-21 16:14 - 00000000 ____D C:\ProgramData\IQIYI Video
2015-08-21 16:12 - 2015-08-21 16:12 - 00003266 _____ C:\WINDOWS\System32\Tasks\Super Optimizer Schedule
2015-08-21 16:12 - 2015-08-21 16:12 - 00000000 ____D C:\Users\VeraHagge\Documents\Super Optimizer
2015-08-21 16:11 - 2015-08-21 16:11 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Super Optimizer
2015-08-21 16:10 - 2015-08-21 16:10 - 00000000 ____D C:\Program Files (x86)\baidu
2015-08-21 16:05 - 2015-08-21 16:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Super Optimizer
2015-08-21 16:05 - 2015-08-21 16:05 - 00001109 _____ C:\Users\VeraHagge\Desktop\Super Optimizer.lnk
2015-08-21 16:04 - 2015-08-21 16:12 - 00043664 _____ C:\WINDOWS\system32\Drivers\hitmanpro37.sys
2015-08-21 16:04 - 2015-08-21 16:06 - 00000000 ____D C:\Program Files (x86)\Super Optimizer
2015-08-21 16:03 - 2015-08-21 16:03 - 00000000 ____D C:\Program Files (x86)\MiniLite
2015-08-21 16:02 - 2015-08-21 16:04 - 00000000 ____D C:\ProgramData\eWinManProe
2015-08-21 15:44 - 2015-08-21 15:44 - 00000000 ____D C:\ProgramData\{9067e982-1f12-20b7-9067-7e9821f1a608}
2015-08-21 15:30 - 2015-08-21 15:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Windesk_Winsearch
2015-08-21 15:29 - 2015-08-21 15:29 - 00001131 _____ C:\Users\Public\Desktop\WindeskWinsearch.lnk
2015-08-21 15:29 - 2015-08-21 15:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WindeskWinsearch
2015-08-21 15:29 - 2015-08-21 15:29 - 00000000 ____D C:\Program Files (x86)\WindeskWinsearch
2015-08-21 15:28 - 2015-08-21 15:28 - 00000000 ____D C:\Users\VeraHagge\Downloads\antivir
2015-08-21 15:24 - 2015-08-21 15:24 - 00000687 _____ C:\awhFF08.tmp
2015-08-21 15:11 - 2015-08-21 15:11 - 00000687 _____ C:\awh998E.tmp
2015-08-21 12:32 - 2015-08-21 12:32 - 00000687 _____ C:\awhF033.tmp
2015-08-21 12:32 - 2015-07-29 16:37 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-08-21 12:32 - 2015-07-29 16:30 - 01381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-08-21 12:32 - 2015-07-29 16:23 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-08-21 12:32 - 2015-07-29 01:24 - 00025776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-08-21 12:32 - 2015-07-28 16:24 - 01148416 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-08-21 12:32 - 2015-07-28 16:24 - 01116160 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-08-21 12:32 - 2015-07-28 16:24 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-08-21 12:32 - 2015-07-28 16:24 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-08-21 12:32 - 2015-07-28 16:24 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-08-21 12:32 - 2015-07-28 16:24 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-08-21 12:32 - 2015-07-24 20:57 - 04177408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-08-21 12:32 - 2015-07-24 20:57 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-08-21 12:32 - 2015-07-24 20:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-08-21 12:32 - 2015-07-24 19:27 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-08-21 12:32 - 2015-07-24 19:23 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-08-21 12:32 - 2015-07-16 23:14 - 25192448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-08-21 12:32 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-08-21 12:32 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-08-21 12:32 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-08-21 12:32 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-08-21 12:32 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-08-21 12:32 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-08-21 12:32 - 2015-07-16 22:20 - 19870208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-08-21 12:32 - 2015-07-16 21:53 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-08-21 12:32 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-08-21 12:32 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-08-21 12:32 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-08-21 12:32 - 2015-07-16 21:45 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-08-21 12:32 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-08-21 12:32 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-08-21 12:32 - 2015-07-16 21:38 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-08-21 12:32 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-08-21 12:32 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-08-21 12:32 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-08-21 12:32 - 2015-07-16 21:14 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-08-21 12:32 - 2015-07-16 21:13 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-08-21 12:32 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-08-21 12:32 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-08-21 12:32 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-08-21 12:32 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-08-21 12:32 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-08-21 12:32 - 2015-07-16 20:52 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-08-21 12:32 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-08-21 12:32 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-08-21 12:32 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-08-21 12:32 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-08-21 12:32 - 2015-07-16 02:29 - 07458648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-08-21 12:32 - 2015-07-16 02:29 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-08-21 12:32 - 2015-07-16 02:29 - 00101720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys
2015-08-21 12:32 - 2015-07-16 02:28 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-08-21 12:32 - 2015-07-14 23:59 - 01113944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2015-08-21 12:32 - 2015-07-14 23:59 - 00487256 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2015-08-21 12:32 - 2015-07-14 23:59 - 00393560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2015-08-21 12:32 - 2015-07-14 05:22 - 02529880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-08-21 12:32 - 2015-07-14 05:21 - 01901776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-08-21 12:32 - 2015-07-13 21:46 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\csrsrv.dll
2015-08-21 12:32 - 2015-07-13 21:45 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2015-08-21 12:32 - 2015-07-10 20:19 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2015-08-21 12:32 - 2015-07-10 19:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2015-08-21 12:32 - 2015-07-10 19:42 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-08-21 12:32 - 2015-07-10 19:14 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2015-08-21 12:32 - 2015-07-10 19:13 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2015-08-21 12:32 - 2015-07-10 18:47 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-08-21 12:32 - 2015-07-10 18:31 - 06213120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2015-08-21 12:32 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe
2015-08-21 12:32 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe
2015-08-21 12:32 - 2015-07-09 18:30 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
2015-08-21 12:32 - 2015-07-07 11:40 - 00270168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-08-21 12:32 - 2015-07-07 11:40 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-08-21 12:32 - 2015-07-07 11:40 - 00044560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-08-21 12:32 - 2015-07-02 00:19 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2015-08-21 12:32 - 2015-07-02 00:16 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2015-08-21 12:32 - 2015-07-01 23:37 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2015-08-21 12:32 - 2015-07-01 23:35 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2015-08-21 12:32 - 2015-06-12 19:03 - 18823680 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2015-08-21 12:32 - 2015-06-12 18:36 - 15159296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2015-08-21 12:32 - 2015-06-11 22:12 - 02476376 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2015-08-21 12:32 - 2015-06-11 22:12 - 00428888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\FWPKCLNT.SYS
2015-08-21 08:43 - 2015-08-22 01:06 - 00001397 _____ C:\startup.log
2015-08-13 13:33 - 2015-08-13 13:33 - 00000687 _____ C:\awhEDA9.tmp
2015-08-13 13:29 - 2015-08-21 16:38 - 00000000 ____D C:\ProgramData\HitmanPro
2015-08-10 20:42 - 2015-08-21 15:23 - 00003320 _____ C:\WINDOWS\System32\Tasks\ASP
2015-08-10 20:42 - 2015-08-21 15:23 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\ASP
2015-08-10 20:41 - 2015-08-13 13:25 - 00000294 _____ C:\WINDOWS\Tasks\RegClean Pro_UPDATES.job
2015-08-10 20:41 - 2015-08-13 13:25 - 00000286 _____ C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job
2015-08-10 20:41 - 2015-08-10 20:41 - 00003090 _____ C:\WINDOWS\System32\Tasks\RegClean Pro
2015-08-10 20:41 - 2015-08-10 20:41 - 00003026 _____ C:\WINDOWS\System32\Tasks\RegClean Pro_UPDATES
2015-08-10 20:41 - 2015-08-10 20:41 - 00002870 _____ C:\WINDOWS\System32\Tasks\RegClean Pro_DEFAULT
2015-08-10 20:41 - 2015-08-10 20:41 - 00001004 _____ C:\Users\Public\Desktop\RegClean Pro.lnk
2015-08-10 20:41 - 2015-08-10 20:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RegClean Pro
2015-08-10 20:41 - 2015-08-10 20:41 - 00000000 ____D C:\Program Files (x86)\RCP
2015-08-10 20:41 - 2015-07-02 14:14 - 00020248 _____ () C:\WINDOWS\system32\roboot64.exe
2015-08-10 20:40 - 2015-08-10 20:40 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\systweak
2015-08-10 20:38 - 2015-08-21 15:29 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057
2015-08-10 20:38 - 2015-08-10 20:38 - 00000000 ____D C:\Program Files (x86)\gmsd_de_005010057
2015-08-10 20:35 - 2015-08-21 16:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\mystartsearch
2015-08-10 20:35 - 2015-08-10 20:36 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\cpuminer
2015-08-10 20:35 - 2015-08-10 20:35 - 00000000 ____D C:\ProgramData\5WinManPro5
2015-08-10 20:19 - 2015-08-10 20:19 - 00001030 _____ C:\Users\VeraHagge\Desktop\GUPlayer.lnk
2015-08-10 20:19 - 2015-08-10 20:19 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer
2015-08-10 20:19 - 2015-08-10 20:19 - 00000000 ____D C:\Program Files (x86)\predm
2015-08-10 20:18 - 2015-08-10 20:23 - 00001374 _____ C:\Users\VeraHagge\Desktop\Continue GamesDesktop Uninstaller.lnk
2015-08-10 20:07 - 2015-08-10 20:07 - 03531374 _____ C:\Users\VeraHagge\AppData\Local\curl.zip
2015-08-10 20:07 - 2015-08-10 20:07 - 00003836 _____ C:\WINDOWS\System32\Tasks\uBr
2015-08-10 20:07 - 2015-08-10 20:07 - 00003776 _____ C:\WINDOWS\System32\Tasks\keepup
2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\pdfie
2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\NewNotepad
2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\iuv0j
2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\cu
2015-08-10 20:07 - 2015-08-10 20:07 - 00000000 ____D C:\ProgramData\Convertor
2015-08-10 19:47 - 2015-08-10 19:47 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\bvxvyxvec
2015-08-10 19:46 - 2015-08-10 19:46 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}
2015-08-07 20:13 - 2015-08-07 20:13 - 01423136 _____ C:\WINDOWS\system32\cpuminer-gw64.exe
2015-08-07 18:57 - 2015-08-07 18:57 - 00000220 _____ C:\WINDOWS\system32\cpuminer-conf.json
2015-07-31 19:56 - 2015-07-31 19:56 - 00000000 ____D C:\Program Files (x86)\Proxy List  Free Proxies for everyone
2015-07-31 19:54 - 2015-07-31 19:57 - 00000000 ____D C:\Program Files (x86)\buyfastt
2015-07-31 19:53 - 2015-08-21 13:53 - 00000382 _____ C:\WINDOWS\Tasks\WheelsMaster.job
2015-07-31 19:53 - 2015-07-31 19:53 - 00003276 _____ C:\WINDOWS\System32\Tasks\WheelsMaster
2015-07-31 19:53 - 2015-07-31 19:53 - 00000000 ____D C:\ProgramData\{ef8baf33-367f-614b-ef8b-baf33367bccc}
2015-07-31 13:39 - 2015-07-31 13:39 - 00000000 ____D C:\ProgramData\{9448b5cb-7fb0-e8b2-9448-8b5cb7fbd72d}
2015-07-31 13:35 - 2015-07-31 13:35 - 00003256 _____ C:\WINDOWS\System32\Tasks\DailyPCClean Schedule
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\Documents\DailyPCClean
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\DailyPCClean
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DailyPcClean Support
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DailyPCClean
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Program Files (x86)\DailyPcClean Support
2015-07-31 13:35 - 2015-07-31 13:35 - 00000000 ____D C:\Program Files (x86)\DailyPCClean
2015-07-31 13:33 - 2015-07-31 13:35 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en(2).exe
2015-07-31 13:27 - 2015-07-31 13:27 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{E6207534-D154-409E-9FA4-5A81CFBB6126}
2015-07-31 13:27 - 2015-07-31 13:27 - 00000000 ____D C:\Program Files (x86)\LibrarySystem
2015-07-30 11:19 - 2015-07-30 11:19 - 00000000 ____D C:\ProgramData\{cd6397c2-994a-f3eb-cd63-397c29945f0a}
2015-07-30 11:13 - 2015-07-30 11:14 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en(1).exe
2015-07-30 11:12 - 2015-07-30 11:12 - 00003568 _____ C:\WINDOWS\System32\Tasks\Shop-wit Updater
2015-07-30 11:12 - 2015-07-30 11:12 - 00000000 ____D C:\Program Files (x86)\shopwit
2015-07-30 04:10 - 2015-07-30 04:10 - 00350720 _____ C:\WINDOWS\SysWOW64\nethtsrv.exe
2015-07-30 04:10 - 2015-07-30 04:10 - 00190976 _____ C:\WINDOWS\SysWOW64\netupdsrv.exe
2015-07-30 04:10 - 2015-07-30 04:10 - 00140288 _____ C:\WINDOWS\SysWOW64\installd.exe
2015-07-30 04:10 - 2015-07-30 04:10 - 00046160 _____ (nethfdrv) C:\WINDOWS\system32\Drivers\nethfdrv.sys
2015-07-30 04:09 - 2015-07-30 04:09 - 00438272 _____ C:\WINDOWS\SysWOW64\hfpapi.dll
2015-07-30 04:09 - 2015-07-30 04:09 - 00108544 _____ C:\WINDOWS\SysWOW64\hfnapi.dll
2015-07-29 22:45 - 2015-07-29 22:45 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{4D1A77BC-63B0-464F-823D-97B5B2CE8CD1}
2015-07-29 13:09 - 2015-07-29 13:09 - 00000000 ____D C:\Program Files (x86)\Media Downloader
2015-07-29 13:09 - 2015-07-29 13:09 - 00000000 ____D C:\Program Files (x86)\EZ Software Updater
2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\rec_de_57
2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Program Files (x86)\rec_de_57
2015-07-29 12:59 - 2015-07-29 12:59 - 00000000 ____D C:\Program Files (x86)\MyBestOffersToday
2015-07-29 08:45 - 2015-07-29 08:45 - 00000000 ____D C:\ProgramData\{8a5acb8e-91ed-48f3-8a5a-acb8e91e2e3a}
2015-07-29 08:39 - 2015-07-31 13:31 - 00002134 _____ C:\Users\VeraHagge\Desktop\Continue Games Desktop.lnk
2015-07-29 08:39 - 2015-07-29 08:40 - 04810368 _____ ( ) C:\Users\VeraHagge\Desktop\setup_gmsd_en.exe
2015-07-29 08:37 - 2015-07-29 08:37 - 00000000 ____D C:\DesktopSearch
2015-07-29 00:10 - 2015-08-21 16:45 - 00001942 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-07-29 00:10 - 2015-08-21 16:45 - 00001942 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-07-29 00:10 - 2015-07-29 00:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-28 17:44 - 2015-07-28 17:44 - 00001608 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Erstellen ‪Sie sich einen Wiederherstellungsdateträger.lnk
2015-07-28 17:44 - 2015-07-28 17:44 - 00001022 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Treiber und Software.lnk
2015-07-28 17:43 - 2015-07-28 17:43 - 00002090 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup.lnk
2015-07-28 17:43 - 2015-07-28 17:43 - 00000714 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\setup_gmsd_en.lnk
2015-07-28 17:42 - 2015-07-28 17:42 - 00002429 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Continue Games Desktop.lnk
2015-07-28 12:14 - 2015-08-21 15:20 - 00000394 _____ C:\WINDOWS\Tasks\LVKAHSH1.job
2015-07-28 12:14 - 2015-08-10 20:19 - 00000000 ____D C:\Program Files (x86)\GUPlayer
2015-07-28 12:14 - 2015-07-31 13:28 - 00000000 ____D C:\ProgramData\SecurityUtility
2015-07-28 12:14 - 2015-07-28 12:14 - 00002908 _____ C:\WINDOWS\System32\Tasks\LVKAHSH1
2015-07-28 12:14 - 2015-07-28 12:14 - 00000000 ____D C:\ProgramData\7b24ec7cc000461ebe26d116b88142c8
2015-07-28 12:13 - 2015-07-28 12:18 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\InetStat
2015-07-28 12:13 - 2015-07-28 12:13 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2015-07-28 10:26 - 2015-07-28 10:26 - 00000000 ____D C:\ProgramData\Radio
2015-07-27 22:26 - 2015-08-10 20:07 - 00003252 _____ C:\WINDOWS\System32\Tasks\DriverMgr
2015-07-27 22:26 - 2015-08-10 20:07 - 00000306 __RSH C:\ProgramData\ntuser.pol
2015-07-27 22:26 - 2015-07-31 13:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Winsta
2015-07-27 22:26 - 2015-07-27 22:26 - 00000540 _____ C:\Users\VeraHagge\AppData\Local\s6zI3.vbs
2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\WinKit
2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\jellylam
2015-07-27 22:26 - 2015-07-27 22:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Convertor
2015-07-27 15:25 - 2015-04-30 22:35 - 00124112 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-07-27 15:25 - 2015-04-30 22:35 - 00102608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-07-27 14:42 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TsWpfWrp.exe
2015-07-27 14:42 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\WINDOWS\system32\TsWpfWrp.exe
2015-07-27 01:49 - 2015-08-21 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\speed browser
2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\speed browser
2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Users\Administrator\AppData\Local\speed browser
2015-07-27 01:49 - 2015-07-27 01:49 - 00000000 ____D C:\Program Files (x86)\speed browser
2015-07-27 01:46 - 2015-07-27 01:46 - 00000000 ____D C:\ProgramData\Browser
2015-07-27 01:24 - 2015-07-31 13:30 - 00004208 _____ C:\WINDOWS\System32\Tasks\ShopperPro
2015-07-27 01:24 - 2015-07-27 01:24 - 00004252 _____ C:\WINDOWS\System32\Tasks\SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34
2015-07-27 01:24 - 2015-07-27 01:24 - 00003504 _____ C:\WINDOWS\System32\Tasks\SPDriver
2015-07-27 01:24 - 2015-07-27 01:24 - 00000000 ____D C:\Program Files\Common Files\ShopperPro
2015-07-27 01:23 - 2015-08-21 16:32 - 00003578 _____ C:\WINDOWS\System32\Tasks\ShopperProJSUpd
2015-07-27 01:23 - 2015-08-21 16:31 - 00000000 ____D C:\Program Files (x86)\ShopperPro
2015-07-27 01:23 - 2015-07-27 01:24 - 00000000 ____D C:\ProgramData\ShopperPro
2015-07-27 01:23 - 2015-07-27 01:23 - 00000000 ____D C:\Users\Public\Documents\ShopperPro
2015-07-27 01:16 - 2015-07-28 17:42 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DeskBar
2015-07-27 01:16 - 2015-07-27 01:16 - 00004258 _____ C:\WINDOWS\System32\Tasks\SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34
2015-07-27 01:16 - 2015-07-27 01:16 - 00003864 _____ C:\WINDOWS\System32\Tasks\SMWUpd
2015-07-27 01:16 - 2015-07-27 01:16 - 00000000 ____D C:\ProgramData\SearchModule
2015-07-27 01:16 - 2015-07-27 01:16 - 00000000 ____D C:\Program Files\Common Files\Goobzo
2015-07-27 01:15 - 2015-07-27 01:15 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\CrashRpt
2015-07-26 20:57 - 2015-07-26 20:57 - 00000686 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Alte Firefox-Daten.lnk
2015-07-26 19:33 - 2015-07-26 19:33 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{0E4761C0-1449-43A1-9EF0-8A28FDBCC3E2}
2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\WINDOWS\SysWOW64\XPSViewer
2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files\Reference Assemblies
2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files\MSBuild
2015-07-26 16:25 - 2015-07-26 16:25 - 00000000 ____D C:\Program Files (x86)\MSBuild
2015-07-26 16:21 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationNative_v0300.dll
2015-07-26 16:21 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationNative_v0300.dll
2015-07-26 11:04 - 2015-08-21 16:24 - 00000000 ____D C:\Program Files (x86)\AnyProtectEx
2015-07-26 11:04 - 2015-07-26 11:04 - 00613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsl7AFB.tmp
2015-07-26 11:04 - 2015-07-26 11:04 - 00000000 __SHD C:\Users\VeraHagge\AppData\Roaming\AnyProtectEx
2015-07-26 11:03 - 2015-07-26 11:04 - 00000000 ____D C:\Program Files\shopperz22072015
2015-07-26 11:03 - 2015-07-26 11:03 - 00003652 _____ C:\WINDOWS\System32\Tasks\Papuir
2015-07-26 11:03 - 2015-07-26 11:03 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Kromtech
2015-07-26 11:03 - 2015-06-18 12:08 - 00061336 _____ (Cherimoya Ltd) C:\WINDOWS\system32\Drivers\cherimoya.sys
2015-07-26 11:02 - 2015-08-10 20:07 - 00003334 _____ C:\WINDOWS\System32\Tasks\WinKit
2015-07-26 11:02 - 2015-07-27 22:26 - 00003794 _____ C:\WINDOWS\System32\Tasks\Convertor
2015-07-26 11:02 - 2015-07-27 22:26 - 00003310 _____ C:\WINDOWS\System32\Tasks\Winsta Update
2015-07-26 11:02 - 2015-07-26 11:02 - 00000000 ____D C:\Program Files (x86)\Winsta
2015-07-26 11:01 - 2015-07-26 11:02 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DocToPDFConverter
2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\PDFConvert
2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\DocToPDFConverter
2015-07-26 11:01 - 2015-07-26 11:01 - 00000000 ____D C:\Program Files (x86)\Convertor
2015-07-26 10:59 - 2015-08-21 16:22 - 00003150 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6.job
2015-07-26 10:59 - 2015-08-21 15:20 - 00003150 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7.job
2015-07-26 10:59 - 2015-08-21 15:20 - 00002458 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user.job
2015-07-26 10:59 - 2015-08-21 15:20 - 00002458 _____ C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5.job
2015-07-26 10:59 - 2015-07-26 10:59 - 00006154 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7
2015-07-26 10:59 - 2015-07-26 10:59 - 00006154 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6
2015-07-26 10:59 - 2015-07-26 10:59 - 00005462 _____ C:\WINDOWS\System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5
2015-07-26 10:58 - 2015-08-21 16:44 - 00003454 _____ C:\WINDOWS\System32\Tasks\Oikliuhoad
2015-07-26 10:58 - 2015-08-10 20:36 - 00000000 ____D C:\Program Files (x86)\MiuiTab
2015-07-26 10:58 - 2015-07-29 00:33 - 00003272 _____ C:\WINDOWS\System32\Tasks\Optimizer Pro Schedule
2015-07-26 10:58 - 2015-07-26 10:59 - 00000000 ____D C:\Program Files (x86)\BrowserV25.07
2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\Users\VeraHagge\Documents\Optimizer Pro
2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Optimizer Pro
2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-07-26 10:58 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-07-26 10:57 - 2015-07-29 16:07 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\DesktopSearch
2015-07-26 10:57 - 2015-07-26 10:58 - 00000000 ____D C:\ProgramData\Oikliuhoad
2015-07-26 10:57 - 2015-07-26 10:57 - 00000000 _____ C:\WINDOWS\prleth.sys
2015-07-26 10:57 - 2015-07-26 10:57 - 00000000 _____ C:\WINDOWS\hgfs.sys
2015-07-26 10:56 - 2015-08-21 16:56 - 00001084 _____ C:\WINDOWS\Tasks\Crossbrowse.job
2015-07-26 10:56 - 2015-08-10 20:36 - 00000000 ____D C:\Program Files (x86)\FriendlyError
2015-07-26 10:56 - 2015-07-26 10:56 - 00004094 _____ C:\WINDOWS\System32\Tasks\Crossbrowse
2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\istartsurf
2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Crossbrowse
2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-07-26 10:56 - 2015-07-26 10:56 - 00000000 ____D C:\Program Files (x86)\Crossbrowse
2015-07-26 10:55 - 2015-07-28 10:41 - 00000000 ____D C:\ProgramData\MailUpdate
2015-07-26 10:55 - 2015-07-26 10:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SmartWeb
2015-07-26 10:55 - 2015-07-26 10:55 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\MailUpdate
2015-07-26 10:54 - 2015-07-26 10:54 - 00000000 ____D C:\Program Files (x86)\wincheck
2015-07-26 10:53 - 2015-08-21 16:45 - 00001948 _____ C:\Users\VeraHagge\Desktop\Iexplore .lnk
2015-07-26 10:53 - 2015-08-21 16:45 - 00001948 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Iexplore .lnk
2015-07-26 10:53 - 2015-08-21 16:45 - 00001942 _____ C:\Users\VeraHagge\AppData\Local\Firefox .lnk
2015-07-26 10:53 - 2015-08-21 16:45 - 00001936 _____ C:\Users\VeraHagge\AppData\Local\Iexplore .lnk
2015-07-26 10:53 - 2015-07-26 10:53 - 00000298 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome .lnk
2015-07-26 10:53 - 2015-07-26 10:53 - 00000298 _____ C:\Users\VeraHagge\AppData\Local\Chrome .lnk
2015-07-26 10:53 - 2015-07-26 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro v3.2
2015-07-26 10:52 - 2015-08-21 15:44 - 00003262 _____ C:\WINDOWS\System32\Tasks\Optscan
2015-07-26 10:52 - 2015-08-21 15:44 - 00000368 _____ C:\WINDOWS\Tasks\Optscan.job
2015-07-26 10:52 - 2015-07-26 10:53 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro 3.99
2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\ProgramData\{76f270a0-8ddb-0972-76f2-270a08ddc282}
2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\Program Files (x86)\youtubeadblocker
2015-07-26 10:52 - 2015-07-26 10:52 - 00000000 ____D C:\Program Files (x86)\Tweet Button for Chrome by Shareaho
2015-07-26 10:51 - 2015-07-31 19:56 - 00000000 ____D C:\ProgramData\6632678238890282139
2015-07-26 10:51 - 2015-07-26 10:53 - 00000000 ____D C:\ProgramData\rKRjrFKiDD
2015-07-26 10:51 - 2015-07-26 10:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desktop Search
2015-07-26 10:50 - 2015-07-26 10:51 - 00000000 ____D C:\Program Files (x86)\PPriiCeLeess
2015-07-26 10:49 - 2015-08-21 16:49 - 00000390 _____ C:\WINDOWS\Tasks\IntelliText.job
2015-07-26 10:49 - 2015-07-26 10:49 - 00003284 _____ C:\WINDOWS\System32\Tasks\IntelliText
2015-07-26 10:49 - 2015-07-26 10:49 - 00000000 ____D C:\ProgramData\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}
2015-07-26 10:45 - 2015-08-21 16:45 - 00002486 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user.job
2015-07-26 10:45 - 2015-08-21 16:45 - 00002486 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5.job
2015-07-26 10:45 - 2015-07-26 10:45 - 00005490 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5
2015-07-26 10:44 - 2015-08-21 16:44 - 00004534 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-4.job
2015-07-26 10:44 - 2015-08-21 16:44 - 00003514 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7.job
2015-07-26 10:44 - 2015-08-21 16:44 - 00003178 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6.job
2015-07-26 10:44 - 2015-08-21 16:44 - 00002152 _____ C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user.job
2015-07-26 10:44 - 2015-07-31 19:52 - 00000000 ____D C:\Program Files (x86)\03D40274-1437900249-057A-7206-A20700080009
2015-07-26 10:44 - 2015-07-31 13:30 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\03D40274-1437907493-057A-7206-A20700080009
2015-07-26 10:44 - 2015-07-26 10:45 - 00000000 ____D C:\Program Files (x86)\Lights Cinema 1.3betaV14.07
2015-07-26 10:44 - 2015-07-26 10:44 - 00007538 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-4
2015-07-26 10:44 - 2015-07-26 10:44 - 00006518 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7
2015-07-26 10:44 - 2015-07-26 10:44 - 00006182 _____ C:\WINDOWS\System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6
2015-07-26 10:44 - 2015-07-26 10:44 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2015-07-26 10:44 - 2013-08-22 15:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-07-26 10:42 - 2015-08-10 19:47 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2015-07-26 10:42 - 2015-07-26 10:43 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\SearchProtect
2015-07-26 10:40 - 2015-07-29 13:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Downloader
2015-07-26 10:40 - 2015-07-26 10:40 - 00010910 _____ C:\WINDOWS\System32\Tasks\DNSPALENVILLE PostInstall
2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL932.tmp
2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL8F3.tmp
2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL886.tmp
2015-07-26 10:40 - 2015-07-26 10:40 - 00000000 _____ C:\LIL857.tmp
2015-07-26 10:39 - 2015-07-26 10:41 - 00000000 ____D C:\6a08e3df-832b-4f9a-b9f5-18b3ace52db9
2015-07-26 10:38 - 2015-07-26 10:38 - 00296448 _____ C:\Users\VeraHagge\Downloads\Setup.exe
2015-07-26 10:34 - 2015-07-29 00:33 - 00003268 _____ C:\WINDOWS\System32\Tasks\OneSafe PC Cleaner Schedule
2015-07-26 10:34 - 2015-07-26 10:48 - 00000000 ____D C:\Users\VeraHagge\Documents\OneSafe PC Cleaner
2015-07-26 10:33 - 2015-07-26 10:34 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\OneSafe PC Cleaner
2015-07-26 10:33 - 2015-07-26 10:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneSafe PC Cleaner
2015-07-26 10:33 - 2015-07-26 10:33 - 00000000 ____D C:\Program Files (x86)\OneSafe PC Cleaner
2015-07-23 07:53 - 2015-07-23 07:53 - 00003668 _____ C:\WINDOWS\System32\Tasks\PCKeeper-Aktualisierungsprogramm
2015-07-23 07:52 - 2015-07-23 07:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kromtech
2015-07-23 07:50 - 2015-07-23 07:53 - 00000000 ____D C:\Program Files\Kromtech
2015-07-23 07:49 - 2015-07-27 15:28 - 00000000 ____D C:\ProgramData\Kromtech
2015-07-23 07:43 - 2015-07-23 07:43 - 00006235 _____ C:\WINDOWS\system32\ScanResults.xml
2015-07-23 07:40 - 2015-07-23 07:40 - 00000464 _____ C:\WINDOWS\system32\ScannerSettings
2015-07-23 07:33 - 2015-08-10 20:31 - 00000000 ____D C:\Program Files\WinZip Driver Updater
2015-07-23 07:26 - 2015-07-23 07:26 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\{96911369-42B5-4B2D-982D-9809511A53A6}
2015-07-22 22:48 - 2015-07-22 22:48 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-21 16:57 - 2015-07-12 01:57 - 00003138 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.job
2015-08-21 16:54 - 2015-06-08 01:14 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\VirtualStore
2015-08-21 16:53 - 2015-06-18 12:16 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\CrashDumps
2015-08-21 16:49 - 2015-06-08 01:24 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-1002
2015-08-21 16:45 - 2015-06-08 01:14 - 00002066 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-21 16:45 - 2014-09-10 10:51 - 00002066 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-21 16:41 - 2015-06-08 01:12 - 00000000 ____D C:\Users\VeraHagge
2015-08-21 16:22 - 2014-03-18 11:47 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-08-21 16:22 - 2014-03-18 11:30 - 00764340 _____ C:\WINDOWS\system32\perfh007.dat
2015-08-21 16:22 - 2014-03-18 11:30 - 00159160 _____ C:\WINDOWS\system32\perfc007.dat
2015-08-21 16:18 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-08-21 16:08 - 2015-07-12 02:50 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-08-21 15:40 - 2015-06-08 01:12 - 01603754 _____ C:\WINDOWS\WindowsUpdate.log
2015-08-21 15:30 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-08-21 15:21 - 2015-07-12 01:51 - 00000382 _____ C:\WINDOWS\Tasks\AmiUpdXp.job
2015-08-21 15:20 - 2015-07-12 01:57 - 00004840 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.job
2015-08-21 15:20 - 2015-07-12 01:57 - 00004494 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.job
2015-08-21 15:20 - 2015-07-12 01:57 - 00003138 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.job
2015-08-21 15:20 - 2015-07-12 01:57 - 00002446 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user.job
2015-08-21 15:20 - 2015-07-12 01:57 - 00002446 _____ C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.job
2015-08-21 15:20 - 2015-07-12 01:55 - 00000974 _____ C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-08-21 15:20 - 2015-07-12 01:55 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-21 15:19 - 2013-08-22 16:46 - 00031880 _____ C:\WINDOWS\setupact.log
2015-08-21 15:19 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-08-21 15:19 - 2013-08-22 16:44 - 00338016 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-21 15:18 - 2014-09-10 11:02 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2015-08-21 15:17 - 2015-06-12 13:34 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-08-21 15:17 - 2015-06-12 13:34 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-08-21 15:17 - 2015-06-11 15:18 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Defender
2015-08-21 15:17 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-08-21 15:16 - 2014-09-10 10:46 - 00000000 ____D C:\Users\Administrator
2015-08-21 15:11 - 2015-06-11 15:18 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-08-21 14:05 - 2015-07-17 21:06 - 09284296 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2015-08-21 14:05 - 2015-07-12 02:50 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-08-21 13:53 - 2015-07-12 01:53 - 00000368 _____ C:\WINDOWS\Tasks\Superclean.job
2015-08-21 12:32 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-08-13 13:25 - 2014-03-18 03:38 - 00749070 _____ C:\WINDOWS\PFRO.log
2015-08-10 20:07 - 2015-07-07 09:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-10 19:52 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-08-08 15:55 - 2013-08-22 17:38 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-08-08 15:55 - 2013-08-22 17:38 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-31 13:28 - 2015-07-12 02:12 - 00000000 ____D C:\ProgramData\4adc7a4f00005e5d
2015-07-30 11:04 - 2015-07-12 01:55 - 00000978 _____ C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-07-27 22:26 - 2013-08-22 17:36 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2015-07-27 22:26 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2015-07-26 19:33 - 2015-07-12 01:45 - 00003994 _____ C:\WINDOWS\System32\Tasks\LaunchPreSignup
2015-07-26 19:33 - 2015-07-12 01:45 - 00000000 ____D C:\Program Files (x86)\OLBPre
2015-07-26 16:25 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\SysWOW64\MUI
2015-07-26 16:25 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\MUI
2015-07-26 10:59 - 2015-07-12 01:55 - 00003950 _____ C:\WINDOWS\System32\Tasks\globalUpdateUpdateTaskMachineUA
2015-07-26 10:59 - 2015-07-12 01:55 - 00003714 _____ C:\WINDOWS\System32\Tasks\globalUpdateUpdateTaskMachineCore
2015-07-26 10:59 - 2015-07-12 01:55 - 00000000 ____D C:\Program Files (x86)\globalUpdate
2015-07-26 10:55 - 2015-06-22 09:02 - 00000000 ____D C:\Program Files (x86)\Boost
2015-07-26 10:54 - 2015-06-08 01:12 - 00000549 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-26 10:53 - 2015-06-08 01:12 - 00000551 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-26 10:53 - 2015-06-06 18:53 - 00002499 _____ C:\Users\Public\Desktop\SlimCleaner Plus.lnk
2015-07-26 10:53 - 2015-06-06 18:51 - 00002519 _____ C:\Users\Public\Desktop\DriverUpdate.lnk
2015-07-26 10:53 - 2014-09-10 20:43 - 00001338 _____ C:\Users\Default\Desktop\Erstellen ‪Sie sich einen Wiederherstellungsdateträger.lnk
2015-07-26 10:53 - 2014-09-10 20:43 - 00001338 _____ C:\Users\Default User\Desktop\Erstellen ‪Sie sich einen Wiederherstellungsdateträger.lnk
2015-07-26 10:53 - 2014-09-10 20:43 - 00000848 _____ C:\Users\Default\Desktop\Treiber und Software.lnk
2015-07-26 10:53 - 2014-09-10 20:43 - 00000848 _____ C:\Users\Default User\Desktop\Treiber und Software.lnk
2015-07-26 10:53 - 2014-09-10 10:46 - 00001338 _____ C:\Users\Administrator\Desktop\Erstellen ‪Sie sich einen Wiederherstellungsdateträger.lnk
2015-07-26 10:53 - 2014-09-10 10:46 - 00000848 _____ C:\Users\Administrator\Desktop\Treiber und Software.lnk
2015-07-26 10:53 - 2014-09-10 10:46 - 00000551 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-26 10:53 - 2014-09-10 10:46 - 00000549 _____ C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-26 10:53 - 2014-03-18 11:48 - 00000551 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-26 10:53 - 2014-03-18 11:48 - 00000551 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-07-26 10:53 - 2014-03-18 11:48 - 00000549 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-26 10:53 - 2014-03-18 11:48 - 00000549 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-07-26 03:52 - 2015-07-08 18:29 - 00000000 ____D C:\ProgramData\f43a0a22-b5b9-43e4-9c6f-705bf4e40c7b
2015-07-25 18:34 - 2015-07-20 17:27 - 00000165 _____ C:\WINDOWS\Reimage.ini
2015-07-25 18:26 - 2015-06-11 15:04 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-07-24 22:04 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-07-24 21:39 - 2015-07-20 17:31 - 00003452 _____ C:\WINDOWS\System32\Tasks\Reimage Reminder
2015-07-24 21:39 - 2015-06-06 18:59 - 00000000 ____D C:\rei
2015-07-23 07:53 - 2015-07-12 01:53 - 00000000 ____D C:\ProgramData\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-07-26 10:53 - 2015-07-26 10:53 - 0000298 _____ () C:\Users\VeraHagge\AppData\Local\Chrome .lnk
2015-08-10 20:07 - 2015-08-10 20:07 - 3531374 _____ () C:\Users\VeraHagge\AppData\Local\curl.zip
2015-07-26 10:53 - 2015-08-21 16:45 - 0001942 _____ () C:\Users\VeraHagge\AppData\Local\Firefox .lnk
2015-07-26 10:53 - 2015-08-21 16:45 - 0001936 _____ () C:\Users\VeraHagge\AppData\Local\Iexplore .lnk
2015-08-21 16:21 - 2015-08-21 16:21 - 0613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsbBBED.tmp
2015-07-26 11:04 - 2015-07-26 11:04 - 0613255 _____ (CMI Limited) C:\Users\VeraHagge\AppData\Local\nsl7AFB.tmp
2015-07-27 22:26 - 2015-07-27 22:26 - 0000540 _____ () C:\Users\VeraHagge\AppData\Local\s6zI3.vbs

Einige Dateien in TEMP:
====================
C:\Users\VeraHagge\AppData\Local\Temp\13895.exe
C:\Users\VeraHagge\AppData\Local\Temp\2300.exe
C:\Users\VeraHagge\AppData\Local\Temp\3276.exe
C:\Users\VeraHagge\AppData\Local\Temp\6068.exe
C:\Users\VeraHagge\AppData\Local\Temp\aff_setup0.exe
C:\Users\VeraHagge\AppData\Local\Temp\bitool.dll
C:\Users\VeraHagge\AppData\Local\Temp\install1215124.exe
C:\Users\VeraHagge\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe
C:\Users\VeraHagge\AppData\Local\Temp\jre-8u51-windows-au.exe
C:\Users\VeraHagge\AppData\Local\Temp\of3w22233.exe
C:\Users\VeraHagge\AppData\Local\Temp\of3w36381.exe
C:\Users\VeraHagge\AppData\Local\Temp\of3w55934.exe
C:\Users\VeraHagge\AppData\Local\Temp\of3w77613.exe
C:\Users\VeraHagge\AppData\Local\Temp\of3w91274.exe
C:\Users\VeraHagge\AppData\Local\Temp\optprosetup.exe
C:\Users\VeraHagge\AppData\Local\Temp\qqpcmgr_v10.7.16065.215_71643_Silence.exe
C:\Users\VeraHagge\AppData\Local\Temp\ReimagePackage.exe
C:\Users\VeraHagge\AppData\Local\Temp\Setup.exe
C:\Users\VeraHagge\AppData\Local\Temp\setup3.exe
C:\Users\VeraHagge\AppData\Local\Temp\ShopperProDBUPD.exe
C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe
C:\Users\VeraHagge\AppData\Local\Temp\shpwt.exe
C:\Users\VeraHagge\AppData\Local\Temp\sqlite3.exe
C:\Users\VeraHagge\AppData\Local\Temp\supoptsetup.exe
C:\Users\VeraHagge\AppData\Local\Temp\Uninstall.exe
C:\Users\VeraHagge\AppData\Local\Temp\z1upd43311.exe
C:\Users\VeraHagge\AppData\Local\Temp\z1upd59047.exe
C:\Users\VeraHagge\AppData\Local\Temp\zxupd71311.exe


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-07-20 21:09

==================== Ende von Ergebnis ============================

arev 22.08.2015 09:30
"IMHO" Ehrlicherweise finde ich den Scan und das Ergebnis von Hitman aussagekräftiger und umfassender. Oder?

Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:21-08-2015
durchgeführt von VeraHagge (2015-08-21 16:59:21)
Gestartet von C:\Users\VeraHagge\Downloads
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-3742509177-3204372618-1584296459-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-3742509177-3204372618-1584296459-501 - Limited - Disabled)
VeraHagge (S-1-5-21-3742509177-3204372618-1584296459-1002 - Administrator - Enabled) => C:\Users\VeraHagge

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: 电脑管家系统防护 (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5}
AV: PCKeeper Antivirus (Disabled - Out of date) {021CBDD8-61D6-36AB-A5D7-3970E8936E82}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: 电脑管家系统防护 (Enabled - Up to date) {D4FDDE76-901F-01C9-CA01-7F04796B2F48}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

AccountService (Version: 1.1.66 - Kromtech) Hidden <==== ACHTUNG
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{1113B31C-097E-644C-7242-829DFC0CED38}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.4 - CMI Limited) <==== ACHTUNG
AnySend (HKLM-x32\...\ASPackage) (Version:  - CMI Limited) <==== ACHTUNG
Boost (HKLM-x32\...\Boost) (Version: 3.0.1.6 - Boost Shopping)
BrowserV25.07 (HKLM-x32\...\BrowserV25.07) (Version: 1.36.01.22 - BrowserV25.07) <==== ACHTUNG
buyfastt (HKLM-x32\...\{78B72F2B-0468-A7AC-ECEE-02C79EC3EF0B}) (Version:  - ) <==== ACHTUNG
Buzzdock (HKLM-x32\...\{cfd32d46-7d3f-483f-bace-7172aec5592d}) (Version:  - Alactro LLC) <==== ACHTUNG
CPU Miner (HKLM\...\cpuminer) (Version: 1.2 - Open Source)
Crossbrowse (HKLM-x32\...\Crossbrowse) (Version: 39.6.2171.95 - The Crossbrowse Authors) <==== ACHTUNG
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4427.02 - CyberLink Corp.)
DailyPcClean Support (HKLM-x32\...\dpcc_en_002040044_is1) (Version:  - Tuto4PC.Com) <==== ACHTUNG
DailyPCClean v4.1 (HKLM-x32\...\DailyPCClean_is1) (Version: 4.1 - Tuto4PC.Com) <==== ACHTUNG
DesktopSearch (HKLM-x32\...\DesktopSearch) (Version: 3.0.74 - Unique Solutions)
DNS Unlocker version 1.3 (HKLM-x32\...\{E1527582-8509-4011-B922-29E3FB548882}_is1) (Version: 1.3 - www.vidcreek.tv) <==== ACHTUNG
DocToPDFConverter (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\DocToPDFConverter) (Version: 01.00.00.00 - VolatoTech)
EZ Software Updater version 1.2.0.4 (HKLM-x32\...\EZ Software Updater_is1) (Version: 1.2.0.4 - www.ezupdater.com)
FastSearch (HKLM-x32\...\FastSearch) (Version: 3.0.0.8 - FastSearch)
Friendly Error (HKLM-x32\...\FriendlyError) (Version:  - )
GamesDesktop 014.005010057 (HKLM-x32\...\gmsd_de_005010057_is1) (Version:  - GAMESDESKTOP) <==== ACHTUNG
GamesDesktop 014.005010066 (HKLM-x32\...\gmsd_de_005010066_is1) (Version:  - GAMESDESKTOP) <==== ACHTUNG
globalupdate Helper (x32 Version: 1.3.25.0 - globalupdate Inc.) Hidden <==== ACHTUNG
GUPlayer (remove only) (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\GUPlayer) (Version:  - ) <==== ACHTUNG
HD4Good (HKLM-x32\...\HD4Good) (Version: 1.36.01.22 - Buca Apps)
Iminent (HKLM-x32\...\IMBoosterARP) (Version: 7.48.4.1 - Iminent) <==== ACHTUNG
IminentToolbar (HKLM-x32\...\IminentToolbar) (Version: 7.48.4.1 - Iminent) <==== ACHTUNG
InetStat (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\InetStat) (Version: 0.5b - InetStat) <==== ACHTUNG
istartsurf uninstall (HKLM-x32\...\istartsurf uninstall) (Version:  - istartsurf) <==== ACHTUNG
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
LibrarySystem (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{88c3b28}) (Version:  - Software Publisher) <==== ACHTUNG
Lights Cinema 1.3betaV14.07 (HKLM-x32\...\Lights Cinema 1.3betaV14.07) (Version: 1.36.01.22 - Cinema PlusV14.07) <==== ACHTUNG
Media Downloader version 1.5 (HKLM-x32\...\Media Downloader_is1) (Version: 1.5 - Media Downloader)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Mozilla Firefox 27.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0 (x86 en-US)) (Version: 27.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0 - Mozilla)
MyBestOffersToday 014.57 (HKLM-x32\...\rec_de_57_is1) (Version:  - MYBESTOFFERSTODAY) <==== ACHTUNG
MyPC Backup  (HKLM\...\OLBPre) (Version:  - MyPC Backup) <==== ACHTUNG
mystartsearch uninstall (HKLM-x32\...\mystartsearch uninstall) (Version:  - mystartsearch) <==== ACHTUNG
OffersWizard (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\OffersWizard) (Version:  - )
OffersWizard Network System Driver (HKLM-x32\...\inethnfd) (Version: 1.0.0.3001 - ) <==== ACHTUNG
OneSafe PC Cleaner v4 (HKLM-x32\...\OneSafe PC Cleaner_is1) (Version: 4.0 - )
Optimizer Pro v3.2 (HKLM-x32\...\Optimizer Pro_is1) (Version: 3.3.1.7 - PCUtilities Software Limited) <==== ACHTUNG
PCKeeper (HKLM-x32\...\{E44BBEE3-3F83-4670-9E2E-EE0556442287}) (Version: 2.2.1370 - Kromtech) <==== ACHTUNG
PCKeeper (Version: 2.2.1370 - Kromtech) Hidden <==== ACHTUNG
PCKeeper Antivirus (HKLM-x32\...\{E7E7B26A-88AA-48B0-A47C-173C062FD904}) (Version: 1.1.85 - Kromtech) <==== ACHTUNG
PCKeeper Antivirus (Version: 1.1.85 - Kromtech) Hidden <==== ACHTUNG
PCKLang.de (Version: 1.0.0 - Kromtech) Hidden <==== ACHTUNG
PPriiCeLeess (HKLM-x32\...\{75F9BF4A-AF67-A478-A37B-31D73186D3F3}) (Version:  - ) <==== ACHTUNG
PremierOpinion (HKLM-x32\...\{eeb86aef-4a5d-4b75-9d74-f16d438fc286}) (Version: 1.3.337.346 - VoiceFive, Inc.) <==== ACHTUNG
Proxy List  Free Proxies for everyone (HKLM-x32\...\{26453017-2C54-574B-7597-9EA6652686A6}) (Version:  - ) <==== ACHTUNG
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.34.617.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7246 - Realtek Semiconductor Corp.)
RegClean-Pro (HKLM-x32\...\RegClean-Pro_is1) (Version: 6.21 - systweak.com) <==== ACHTUNG
Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.1.9 - Reimage) <==== ACHTUNG
Sale Clipper (HKLM-x32\...\Sale Clipper) (Version: 2.0.5667.8733 - Sale Clipper) <==== ACHTUNG
Search module (HKLM-x32\...\Search module) (Version:  - Goobzo)
Search Protect (HKLM-x32\...\SearchProtect) (Version: 3.0.3.67 - Client Connect LTD) <==== ACHTUNG
SecurityUtility (HKLM-x32\...\SecurityUtility) (Version:  - ) <==== ACHTUNG
Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - )
Shopper-Pro (HKLM-x32\...\ShopperPro) (Version:  - ) <==== ACHTUNG
shopperz22072015 2.0.0.471 (HKLM\...\{318d2d55-9ce3-446e-8640-a43be68a550f}_is1) (Version: 2.0.0.471 - shopperz) <==== ACHTUNG
Shop-wit (HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\shopwit) (Version:  - shopwit) <==== ACHTUNG
SmartWeb (HKLM-x32\...\SmartWeb) (Version: 8.0.9 - SoftBrain Technologies Ltd.) <==== ACHTUNG
Software Version Updater (HKLM-x32\...\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96}) (Version: 1.1.4.2 - ) <==== ACHTUNG
speed browser (HKLM-x32\...\speed browser) (Version: 44.0.2367.0 - Smart Applications) <==== ACHTUNG
Super Optimizer v3.2 (HKLM-x32\...\Super Optimizer_is1) (Version: 3.2.0.1 - Super PC Tools ltd) <==== ACHTUNG
Support PL 1.1 (HKLM-x32\...\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{57e40902}) (Version:  - riceLes) <==== ACHTUNG
Tweet Button for Chrome by Shareaho (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version:  - ) <==== ACHTUNG
WindeskWinsearch 1.0 (HKLM-x32\...\WindeskWinsearch) (Version: 1.0 - PCSoftware) <==== ACHTUNG
WordShark 1.10.0.20 (HKLM-x32\...\WordShark_1.10.0.20) (Version: 1.10.0.20 - WordShark) <==== ACHTUNG
Yahoo Search Set (HKLM-x32\...\Yahoo! SearchSet) (Version:  - Yahoo Inc.)
youtubeadblocker (HKLM-x32\...\{4820778D-AB0D-6D18-C316-52A6A0E1D507}) (Version:  - ) <==== ACHTUNG
爱奇艺影音 (HKLM-x32\...\IQIYI Video) (Version:  - 爱奇艺)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

12-07-2015 13:31:33 Uniblue PC Mechanic installation
16-07-2015 23:59:30 Windows Update
17-07-2015 08:03:58 Wiederherstellungsvorgang
20-07-2015 14:57:27 Smileys We Love Toolbar for IE wird entfernt
23-07-2015 07:42:43 WinZip Driver Updater (23/07/2015 07:42)
26-07-2015 10:28:36 windows 8
26-07-2015 16:16:15 Windows Modules Installer
21-08-2015 15:09:25 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {023008A5-CEE0-4D4E-8B0A-D064DB82BDE1} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro 3.99\OptProLauncher.exe [2015-07-23] () <==== ACHTUNG
Task: {090697A2-DD60-4F36-8DE1-66FCB81B5D3F} - System32\Tasks\Winsta Update => C:\Users\VeraHagge\AppData\Roaming\Winsta\Winsta.exe [2015-01-29] ()
Task: {0BA5144B-6C4D-43EA-A2BB-6A4FE3A1A184} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe [2015-07-12] (Buca Apps) <==== ACHTUNG
Task: {10FC111E-2E33-4D4A-9E8D-82E701D6779E} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe [2015-07-12] (Buca Apps) <==== ACHTUNG
Task: {147AF33D-35E7-4F97-B141-469BF6AC8A19} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.exe [2015-07-12] (Buca Apps) <==== ACHTUNG
Task: {15C0F3B4-CFA5-473C-8874-11BE75CA1419} - System32\Tasks\Oikliuhoad => C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe [2015-07-26] ()
Task: {1C14D75C-A75F-4E44-8DD7-879DEF90D2F3} - System32\Tasks\ShopperPro => C:\Program Files (x86)\ShopperPro\ShopperPro.exe [2015-08-20] (Goobzo LTD) <==== ACHTUNG
Task: {2059AF37-3684-475F-83F9-3C8A3F794D2E} - System32\Tasks\SPDriver => C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe [2015-07-26] () <==== ACHTUNG
Task: {28B85FDA-77F3-4D8F-B57E-4C4DBF95EC53} - System32\Tasks\SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 <==== ACHTUNG
Task: {2CEE3A3E-B0F0-4C04-BC32-A83662A853E2} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG
Task: {336375A5-4B53-4956-B147-CCF175DBF4E7} - System32\Tasks\AmiUpdXp => C:\Users\VeraHagge\AppData\Local\29908\Updater.exe [2015-07-12] () <==== ACHTUNG
Task: {38307FF6-E63E-4462-9ADB-866679486EF8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-08-21] (Microsoft Corporation)
Task: {392F15F1-6932-405D-9C62-8A4BC38C5345} - System32\Tasks\OneSafe PC Cleaner Schedule => C:\Program Files (x86)\OneSafe PC Cleaner\OSPCSchedule.exe [2015-07-24] (Avanquest Software)
Task: {3D0E5EA7-9953-43BD-ABD8-6F9FDBD1CB65} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG
Task: {44D3F9C0-D248-4295-B8FA-30E5618ED0B7} - System32\Tasks\Superclean => c:\programdata\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}\hqghumeaylnlf.exe [2014-07-12] (Super PC Tools Ltd) <==== ACHTUNG
Task: {460D18FD-BF7E-44E9-BBD2-DEE7134E2A75} - System32\Tasks\Crossbrowse => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ACHTUNG
Task: {472FE64C-FBD4-4F11-B550-EFBF7C0907A1} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG
Task: {47EB4A3A-920A-41A6-8563-18477A65BB97} - System32\Tasks\Optscan => c:\programdata\{9067e982-1f12-20b7-9067-7e9821f1a608}\hqghumeaylnlf.exe [2014-08-21] (PC Utilities Software Limited) <==== ACHTUNG
Task: {4A038234-004A-4A05-9F3E-2AA83093DF67} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-08-21] (AnyProtect.com) <==== ACHTUNG
Task: {501C1A81-04D2-40CD-9DCF-2175E0952EF9} - System32\Tasks\Convertor => C:\Users\VeraHagge\AppData\Roaming\Convertor\Convertor.exe [2015-01-29] ()
Task: {5435653C-33AB-4EC3-B013-5153B0866C10} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-6.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG
Task: {55957403-B8E3-4BCD-A77D-6A23D3FF521C} - System32\Tasks\LVKAHSH1 => C:\ProgramData\SecurityUtility\SecurityUtility.exe [2015-05-26] (SecurityUtility) <==== ACHTUNG
Task: {55B34A96-F696-4894-B046-5C00C63FDD06} - System32\Tasks\DNSPALENVILLE PostInstall => dnspalenville.exe
Task: {58C8A81C-81E6-4401-B3A6-28470C72D99F} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-21] (Adobe Systems Incorporated)
Task: {5947C620-3C56-4A6D-BC84-76959B9BCC2C} - System32\Tasks\PCKeeper-Aktualisierungsprogramm => C:\ProgramData\Kromtech\installer.exe <==== ACHTUNG
Task: {642CB0E0-FE7E-4295-8A7B-6E37E9CF8F6B} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2015-05-19] (Reimage®) <==== ACHTUNG
Task: {648C86F9-48EA-4868-AEAB-7A289E6D789B} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG
Task: {654A74CB-F098-4E45-8B15-30767C639BC1} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Pending Update => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe <==== ACHTUNG
Task: {66A8DBC8-F7AE-430B-8E4B-8D21A6FDB52F} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [2015-07-26] (globalUpdate) <==== ACHTUNG
Task: {6B4B9EF0-07F8-4990-B2BA-75D0BCAA7DF3} - System32\Tasks\WinZipDriverUpdater_UPDATES => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe
Task: {6D2AB3F8-C3CD-4A08-B6EC-2E16A6236E0B} - System32\Tasks\Papuir => C:\Program Files\shopperz22072015\Asyofakaz.bat [2015-07-22] () <==== ACHTUNG
Task: {6D68BC42-698E-4D67-A1FE-3FAE10042ECB} - System32\Tasks\WheelsMaster => c:\programdata\{ef8baf33-367f-614b-ef8b-baf33367bccc}\5951259966257080345e.exe [2014-07-31] () <==== ACHTUNG
Task: {703ECDFE-6066-4290-BADF-B8F896DAD91C} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe [2015-07-12] (Buca Apps) <==== ACHTUNG
Task: {71DA6959-D9A4-42BB-85AB-D763441706BD} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-7.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG
Task: {747F57D3-AA28-4733-8987-90EF1B02ACA8} - System32\Tasks\SMWUpd => C:\Program Files\Common Files\Goobzo\GBUpdate\updater.exe [2015-07-26] (Goobzo) <==== ACHTUNG
Task: {789F433C-C81C-48AC-AAF7-01A9C68020D3} - System32\Tasks\LaunchPreSignup => C:\Program Files (x86)\OLBPre\OLBPre.exe [2015-07-23] () <==== ACHTUNG
Task: {85FDE24F-97A9-401D-83ED-1F2E19031A6B} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe [2015-07-26] (globalUpdate) <==== ACHTUNG
Task: {9089A441-7567-40E1-BEDB-7C38411E3062} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG
Task: {9454C744-54FC-4409-AF8C-14C0BA0F17CE} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-5 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG
Task: {9725831F-0D22-460F-918C-136C9D96C495} - System32\Tasks\ShopperProJSUpd => C:\Program Files (x86)\ShopperPro\updater.exe [2015-08-20] (Goobzo) <==== ACHTUNG
Task: {9CC35DDB-1A35-45A0-B423-C29C7359C2D3} - System32\Tasks\SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34 => Wscript.exe //B "C:\ProgramData\SearchModule\smhe.js" smu.exe /invoke /f:check_services /l:0 <==== ACHTUNG
Task: {A2067C6F-5725-4BF3-A42C-BF9334D54568} - System32\Tasks\Reimage Reminder => C:\Program Files\Reimage\Reimage Repair\ReimageReminder.exe [2015-07-12] (Reimage ltd.) <==== ACHTUNG
Task: {A2CAB576-0E92-4F10-9F10-5998A157C3F8} - System32\Tasks\DriverMgr => C:\Users\VeraHagge\AppData\Roaming\iuv0j\rinti.exe [2015-08-05] ()
Task: {AA33371F-9415-4DD0-8A72-759376E7506F} - System32\Tasks\keepup => C:\Users\VeraHagge\AppData\Roaming\iuv0j\rinti.exe [2015-08-05] ()
Task: {B4F89F73-7808-4AB3-A53E-8B66164A980D} - System32\Tasks\Shop-wit Updater => Wscript.exe //B "C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\..\updt.js" <==== ACHTUNG
Task: {B6EC764F-CCD8-4C59-A0FA-7A5AC1A8832F} - System32\Tasks\WordShark Auto Updater 1.10.0.20 Core => C:\Program Files (x86)\WordShark_1.10.0.20\Update\WordSharkAutoUpdateClient.exe <==== ACHTUNG
Task: {BAF7F5A8-C3E4-45B0-963D-813B179D1494} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.exe [2015-07-12] (Buca Apps) <==== ACHTUNG
Task: {BDF0898D-DC41-4E5B-A416-1237C435F3E8} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG
Task: {C753085F-E567-4BF2-86A3-695D873DE2C5} - System32\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5 => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe [2015-07-26] (BrowserV25.07) <==== ACHTUNG
Task: {C876BA3C-170A-46BF-B63F-3E954378227B} - System32\Tasks\Super Optimizer Schedule => C:\Program Files (x86)\Super Optimizer\SupOptLauncher.exe [2015-07-31] () <==== ACHTUNG
Task: {CA32D1AC-0C7B-49D8-B96C-27B4C165D77E} - System32\Tasks\WinKit => C:\Users\VeraHagge\AppData\Roaming\NewNotepad\GUP.exe [2015-08-05] (Don HO don.h@free.fr)
Task: {CB337DD0-9AB2-4A32-90DE-E3CCCBC83029} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {CDB98180-20BE-48C5-AEED-0AC3A0F61AB3} - System32\Tasks\IntelliText => c:\programdata\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}\priceless_p_soft_partner.exe [2014-07-26] () <==== ACHTUNG
Task: {CF94A10F-B565-4070-A486-1DCD4EC4F500} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-7.exe <==== ACHTUNG
Task: {D487C202-2A15-4BE6-B82C-BC371E9DEAF8} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RCP\RegCleanPro.exe [2015-07-02] () <==== ACHTUNG
Task: {D54D0452-6F9A-4AAA-80E1-095F0BC2A5E0} - System32\Tasks\ASP => C:\Program Files (x86)\RCP\systweakasp.exe [2015-02-19] (Systweak Inc                                                )
Task: {E0A268FA-64D1-46A0-BEB5-D2FCCB60BDE1} - System32\Tasks\c233af57-2b16-455f-9052-a826317e171a-4 => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-4.exe [2015-07-26] (Cinema PlusV14.07) <==== ACHTUNG
Task: {E2ADF0E0-E18A-4029-87BB-8C6B0779CD2F} - System32\Tasks\uBr => C:\ProgramData\Convertor\Convertor.exe [2015-08-05] (Don HO don.h@free.fr) <==== ACHTUNG
Task: {F9B2ED92-1F2D-44B1-A7B3-0426D51745AB} - System32\Tasks\DailyPCClean Schedule => C:\Program Files (x86)\DailyPCClean\DPCCSchedule.exe [2015-05-19] (Tuto4PC)
Task: {FD1A5C7A-82A3-4E2A-9B1F-0C989C28D188} - System32\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7 => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.exe [2015-07-12] (Buca Apps) <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-6.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-6.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-1-7.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-1-7.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\3684a602-0673-47a5-9b45-32a46950946c-5_user.job => C:\Program Files (x86)\BrowserV25.07\3684a602-0673-47a5-9b45-32a46950946c-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-11.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-4.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user.job => C:\Program Files (x86)\HD4Good\39b4727c-96f0-45a6-8f25-0adaab9ae46a-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\AmiUpdXp.job => C:\Users\VeraHagge\AppData\Local\29908\Updater.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-6.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-6.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-1-7.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-1-7.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-10_user.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-10.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-4.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-4.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\c233af57-2b16-455f-9052-a826317e171a-5_user.job => C:\Program Files (x86)\Lights Cinema 1.3betaV14.07\c233af57-2b16-455f-9052-a826317e171a-5.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Crossbrowse.job => C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\IntelliText.job => c:\programdata\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}\priceless_p_soft_partner.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\LVKAHSH1.job => C:\ProgramData\SecurityUtility\SecurityUtility.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Optscan.job => c:\programdata\{9067e982-1f12-20b7-9067-7e9821f1a608}\hqghumeaylnlf.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\Superclean.job => c:\programdata\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}\hqghumeaylnlf.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\WheelsMaster.job => c:\programdata\{ef8baf33-367f-614b-ef8b-baf33367bccc}\5951259966257080345e.exe <==== ACHTUNG
Task: C:\WINDOWS\Tasks\WinZipDriverUpdater_UPDATES.job => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-07-26 11:03 - 2015-07-22 16:26 - 01448824 _____ () C:\Program Files\shopperz22072015\csrcc.exe
2015-07-26 11:03 - 2015-07-22 16:26 - 00285560 _____ () C:\Program Files\shopperz22072015\Jmahzov.exe
2015-07-29 13:09 - 2015-02-17 17:02 - 00221696 _____ () C:\Program Files (x86)\EZ Software Updater\EZ Software Updater.exe
2015-07-30 04:10 - 2015-07-30 04:10 - 00350720 _____ () C:\WINDOWS\SysWOW64\nethtsrv.exe
2015-07-17 17:30 - 2015-07-17 17:30 - 00090328 _____ () C:\Program Files\Kromtech\PCKAV\SharedNativeLibraryPS.dll
2015-07-30 04:10 - 2015-07-30 04:10 - 00190976 _____ () C:\WINDOWS\SysWOW64\netupdsrv.exe
2015-07-26 11:03 - 2015-07-22 16:26 - 00174968 _____ () C:\Program Files\shopperz22072015\Jvpmajlij.exe
2015-07-26 11:03 - 2015-07-22 16:27 - 00297848 _____ () C:\Program Files\shopperz22072015\Xpnsbedno64.DLL
2015-07-26 11:03 - 2015-07-22 16:26 - 00434040 _____ () C:\Program Files\shopperz22072015\Huyde.exe
2015-07-26 11:03 - 2015-07-22 16:26 - 00464760 _____ () C:\Program Files\shopperz22072015\Huyde64.exe
2015-07-26 11:03 - 2015-07-22 16:27 - 00631160 _____ () C:\Program Files\shopperz22072015\Dhnayvhf64.DLL
2015-07-26 11:03 - 2015-07-22 16:27 - 00277880 _____ () C:\Program Files\shopperz22072015\Keeqcb64.DLL
2015-07-26 11:03 - 2015-07-22 16:27 - 00337272 _____ () C:\Program Files\shopperz22072015\Xeelfeze64.DLL
2015-08-10 20:38 - 2015-08-10 12:04 - 03346064 _____ () C:\Users\VeraHagge\AppData\Local\gmsd_de_005010057\upgmsd_de_005010057.exe
2015-08-10 19:46 - 2015-08-10 19:46 - 00982016 _____ () C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe
2015-05-25 17:29 - 2015-05-25 17:29 - 00104752 _____ () C:\Program Files\Kromtech\PCKeeper\ZBAnalyticsCore.dll
2015-05-25 15:00 - 2015-05-25 15:00 - 04901376 _____ () C:\Program Files\Kromtech\PCKeeper\de\ImageResources.de.dll
2015-05-25 17:29 - 2015-05-25 17:29 - 00060720 _____ () C:\Program Files\Kromtech\PCKeeper\ZBAnalytics.dll
2015-07-27 01:23 - 2015-07-26 07:12 - 03225088 _____ () C:\Program Files (x86)\ShopperPro\JSDriver\1.42.1.2188\jsdrv.exe
2015-07-28 12:13 - 2015-07-28 12:13 - 00840206 _____ () C:\Users\VeraHagge\AppData\Roaming\InetStat\inetstat.exe
2015-07-30 11:12 - 2015-07-30 11:12 - 00656128 _____ () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopwit.exe
2015-07-29 12:59 - 2015-07-27 17:16 - 03979408 _____ () C:\Program Files (x86)\rec_de_57\rec_de_57.exe
2015-08-10 20:38 - 2015-08-10 12:03 - 03984016 _____ () C:\Program Files (x86)\gmsd_de_005010057\gmsd_de_005010057.exe
2014-08-12 11:06 - 2014-08-12 11:06 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2015-07-26 07:09 - 2015-07-26 07:09 - 01684480 _____ () C:\Program Files\Common Files\ShopperPro\spbici64.dll
2015-08-21 15:31 - 2015-08-21 15:31 - 04717435 _____ () C:\Users\VeraHagge\AppData\Local\Temp\ShopperProJSINJFull.exe
2015-07-26 10:52 - 2015-07-23 17:59 - 03645584 _____ () C:\Program Files (x86)\Optimizer Pro 3.99\OptimizerPro.exe
2015-07-30 11:12 - 2015-07-30 11:12 - 00452352 _____ () C:\Program Files (x86)\shopwit\shopwit\1.3.26.16\shopup.exe
2015-08-21 16:10 - 2015-08-12 00:00 - 00077824 ____H () C:\Program Files (x86)\baidu\pps.exe
2015-08-21 16:10 - 2015-08-11 23:58 - 00036864 ____H () C:\Program Files (x86)\baidu\Bind.exe
2015-08-21 16:20 - 2015-08-20 15:04 - 03978384 _____ () C:\Program Files (x86)\gmsd_de_005010066\gmsd_de_005010066.exe
2015-08-21 15:48 - 2015-08-21 16:27 - 04613520 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nseBB78.tmp\setup.exe
2015-08-21 16:39 - 2015-08-21 16:39 - 01455072 _____ () C:\ProgramData\rKRjrFKiDD\dat\vgKjuCRO.dll
2015-08-10 20:07 - 2015-08-05 17:23 - 00221312 _____ () C:\Users\VeraHagge\AppData\Roaming\pdfie\PdfConv_64.dll
2015-07-26 10:57 - 2015-07-26 10:57 - 00158720 _____ () C:\ProgramData\Oikliuhoad\1.0.4.1\esmricar.exe
2015-07-31 13:27 - 2015-07-31 13:28 - 02239488 _____ () c:\Program Files (x86)\LibrarySystem\LibrarySystem.dll
2015-07-26 10:54 - 2015-07-26 10:54 - 03196928 _____ () c:\Program Files (x86)\wincheck\wincheck.dll
2015-07-26 10:53 - 2015-07-26 10:53 - 02570896 _____ () c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll
2015-07-26 11:03 - 2015-07-22 16:27 - 00291704 _____ () C:\Program Files\shopperz22072015\Xpnsbedno.DLL
2015-07-26 11:03 - 2015-07-22 16:27 - 00620408 _____ () C:\Program Files\shopperz22072015\Dhnayvhf.DLL
2015-07-26 11:03 - 2015-07-22 16:27 - 00243576 _____ () C:\Program Files\shopperz22072015\Keeqcb.DLL
2015-07-26 11:03 - 2015-07-22 16:27 - 00312184 _____ () C:\Program Files\shopperz22072015\Xeelfeze.DLL
2015-08-21 16:30 - 2015-08-21 16:30 - 00004608 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\nsProcess.dll
2015-08-21 16:30 - 2015-08-21 16:30 - 00251904 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\AccDownload.dll
2015-08-21 16:32 - 2015-08-21 16:32 - 00011264 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\System.dll
2015-08-21 16:32 - 2015-08-21 16:32 - 00006656 _____ () C:\Users\VeraHagge\AppData\Local\Temp\nsuA82C.tmp\nsExec.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\zlib.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libexpatw.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\tinyxml.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00481632 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\sqlite.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00063840 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\qmiemalrtpplugin\qmiemalrtpplugin.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00051552 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\sysspeeduprtpplugin\SysSpeedupRtpPlugin.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00018784 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\oDayProtect.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00203104 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQFileFlt.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00194912 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\xImage.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00342040 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\arkGraphic.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00092184 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\xGraphic32.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libpng.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\libjpegturbo.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00045920 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\jgImage.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\jgIOStub.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00076128 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\MemDefrag.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00502168 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMLoader\QQPCDetector.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00268640 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\StartupMgr\SoftMon.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00092184 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\xGraphic32.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00088416 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\zlib.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00137568 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libexpatw.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00100704 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\tinyxml.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00342040 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\arkGraphic.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00045920 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\jgImage.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00014176 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\jgIOStub.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00158048 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libpng.dll
2015-08-21 16:51 - 2015-08-21 16:51 - 00285024 _____ () C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\libjpegturbo.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)

IE trusted site: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\...\webcompanion.com -> hxxp://webcompanion.com


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\Theme2\img12.jpg
HKU\S-1-5-21-3742509177-3204372618-1584296459-500\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\Windows\img0.jpg
DNS Servers: 52.18.92.32 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{746F8BB3-5428-4343-8158-8FABAAF16679}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD Cinema\PowerDVDCinema10.exe
FirewallRules: [{C0FB77C1-5EC8-43F6-89C9-6B7BED00A8E0}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD10\PowerDVD10.EXE
FirewallRules: [{6515E186-6D47-4B6C-AFB3-709B4935D9C6}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{45C19567-A39A-422B-9938-A30E7A78EF2C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{B71E6EDA-A6E3-4C91-B70D-0E2C2A9D96B8}] => (Allow) C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe
FirewallRules: [{D5F4F611-7EF7-417C-88E4-B8F58CAF022F}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe
FirewallRules: [{1A0CA108-B1B1-4DC6-AC59-6CCF2DC8AD25}] => (Allow) C:\Program Files (x86)\PremierOpinion\pmropn.exe
FirewallRules: [{EBCE7656-28C8-4146-A6DA-ADFD3A5214AB}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
FirewallRules: [{7B392023-D9E8-49AD-8E32-C291BF2D1644}] => (Allow) C:\Program Files (x86)\speed browser\Application\browser.exe
FirewallRules: [{3E487AB0-39D3-421C-9F31-EB56EA8B3CEC}] => (Allow) C:\IQIYI Video\LStyle\QyClient.exe
FirewallRules: [{54749A6D-F2DB-4FF3-B624-C27D6F8A1637}] => (Allow) C:\IQIYI Video\Common\QyKernel.exe
FirewallRules: [{1E377C14-C008-4AED-8841-9593EC742956}] => (Allow) C:\IQIYI Video\LStyle\QyPlayer.exe
FirewallRules: [{AFF403EC-49D4-4B53-9BFA-211D5F0E56F8}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCmgrInstallGuide.exe
FirewallRules: [{3BCB4B94-C2F4-4D0B-900D-51305B02D2A2}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCTray.exe
FirewallRules: [{EC220F28-4C86-4F2A-AE3B-F5D636581BA7}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCMgr.exe
FirewallRules: [{A0B2E722-81FA-4A3D-98EE-4AED8E67627A}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCRTP.exe
FirewallRules: [{2DC3DE63-37D2-4004-ACAF-5CA1D058CB34}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMDL.exe
FirewallRules: [{F4E6F4E3-7F6E-4731-82AC-2C5066934DAA}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\bugreport.exe
FirewallRules: [{5DDE6DBD-938F-4120-99DA-B18931133A1C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCFileOpen.exe
FirewallRules: [{3F0A16D0-825C-405E-BF82-1045EA443DFD}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCLeakScan.exe
FirewallRules: [{1CC214C1-0F1B-4C7E-85C3-8A268988B4E0}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPConfig.exe
FirewallRules: [{038BFC67-E288-4E41-A406-5E621EA7F593}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSoftMgr.exe
FirewallRules: [{17CCEE76-DE33-461E-AE79-4F8F44D4F854}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{2BAB52DA-A9E2-4C62-80BE-19CA3D40F393}] => (Allow) C:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{7B6BB968-2C91-4018-8A08-A18AB91DB67D}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{FF6405A1-CD50-4357-A065-0C1EE2097607}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCBTU.exe
FirewallRules: [{452A7506-E3EE-40B6-B0A6-6001E1E34223}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCClinic.exe
FirewallRules: [{6A2FC18B-9B1D-482A-B1F4-0C63E0FA14EA}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCLaunch.exe
FirewallRules: [{6D9642CF-FDF7-41F3-8D85-158A44CD63B1}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{9BDCC5E8-3476-4931-AB57-807B59A5753E}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSoftGame.exe
FirewallRules: [{94EA5551-7A1C-4117-BB54-DA1F5D29B31C}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCSysOptimize.exe
FirewallRules: [{59677356-AA59-4350-B8E4-802BE5E406E2}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCUpdateAVLib.exe
FirewallRules: [{CE73CF55-FF24-4E9D-B0CD-4F5CE8DA25E7}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQRepair.exe
FirewallRules: [{1B4377B5-6AA3-4D29-8F46-E851AABC08F6}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\Uninst.exe
FirewallRules: [{7728906C-EF26-45A5-9BDA-05F291853C80}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QQPCPatch.exe
FirewallRules: [{A644DE9C-392E-4601-9B20-C3445CB45EBC}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\TpkUpdate.exe
FirewallRules: [{F2E0ABB8-737D-433D-9CAF-BDB96EC52725}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMRouterMgr.exe
FirewallRules: [{C04D1627-2A94-46E4-8789-6996230059E3}] => (Allow) C:\Program Files (x86)\Tencent\QQPCMgr\10.7.16065.215\QMAccountProtection.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/21/2015 04:53:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7487ca20
ID des fehlerhaften Prozesses: 0x2434
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:53:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x00954fa0
ID des fehlerhaften Prozesses: 0x2434
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:53:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7487ca20
ID des fehlerhaften Prozesses: 0x2704
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:53:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x00a94fa0
ID des fehlerhaften Prozesses: 0x2704
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:53:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7487ca20
ID des fehlerhaften Prozesses: 0x25d4
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:53:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x020d4fa0
ID des fehlerhaften Prozesses: 0x25d4
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:52:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7487ca20
ID des fehlerhaften Prozesses: 0xde4
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:52:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x02124fa0
ID des fehlerhaften Prozesses: 0xde4
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:52:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x7487ca20
ID des fehlerhaften Prozesses: 0x25a8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5

Error: (08/21/2015 04:52:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe, Version: 18.0.0.232, Zeitstempel: 0x55c42e20
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc00001a5
Fehleroffset: 0x00a94fa0
ID des fehlerhaften Prozesses: 0x25a8
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_18_0_0_232.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_18_0_0_232.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_18_0_0_232.exe2
Berichtskennung: FlashPlayerPlugin_18_0_0_232.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_18_0_0_232.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_18_0_0_232.exe5


Systemfehler:
=============
Error: (08/21/2015 04:55:08 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "Rsd Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/21/2015 04:52:59 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "QQPCMgr RTP Service" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (08/21/2015 04:38:29 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "JwTtFpw" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/21/2015 03:19:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Internet Explorer Flash Player unter Windows 8.1 für x64-basierte Systeme (KB3089023)

Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 3.5 unter Windows 8.1 und Windows Server 2012 R2 für x64-basierte Systeme (KB3072307)

Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3070071)

Error: (08/21/2015 03:17:12 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007045b fehlgeschlagen: Update für Windows 8.1 für x64-Systeme (KB3075853)

Error: (08/21/2015 02:13:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "AppEx Networks Accelerator LWF" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (08/21/2015 02:13:25 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎21.‎08.‎2015 um 13:58:29 unerwartet heruntergefahren.


Microsoft Office:
=========================
Error: (08/21/2015 04:53:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20243401d0dc21248e9840C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown6468749d-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:53:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500954fa0243401d0dc21248e9840C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown6285a95d-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:53:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20270401d0dc211c4f4f89C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown5db98f9d-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:53:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500a94fa0270401d0dc211c4f4f89C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown5a72eefa-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:53:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca2025d401d0dc2115900188C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown567d223d-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:53:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a5020d4fa025d401d0dc2115900188C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown53ba57c1-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:52:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca20de401d0dc21086e2bb7C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown48c17d31-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:52:42 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a502124fa0de401d0dc21086e2bb7C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown4641d652-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:52:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00000057487ca2025a801d0dc20fefb559eC:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown4188b952-4814-11e5-826b-74d4357a72a2

Error: (08/21/2015 04:52:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_18_0_0_232.exe18.0.0.23255c42e20unknown0.0.0.000000000c00001a500a94fa025a801d0dc20fefb559eC:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_232.exeunknown3d55e383-4814-11e5-826b-74d4357a72a2


CodeIntegrity:
===================================
  Date: 2015-07-27 01:19:03.992
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-27 01:19:03.883
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-27 01:18:43.539
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-27 01:18:43.414
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-27 01:17:17.195
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-27 01:17:17.007
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\BubbleSound\BubbleSound.dll because the set of per-page image hashes could not be found on the system.

  Date: 2015-07-23 07:34:17.784
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-23 07:34:17.518
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-12 13:31:23.675
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2015-07-12 13:31:23.409
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\LavasoftTcpService64.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Speicherinformationen ===========================

Processor: AMD A4-4020 APU with Radeon(tm) HD Graphics
Prozentuale Nutzung des RAM: 71%
Installierter physikalischer RAM: 3271.44 MB
Verfügbarer physikalischer RAM: 926.19 MB
Summe virtueller Speicher: 5607.32 MB
Verfügbarer virtueller Speicher: 2037.11 MB

==================== Laufwerke ================================

Drive c: (Windows) (Fixed) (Total:916.15 GB) (Free:876.33 GB) NTFS
Drive d: (CD_ROM) (CDROM) (Total:0.15 GB) (Free:0 GB) CDFS
Drive f: (HITMANPRO) (Removable) (Total:1.86 GB) (Free:1.73 GB) FAT32

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: E6631533)

Partition: GPT.

==================== Ende von Ergebnis ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-21 20:11:01
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000025 ST31000524AS rev.JC4B 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\VERAHA~1\AppData\Local\Temp\kfrirpow.sys


---- Kernel code sections - GMER 2.1 ----

.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable                                                                                                                                                                                      fffff9600016bd00 15 bytes [00, E4, F2, 01, 80, 8C, 6C, ...]
.text    C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16                                                                                                                                                                                  fffff9600016bd10 11 bytes [00, 72, FC, FF, 00, 09, CB, ...]

---- User code sections - GMER 2.1 ----

.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!DllInstall + 4                                                                                                                                    0000000070af5144 16 bytes [83, EC, 4C, 8B, 45, 0C, 8B, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!DllInstall + 24                                                                                                                                  0000000070af5158 6 bytes [89, 45, F8, C7, 45, E4]
.text    ...                                                                                                                                                                                                                                  * 15
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!__apicall + 42                                                                                                                                    0000000070af533a 10 bytes [45, D4, 32, BF, D7, 75, 8B, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!__apicall + 56                                                                                                                                    0000000070af5348 16 bytes {JMP 0x75d7bf36}
.text    ...                                                                                                                                                                                                                                  * 8
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_init + 38                                                                                                                                        0000000070af5516 73 bytes [89, 45, F0, C7, 45, D4, CB, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_init + 112                                                                                                                                      0000000070af5560 3 bytes [00, 00, 00]
.text    ...                                                                                                                                                                                                                                  * 10
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_uninstall + 32                                                                                                                                  0000000070af56f0 2 bytes [DC, A1]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!_uninstall + 38                                                                                                                                  0000000070af56f6 44 bytes [89, 45, F0, C7, 45, D4, B8, ...]
.text    ...                                                                                                                                                                                                                                  * 13
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!serv + 22                                                                                                                                        0000000070af58c6 12 bytes {CALL 0xffffffff89e44d8f}
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2156] c:\Program Files (x86)\wincheck\wincheck.dll!serv + 38                                                                                                                                        0000000070af58d6 1 byte [89]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!DllInstall + 24                                                                                                                        00000000700b7218 23 bytes [89, 45, F8, C7, 45, E4, E1, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!DllInstall + 51                                                                                                                        00000000700b7233 83 bytes {JG 0x21; JMP 0xb}
.text    ...                                                                                                                                                                                                                                  * 9
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__apicall + 22                                                                                                                        00000000700b73e6 12 bytes {CALL 0xffffffff89e44d8f}
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__apicall + 38                                                                                                                        00000000700b73f6 52 bytes [89, 45, F0, C7, 45, D4, 32, ...]
.text    ...                                                                                                                                                                                                                                  * 16
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__install + 31                                                                                                                        00000000700b75cf 26 bytes [89, 45, F4, C7, 45, DC, 94, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__install + 61                                                                                                                        00000000700b75ed 74 bytes {SBB EAX, [RAX]; ADD [RAX], AL; JMP 0x9}
.text    ...                                                                                                                                                                                                                                  * 13
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__uninstall + 6                                                                                                                        00000000700b7796 17 bytes [EC, 50, 8B, 45, 10, 8B, 4D, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!__uninstall + 31                                                                                                                      00000000700b77af 14 bytes [89, 45, F4, C7, 45, DC, C1, ...]
.text    ...                                                                                                                                                                                                                                  * 16
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_init + 38                                                                                                                            00000000700b7996 72 bytes [89, 45, F0, C7, 45, D4, 87, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_init + 111                                                                                                                            00000000700b79df 25 bytes {SBB EAX, [RAX]; ADD [RAX], AL; JMP 0x9}
.text    ...                                                                                                                                                                                                                                  * 7
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_uninstall + 16                                                                                                                        00000000700b7b60 18 bytes [55, 0C, 8B, 75, 08, 89, 45, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!_uninstall + 38                                                                                                                        00000000700b7b76 50 bytes [89, 45, F0, C7, 45, D4, 63, ...]
.text    ...                                                                                                                                                                                                                                  * 11
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!ENT + 38                                                                                                                              00000000700b7d56 71 bytes [89, 45, F0, C7, 45, D4, 32, ...]
.text    C:\WINDOWS\SysWOW64\rundll32.exe[2344] c:\Program Files (x86)\Optimizer Pro 3.99\OptProMon.dll!ENT + 110                                                                                                                              00000000700b7d9e 31 bytes {POP QWORD [RDI+0x0]; ADD [RAX], AL; JMP 0xa}
.text    C:\WINDOWS\system32\dashost.exe[2588] C:\WINDOWS\system32\KERNEL32.DLL!SetFileCompletionNotificationModes                                                                                                                            00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]}
.text    C:\Program Files\shopperz22072015\Huyde64.exe[4632] C:\WINDOWS\system32\KERNEL32.DLL!SetFileCompletionNotificationModes                                                                                                              00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]}
.text    C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[7640] C:\WINDOWS\system32\KERNEL32.dll!SetFileCompletionNotificationModes                                                                                        00007ffd4a07fc50 14 bytes {JMP QWORD [RIP+0x0]}

---- Threads - GMER 2.1 ----

Thread  C:\WINDOWS\system32\csrss.exe [568:592]                                                                                                                                                                                              fffff960008b02d0
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [1792:2196]                                                                                                                                                                                          000000007ed3fdc0
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [1792:5772]                                                                                                                                                                                          000000007eeb8bd0
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [2156:2400]                                                                                                                                                                                          000000007f490110
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [2156:4776]                                                                                                                                                                                          000000007f3aa670
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [2344:2856]                                                                                                                                                                                          000000007ee0c700
Thread  C:\WINDOWS\SysWOW64\rundll32.exe [2344:1188]                                                                                                                                                                                          000000007ed000a0
Thread  C:\WINDOWS\system32\svchost.exe [2992:2220]                                                                                                                                                                                          00007ffd3cda1120
Thread  C:\WINDOWS\system32\svchost.exe [2992:2212]                                                                                                                                                                                          00007ffd3c193460
Thread  C:\WINDOWS\system32\taskhost.exe [2408:812]                                                                                                                                                                                          00007ffd2ea3def0
Thread  C:\WINDOWS\system32\taskhost.exe [5032:1588]                                                                                                                                                                                          00007ffd2d87b360
Thread  C:\WINDOWS\system32\taskhost.exe [5032:4988]                                                                                                                                                                                          00007ffd36ca7470
Thread  C:\WINDOWS\system32\taskhost.exe [5032:2136]                                                                                                                                                                                          00007ffd36ca7470
Thread  C:\WINDOWS\system32\taskhost.exe [5032:4384]                                                                                                                                                                                          00007ffd36ca7470
Thread  C:\WINDOWS\Explorer.EXE [3696:7092]                                                                                                                                                                                                  00007ffd26d6e630
Thread  C:\WINDOWS\Explorer.EXE [3696:6920]                                                                                                                                                                                                  00007ffd26d6e630
Thread  C:\WINDOWS\Explorer.EXE [3696:6812]                                                                                                                                                                                                  00007ffd26d6e630
Thread  C:\WINDOWS\Explorer.EXE [3696:6232]                                                                                                                                                                                                  00007ffd26d69970
---- Processes - GMER 2.1 ----

Process  C:\ProgramData\SecurityUtility\SecurityUtility.exe (*** suspicious ***) @ C:\ProgramData\SecurityUtility\SecurityUtility.exe [3500] (Install/SecurityUtility)(2015-07-28 10:14:30)                                                    00007ff652990000
Process  C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe (*** suspicious ***) @ C:\Users\VeraHagge\AppData\Local\{A91A2797-04B8-45E1-B9A7-7CED9DF565FA}\OffersWizard.exe [7084](2015-08-10 17:46:37)  0000000000d00000

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                                                                                                                                                                unknown MBR code

---- EOF - GMER 2.1 ----

schrauber 23.08.2015 05:53
Du bist offiziell der TB-Adware-König :)

Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    AccountService

    AnyProtect

    AnySend

    BrowserV25.07

    buyfastt

    Buzzdock

    Crossbrowse

    DailyPcClean Support

    DailyPCClean v4.1

    DNS Unlocker version 1.3

    GamesDesktop 014.005010057

    GamesDesktop 014.005010066

    globalupdate Helper

    GUPlayer

    Iminent

    IminentToolbar

    InetStat

    istartsurf uninstall

    LibrarySystem

    Lights Cinema 1.3betaV14.07

    MyBestOffersToday 014.57

    MyPC Backup

    mystartsearch uninstall

    OffersWizard Network System Driver (HKLM-x32\...\inethnfd) (Version: 1.0.0.3001 - ) <==== ACHTUNG

    Optimizer Pro v3.2

    PCKeeper

    PCKeeper

    PCKeeper Antivirus

    PCKeeper Antivirus

    PCKLang.de

    PPriiCeLeess

    PremierOpinion

    Proxy List Free Proxies for everyone (HKLM-x32\...\{26453017-2C54-574B-7597-9EA6652686A6}) (Version: - ) <==== ACHTUNG

    RegClean-Pro

    Reimage Repair

    Sale Clipper

    Search Protect

    SecurityUtility

    Shopper-Pro

    shopperz22072015 2.0.0.471

    Shop-wit

    SmartWeb

    Software Version Updater

    speed browser

    Super Optimizer v3.2

    Support PL 1.1

    Tweet Button for Chrome by Shareaho (HKLM-x32\...\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}) (Version: - ) <==== ACHTUNG

    WindeskWinsearch 1.0

    WordShark 1.10.0.20

    youtubeadblocker


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 






Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

arev 27.08.2015 19:46
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-08-2015 02
durchgeführt von VeraHagge (Administrator) auf BINE-VERA (27-08-2015 10:26:02)
Gestartet von C:\Users\VeraHagge\Downloads\antivir
Geladene Profile: VeraHagge (Verfügbare Profile: VeraHagge & Administrator)
Platform: Windows 8.1 Connected (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672152 2014-05-22] (Realtek Semiconductor)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767200 2014-08-12] (Advanced Micro Devices, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.hyrican.de
HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.hyrican.de
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3742509177-3204372618-1584296459-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{4DA0C2FE-7569-4008-B679-DF87F24539D4}: [DhcpNameServer] 192.168.1.254

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-08-12] (Advanced Micro Devices, Inc.) [Datei ist nicht signiert]
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-07-18] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-07-18] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S0 amdkmafd; C:\Windows\System32\drivers\amdkmafd.sys [21160 2012-09-23] (Advanced Micro Devices, Inc.)
R2 AODDriver4.3; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [225504 2014-03-28] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [222720 2014-03-11] (Advanced Micro Devices)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-27] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R4 ccSet_NIS; \SystemRoot\system32\drivers\NISx64\1500000.064\ccSetx64.sys [X]
R4 IDSVia64; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\21.0.0.100\Definitions\IPSDefs\20130805.011\IDSVia64.sys [X]
R4 SRTSPX; \SystemRoot\system32\drivers\NISx64\1500000.064\SRTSPX64.SYS [X]
R4 SymDS; \SystemRoot\system32\drivers\NISx64\1500000.064\SYMDS64.SYS [X]
R4 SymEFA; \SystemRoot\system32\drivers\NISx64\1500000.064\SYMEFA64.SYS [X]
R4 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-27 10:25 - 2015-08-27 10:25 - 00000608 _____ C:\Users\VeraHagge\Documents\JRT.txt
2015-08-27 10:25 - 2015-08-27 10:25 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Macromedia
2015-08-27 10:20 - 2015-08-27 10:20 - 00000608 _____ C:\Users\VeraHagge\Desktop\JRT.txt
2015-08-27 10:16 - 2015-08-27 10:16 - 00030223 _____ C:\Users\VeraHagge\Documents\AdwCleaner[S1].txt
2015-08-27 10:11 - 2015-08-27 10:11 - 00001189 _____ C:\Users\VeraHagge\Documents\mbam.txt
2015-08-27 09:47 - 2015-08-27 09:48 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-08-27 09:47 - 2015-08-27 09:47 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-08-27 09:47 - 2015-08-27 09:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-08-27 09:46 - 2015-08-27 09:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-08-27 09:46 - 2015-08-27 09:46 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-27 09:46 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-08-27 09:46 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-08-27 09:46 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-08-26 18:04 - 2015-08-26 18:09 - 00000000 ____D C:\Users\VeraHagge\Downloads\# neue versionen #
2015-08-26 18:03 - 2015-08-27 09:57 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-1002
2015-08-26 18:00 - 2015-08-26 18:00 - 00000000 __SHD C:\Users\VeraHagge\AppData\Local\EmieUserList
2015-08-26 18:00 - 2015-08-26 18:00 - 00000000 __SHD C:\Users\VeraHagge\AppData\Local\EmieSiteList
2015-08-26 17:59 - 2015-08-26 17:59 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\AMD
2015-08-26 17:58 - 2015-08-26 17:58 - 00007988 _____ C:\Users\VeraHagge\Desktop\Entfernte Anwendungen.html
2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\WINDOWS\System32\Tasks\WPD
2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\ATI
2015-08-26 17:58 - 2015-08-26 17:58 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\ATI
2015-08-26 17:57 - 2015-08-26 17:57 - 00001461 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-26 17:57 - 2015-08-26 17:57 - 00000020 ___SH C:\Users\VeraHagge\ntuser.ini
2015-08-26 17:57 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Adobe
2015-08-26 17:57 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\VirtualStore
2015-08-26 14:04 - 2015-08-27 06:04 - 00000000 ____D C:\Windows.old
2015-08-26 14:04 - 2015-08-26 14:04 - 00262144 _____ C:\WINDOWS\system32\config\userdiff
2015-08-26 13:09 - 2015-08-27 10:17 - 01068115 _____ C:\WINDOWS\WindowsUpdate.log
2015-08-26 13:09 - 2015-08-26 13:09 - 00001226 _____ C:\Users\Administrator\AppData\Local\Application.xml
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Vorlagen
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Startmenü
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Netzwerkumgebung
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Lokale Einstellungen
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Eigene Dateien
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Druckumgebung
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Musik
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Documents\Eigene Bilder
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Local\Verlauf
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\AppData\Local\Anwendungsdaten
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default\Anwendungsdaten
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Musik
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\Documents\Eigene Bilder
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Verlauf
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Users\Default User\AppData\Local\Anwendungsdaten
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Vorlagen
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Startmenü
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Microsoft\Windows\Start Menu\Programme
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Dokumente
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\ProgramData\Anwendungsdaten
2015-08-26 13:09 - 2015-08-26 13:09 - 00000000 _SHDL C:\Program Files\Gemeinsame Dateien
2015-08-26 13:08 - 2015-08-26 17:57 - 00000000 ____D C:\Users\VeraHagge
2015-08-26 13:08 - 2015-08-26 13:09 - 00028578 _____ C:\WINDOWS\diagwrn.xml
2015-08-26 13:08 - 2015-08-26 13:09 - 00028578 _____ C:\WINDOWS\diagerr.xml
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Vorlagen
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Startmenü
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Netzwerkumgebung
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Lokale Einstellungen
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Eigene Dateien
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Druckumgebung
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Documents\Eigene Musik
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Documents\Eigene Bilder
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Local\Verlauf
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\AppData\Local\Anwendungsdaten
2015-08-26 13:08 - 2015-08-26 13:08 - 00000000 _SHDL C:\Users\VeraHagge\Anwendungsdaten
2015-08-26 13:08 - 2014-07-18 09:03 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2015-08-26 13:08 - 2014-07-18 08:53 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-26 13:08 - 2014-03-18 11:48 - 00000369 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2015-08-26 13:08 - 2014-03-18 11:48 - 00000369 _____ C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2015-08-26 13:08 - 2013-10-18 12:44 - 00001320 _____ C:\Users\VeraHagge\Desktop\Erstellen ‪Sie sich einen Wiederherstellungsdateträger.lnk
2015-08-26 13:08 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-26 13:08 - 2013-08-22 17:36 - 00000000 ____D C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-08-26 13:08 - 2012-10-02 08:25 - 00000830 _____ C:\Users\VeraHagge\Desktop\Treiber und Software.lnk
2015-08-26 13:06 - 2015-08-26 13:06 - 00002312 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3742509177-3204372618-1584296459-500
2015-08-26 13:06 - 2015-08-26 13:06 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-08-26 12:43 - 2015-08-26 18:17 - 00000000 ___HD C:\$SysReset
2015-08-26 09:47 - 2015-08-26 09:47 - 00001192 _____ C:\AdwCleaner[C3].txt
2015-08-26 09:45 - 2015-08-26 09:45 - 00001086 _____ C:\AdwCleaner[S3].txt
2015-08-26 09:36 - 2015-08-26 09:36 - 01798576 _____ (Malwarebytes Corporation) C:\Users\VeraHagge\Downloads\JRT-26-08-15.exe
2015-08-26 09:20 - 2015-08-26 09:19 - 19334088 _____ (Innovative Solutions ) C:\Users\VeraHagge\Downloads\Advanced_Uninstaller11.exe
2015-08-26 09:16 - 2015-08-26 09:16 - 00058716 _____ C:\Users\VeraHagge\Documents\eset.txt
2015-08-25 11:33 - 2015-08-25 11:33 - 00001229 _____ C:\AdwCleaner[C2].txt
2015-08-25 11:08 - 2015-08-25 11:09 - 00001105 _____ C:\AdwCleaner[S2].txt
2015-08-25 11:05 - 2015-08-25 11:05 - 00931408 _____ (Google Inc.) C:\Users\VeraHagge\Downloads\ChromeSetup.exe
2015-08-25 11:01 - 2015-08-25 11:01 - 00030187 _____ C:\AdwCleaner[C1].txt
2015-08-25 10:59 - 2015-08-27 10:12 - 00030223 _____ C:\AdwCleaner[S1].txt
2015-08-25 10:59 - 2015-08-25 10:59 - 00000000 ____D C:\AdwCleaner
2015-08-24 09:22 - 2015-08-24 09:16 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\VeraHagge\Downloads\revosetup95.exe
2015-08-21 20:14 - 2015-08-21 20:11 - 00016878 _____ C:\Users\VeraHagge\Downloads\gmer.log
2015-08-21 17:01 - 2015-08-24 12:40 - 00000000 ___RD C:\RavBin
2015-08-21 16:59 - 2015-08-21 17:01 - 00061237 _____ C:\Users\VeraHagge\Downloads\Addition.txt
2015-08-21 16:54 - 2015-08-21 17:01 - 00110968 _____ C:\Users\VeraHagge\Downloads\FRST.txt
2015-08-21 16:49 - 2015-08-21 16:31 - 00380416 _____ C:\Users\VeraHagge\Downloads\Gmer-19357.exe
2015-08-21 16:42 - 2015-08-27 10:26 - 00000000 ____D C:\FRST
2015-08-21 16:41 - 2015-08-21 16:41 - 00000000 _____ C:\Users\VeraHagge\defogger_reenable
2015-08-21 16:20 - 2015-08-24 09:18 - 00000000 ____D C:\qycache
2015-08-21 16:20 - 2015-08-21 16:20 - 00000000 ____D C:\ppsfile
2015-08-21 15:28 - 2015-08-27 09:45 - 00000000 ____D C:\Users\VeraHagge\Downloads\antivir
2015-08-21 15:24 - 2015-08-21 15:24 - 00000687 _____ C:\awhFF08.tmp
2015-08-21 15:11 - 2015-08-21 15:11 - 00000687 _____ C:\awh998E.tmp
2015-08-21 12:32 - 2015-08-21 12:32 - 00000687 _____ C:\awhF033.tmp
2015-08-21 08:43 - 2015-08-22 01:06 - 00001397 _____ C:\startup.log
2015-08-13 13:33 - 2015-08-13 13:33 - 00000687 _____ C:\awhEDA9.tmp

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-27 10:16 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\restore
2015-08-27 10:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-08-27 04:37 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-08-27 04:30 - 2015-05-11 14:00 - 00000000 ____D C:\Users\VeraHagge\AppData\Local\Packages
2015-08-27 00:00 - 2014-09-10 20:43 - 00000000 ___DC C:\WINDOWS\Panther
2015-08-26 18:03 - 2014-09-10 10:47 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2015-08-26 18:03 - 2013-08-22 17:36 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-08-26 18:03 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2015-08-26 17:59 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\Recovery
2015-08-26 14:04 - 2013-08-22 17:36 - 00262144 _____ C:\WINDOWS\system32\config\BCD-Template
2015-08-26 13:14 - 2014-03-18 11:47 - 01686150 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-08-26 13:14 - 2014-03-18 11:30 - 00726688 _____ C:\WINDOWS\system32\perfh007.dat
2015-08-26 13:14 - 2014-03-18 11:30 - 00151380 _____ C:\WINDOWS\system32\perfc007.dat
2015-08-26 13:12 - 2014-09-10 10:47 - 00000000 ____D C:\ProgramData\Norton
2015-08-26 13:10 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-08-26 13:09 - 2013-08-22 17:36 - 00000000 __RHD C:\Users\Public\Libraries
2015-08-26 13:09 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows NT
2015-08-26 13:09 - 2013-08-22 16:46 - 00027757 _____ C:\WINDOWS\setupact.log
2015-08-26 13:09 - 2013-08-22 15:36 - 00000000 __RHD C:\Users\Default
2015-08-26 13:07 - 2014-09-10 11:02 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2015-08-26 13:07 - 2014-09-10 10:46 - 00000000 ____D C:\Users\Administrator
2015-08-26 13:07 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-08-26 13:07 - 2013-08-22 16:44 - 00335992 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-26 13:07 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-08-26 13:06 - 2013-08-22 17:37 - 00003608 _____ C:\WINDOWS\DtcInstall.log
2015-08-26 13:05 - 2014-03-18 03:38 - 00001912 _____ C:\WINDOWS\PFRO.log

Einige Dateien in TEMP:
====================
C:\Users\VeraHagge\AppData\Local\Temp\SEVINST64x86.EXE


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2014-09-10 10:43

==================== Ende von FRST.txt ============================
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.5.4 (07.27.2015:1)
OS: Windows 8.1 Connected x64
Ran by VeraHagge on 27.08.2015 at 10:16:33,22
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.08.2015 at 10:20:17,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlaufdatum: 27.08.2015
Suchlaufzeit: 09:48
Protokolldatei: mbam-log.txt
Administrator: Ja

Version: 2.1.8.1057
Malware-Datenbank: v2015.08.27.01
Rootkit-Datenbank: v2015.08.16.01
Lizenz: Testversion
Malware-Schutz: Aktiviert
Schutz vor bösartigen Websites: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: VeraHagge

Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 372486
Abgelaufene Zeit: 7 Min., 40 Sek.

Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(keine bösartigen Elemente erkannt)

Module: 0
(keine bösartigen Elemente erkannt)

Registrierungsschlüssel: 0
(keine bösartigen Elemente erkannt)

Registrierungswerte: 0
(keine bösartigen Elemente erkannt)

Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)

Ordner: 0
(keine bösartigen Elemente erkannt)

Dateien: 0
(keine bösartigen Elemente erkannt)

Physische Sektoren: 0
(keine bösartigen Elemente erkannt)


(end)
AdwCleaner Logfile:
Code:
# AdwCleaner v5.000 - Logfile created 25/08/2015 at 10:59:46
# Updated 14/08/2015 by Xplode
# Database : 2015-08-23.3 [Server]
# Operating system : Windows 8.1 Connected  (x64)
# Username : VeraHagge - BINE-VERA
# Running from : C:\Users\VeraHagge\Downloads\antivir\adwcleaner_5.000.exe
# Option : Scan

***** [ Services ] *****

Service Found : nethfdrv
Service Found : NethxxpService
Service Found : ServiceUpdater
Service Found : QMUdisk
Service Found : TS888x64
Service Found : RsMgrSvc
Service Found : 088c3b28
Service Found : 1f68291f
Service Found : 80b4b4af
Service Found : SPDRIVER_1.42.1.2188

***** [ Folders ] *****

Folder Found : C:\IQIYI Video
Folder Found : C:\DesktopSearch
Folder Found : C:\Program Files\Kromtech
Folder Found : C:\Program Files\WinZip Driver Updater
Folder Found : C:\Program Files (x86)\Boost
Folder Found : C:\Program Files (x86)\predm
Folder Found : C:\Program Files (x86)\shopwit
Folder Found : C:\Program Files (x86)\Convertor
Folder Found : C:\Program Files (x86)\GUPlayer
Folder Found : C:\Program Files (x86)\tencent
Folder Found : C:\Program Files (x86)\DailyPcClean Support
Folder Found : C:\Program Files (x86)\Rising
Folder Found : C:\Program Files (x86)\winsta
Folder Found : C:\Program Files (x86)\MiniLite
Folder Found : C:\Program Files (x86)\MiniiMuuumPruice
Folder Found : C:\Program Files (x86)\Winsta
Folder Found : C:\Program Files (x86)\Common Files\Umbrella
Folder Found : C:\Program Files (x86)\Common Files\tencent
Folder Found : C:\Program Files\Common Files\tencent
Folder Found : C:\ProgramData\Browser
Folder Found : C:\ProgramData\Kromtech
Folder Found : C:\ProgramData\Convertor
Folder Found : C:\ProgramData\radio
Folder Found : C:\ProgramData\tencent
Folder Found : C:\ProgramData\TXQMPC
Folder Found : C:\ProgramData\Rising
Folder Found : C:\ProgramData\4adc7a4f00005e5d
Folder Found : C:\ProgramData\53e616a6000027d3
Folder Found : C:\ProgramData\5b64599000004c3f
Folder Found : C:\ProgramData\6632678238890282139
Folder Found : C:\ProgramData\{36543f71-a4eb-bdfc-3654-43f71a4efdc6}
Folder Found : C:\ProgramData\{5fa924e3-d0e2-8e5b-5fa9-924e3d0e938f}
Folder Found : C:\ProgramData\{76f270a0-8ddb-0972-76f2-270a08ddc282}
Folder Found : C:\ProgramData\{8a5acb8e-91ed-48f3-8a5a-acb8e91e2e3a}
Folder Found : C:\ProgramData\{8f1ec0c1-07e2-335f-8f1e-ec0c107e0304}
Folder Found : C:\ProgramData\{9067e982-1f12-20b7-9067-7e9821f1a608}
Folder Found : C:\ProgramData\{9448b5cb-7fb0-e8b2-9448-8b5cb7fbd72d}
Folder Found : C:\ProgramData\{cd6397c2-994a-f3eb-cd63-397c29945f0a}
Folder Found : C:\ProgramData\{ef8baf33-367f-614b-ef8b-baf33367bccc}
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kromtech
Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Desktop Search
Folder Found : C:\Users\Administrator\AppData\Local\speed browser
Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\Iminent
Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\PremierOpinion
Folder Found : C:\Users\VERAHA~1\AppData\Local\Temp\tencent
Folder Found : C:\Users\VeraHagge\AppData\Local\Boost
Folder Found : C:\Users\VeraHagge\AppData\Local\Kromtech
Folder Found : C:\Users\VeraHagge\AppData\Local\DesktopSearch
Folder Found : C:\Users\VeraHagge\AppData\Local\YSearchUtil
Folder Found : C:\Users\VeraHagge\AppData\Local\SysassistByHotWheel
Folder Found : C:\Users\VeraHagge\AppData\Local\03D40274-1437907493-057A-7206-A20700080009
Folder Found : C:\Users\VeraHagge\AppData\LocalLow\Browser-Security
Folder Found : C:\Users\VeraHagge\AppData\Roaming\ASP
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Convertor
Folder Found : C:\Users\VeraHagge\AppData\Roaming\pdfie
Folder Found : C:\Users\VeraHagge\AppData\Roaming\WinKit
Folder Found : C:\Users\VeraHagge\AppData\Roaming\tencent
Folder Found : C:\Users\VeraHagge\AppData\Roaming\cpuminer
Folder Found : C:\Users\VeraHagge\AppData\Roaming\jellylam
Folder Found : C:\Users\VeraHagge\AppData\Roaming\winsta
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Winsta
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GUPlayer
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\22JDQ@j.org
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\fIed@2Q.net
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\hRGDtVG@B.org
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\tIxgdvdh@u.org
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\ccf7276c-d388-480f-8835-5b680025e1ca@gmail.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\r8kbw0t7.default-1436725576431\Extensions\f04aefc8-8ba0-4db5-9173-75513b63d276@1c0acb40-234c-4912-b8ce-35e3901228ad.com
Folder Found : C:\Users\VeraHagge\Documents\DailyPCClean
Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\SearchProtect
Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\speed browser
Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Local\YSearchUtil
Folder Found : C:\WINDOWS\SysWOW64\config\systemprofile\AppData\Roaming\tencent

***** [ Files ] *****

File Found : C:\Program Files (x86)\Mozilla Firefox\defaults\pref\all-iminent.js
File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\StartWeb.xml
File Found : C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\yahoo.xml
File Found : C:\Program Files (x86)\Common Files\config\uninstinethnfd.exe
File Found : C:\Users\Public\Desktop\slimcleaner plus.lnk
File Found : C:\Users\Public\Desktop\driverupdate.lnk
File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\istartsurf.xml
File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\user.js
File Found : C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\searchplugins\yahoo.xml
File Found : C:\Users\VeraHagge\Desktop\GUPlayer.lnk
File Found : C:\WINDOWS\Sysnative\sasnative64.exe
File Found : C:\WINDOWS\Sysnative\drivers\fileHiders.sys
File Found : C:\WINDOWS\Sysnative\drivers\TFsFltX64.sys
File Found : C:\WINDOWS\SysWOW64\SafeAppLM.ocx
File Found : C:\WINDOWS\SysWOW64\drivers\TS888x64.sys

***** [ Shortcuts ] *****

Shortcut Infected : C:\Users\VeraHagge\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome .lnk ( hxxp://start.iminent.com/?appId=b7672bac-eee2-4450-a0fc-afe69bcdc811&ref=sct )

***** [ Scheduled tasks ] *****

Task Found : ASP
Task Found : Convertor
Task Found : WinKit
Task Found : WinZipDriverUpdater_UPDATES
Task Found : LaunchPreSignup
Task Found : DriverMgr
Task Found : keepup
Task Found : SMWUpd
Task Found : Superclean
Task Found : Winsta Update
Task Found : Shop-wit Updater
Task Found : Optscan
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-6
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-7
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5_user
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-11
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-4
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user
Task Found : c233af57-2b16-455f-9052-a826317e171a-1-6
Task Found : c233af57-2b16-455f-9052-a826317e171a-1-7
Task Found : c233af57-2b16-455f-9052-a826317e171a-10_user
Task Found : c233af57-2b16-455f-9052-a826317e171a-4
Task Found : c233af57-2b16-455f-9052-a826317e171a-5
Task Found : c233af57-2b16-455f-9052-a826317e171a-5_user
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-6
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-1-7
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5
Task Found : 3684a602-0673-47a5-9b45-32a46950946c-5_user
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-6
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-1-7
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-11
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-4
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5
Task Found : 39b4727c-96f0-45a6-8f25-0adaab9ae46a-5_user
Task Found : c233af57-2b16-455f-9052-a826317e171a-1-6
Task Found : c233af57-2b16-455f-9052-a826317e171a-1-7
Task Found : c233af57-2b16-455f-9052-a826317e171a-10_user
Task Found : c233af57-2b16-455f-9052-a826317e171a-4
Task Found : c233af57-2b16-455f-9052-a826317e171a-5
Task Found : c233af57-2b16-455f-9052-a826317e171a-5_user
Task Found : SMW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34
Task Found : SPBIW_UpdateTask_Time_323939383636383733322d3755556c415a505757414a34
Task Found : LVKAHSH1

***** [ Registry ] *****

Key Found : HKCU\Software\Mozilla\Extends
Key Found : HKLM\SOFTWARE\CLASSES\Boost.BoostBho.1
Key Found : HKLM\SOFTWARE\CLASSES\Boost.BoostBho
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Boost]
Key Found : HKLM\SOFTWARE\Classes\AppID\DownloadProxy.EXE
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [SmartWeb]
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DesktopSearch]
Value Found : HKLM\SOFTWARE\Classes\.htm\OpenWithProgids [CRSBRWSHTML]
Value Found : HKLM\SOFTWARE\Classes\.html\OpenWithProgids [CRSBRWSHTML]
Value Found : HKLM\SOFTWARE\RegisteredApplications [Crossbrowse]
Key Found : HKLM\SOFTWARE\CLASSES\METNSD
Key Found : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP
Key Found : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [PCKeeper2]
Value Found : HKLM\SOFTWARE\Classes\.xht\OpenWithProgIDs [CRSBRWSHTML]
Value Found : HKLM\SOFTWARE\Classes\.webp\OpenWithProgIDs [CRSBRWSHTML]
Value Found : HKLM\SOFTWARE\Classes\.shtml\OpenWithProgIDs [CRSBRWSHTML]
Key Found : HKLM\SOFTWARE\CLASSES\adTech.adTech.1
Key Found : HKLM\SOFTWARE\CLASSES\adTech.adTech
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mbot_de_012010041]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010041]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [rec_de_57]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010057]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [gmsd_de_005010066]
Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [DesktopSearch]
Key Found : HKLM\SOFTWARE\15256f25-c79f-8bd9-2f30-4c64ad1a4c09
Key Found : HKLM\SOFTWARE\5da059a482fd494db3f252126fbc3d5b
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{1f68291f}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}{80b4b4af}
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [searchffv2@gmail.com]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [deskCutv2@gmail.com]
Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [defsearchp@gmail.com]
Key Found : HKLM\SOFTWARE\Classes\AppID\{51BEE30D-EEC8-4BA3-930B-298B8E759EB1}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{70DE12EA-79F4-46BC-9812-86DB50A2FD64}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{6EDBF8C0-C94C-4A13-956F-E393BCA5BA4B}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{934B156A-3D17-3981-B78A-5C138F423AD6}
Key Found : HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F}
Key Found : HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370}
Key Found : HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E860F65C-6645-411C-A662-E12E25FD3A93}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{3FC2D59A-5C76-1E97-30DC-1EC6784419E5}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{934B156A-3D17-3981-B78A-5C138F423AD6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2299856A-6506-42E3-A34F-CD35A47C1B19}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{934B156A-3D17-3981-B78A-5C138F423AD6}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2299856A-6506-42E3-A34F-CD35A47C1B19}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5E6A8DA1-5731-465B-B036-B9E16EF26CAC}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5EC7C511-CD0F-42E6-830C-1BD9882F3458}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1F91A9A1-01BA-4C81-863D-3BA0751E1419}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{934B156A-3D17-3981-B78A-5C138F423AD6}
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{1F91A9A1-01BA-4C81-863D-3BA0751E1419}]
Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID [{934B156A-3D17-3981-B78A-5C138F423AD6}]
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{2299856A-6506-42E3-A34F-CD35A47C1B19}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{5CD76C57-6893-478A-B776-47E7C82504BE}
Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{934B156A-3D17-3981-B78A-5C138F423AD6}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{88C20E16-1EB7-40CE-820C-6CFCB41B1D2F}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{41634761-D0BA-4C1A-9AC2-04AEE9511370}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{E7270EC6-0113-4A78-B610-E501D0A9E48E}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{EAC7DE5C-9520-435D-91AA-4A02E4773CEA}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{63D2A451-3351-178C-7BC4-13C4D58A7652}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{934B156A-3D17-3981-B78A-5C138F423AD6}
Key Found : HKU\.DEFAULT\Software\Browser
Key Found : HKCU\Software\InstalledBrowserExtensions
Key Found : HKCU\Software\MyBestOffersToday
Key Found : HKCU\Software\NoVooITSet
Key Found : HKCU\Software\Vonteera Safe ads
Key Found : HKCU\Software\GAMESDESKTOP
Key Found : HKCU\Software\Squeaky
Key Found : HKCU\Software\reimagerepair
Key Found : HKCU\Software\PRODUCTSETUP
Key Found : HKCU\Software\Kromtech
Key Found : HKCU\Software\Browser
Key Found : HKCU\Software\OffersWizard
Key Found : HKCU\Software\DAILYPCCLEAN
Key Found : HKCU\Software\AppDataLow\Software\Boost
Key Found : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Found : HKLM\SOFTWARE\InstalledBrowserExtensions
Key Found : HKLM\SOFTWARE\Tutorials
Key Found : HKLM\SOFTWARE\Uniblue
Key Found : HKLM\SOFTWARE\ORBTR
Key Found : HKLM\SOFTWARE\{12A61307-94CD-4F8E-94BC-918E511FAA81}
Key Found : HKLM\SOFTWARE\AIM Toolbar
Key Found : HKLM\SOFTWARE\AdGazelle
Key Found : HKLM\SOFTWARE\FFPluginHp
Key Found : HKLM\SOFTWARE\ZoomWebLists
Key Found : HKLM\SOFTWARE\searchult
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA1838EF-A497-194E-3850-37A62CEE398B}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}
Key Found : [x64] HKCU\Software\InstalledBrowserExtensions
Key Found : [x64] HKCU\Software\MyBestOffersToday
Key Found : [x64] HKCU\Software\NoVooITSet
Key Found : [x64] HKCU\Software\Vonteera Safe ads
Key Found : [x64] HKCU\Software\GAMESDESKTOP
Key Found : [x64] HKCU\Software\Squeaky
Key Found : [x64] HKCU\Software\reimagerepair
Key Found : [x64] HKCU\Software\PRODUCTSETUP
Key Found : [x64] HKCU\Software\Kromtech
Key Found : [x64] HKCU\Software\Browser
Key Found : [x64] HKCU\Software\OffersWizard
Key Found : [x64] HKCU\Software\DAILYPCCLEAN
Key Found : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Key Found : [x64] HKLM\SOFTWARE\BubbleSound
Key Found : [x64] HKLM\SOFTWARE\WebBar
Key Found : [x64] HKLM\SOFTWARE\SecurityUtility
Key Found : [x64] HKLM\SOFTWARE\Kromtech
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\gpuminer
Data Found : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
Data Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.hao123.com/?tn=91800134_hao_pg
Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
Data Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page] - hxxp://www.istartsurf.com/?type=hppp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
Data Found : HKU\S-1-5-21-3742509177-3204372618-1584296459-1002\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://www.istartsurf.com/web/?type=dspp&ts=1437901071&z=d21ebd922bee7e2352cee62g5zec6m3t2ebg8e5o1t&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searchTerms}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{BFFED5CA-8BDF-47CC-AED0-23F4E6D77732}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
Data Found : HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command [] - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.oursurfing.com/?type=sc&ts=1436658449&z=13abf1ab21cdeb884a3e887gdz3c4qbqbweb3z8zdc&from=pjr&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT
Data Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\programdata\securityutility\securityutility32.dll

***** [ Web browsers ] *****

[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.defaultenginename", "mystartsearch");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.alias", "istartsurf");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.iconURL", "hxxp://www.istartsurf.com/favicon.ico");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.name", "istartsurf");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.searchengine.url", "hxxp://www.istartsurf.com/web/?type=ds&ts=1437900925&z=c6a2f3ee8426432ab8bdfa3gcz9cbm7t6ece4beb4c&from=face&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT&q={searc[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.search.selectedEngine", "mystartsearch");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("browser.startup.homepage", "hxxp://www.mystartsearch.com/?type=hp&ts=1440165373&z=fa5cfb9e673cb17136cd2e2g7z7z9edg5q6weo1meb&from=cmi&uid=ST31000524AS_5VP1PEGTXXXX5VP1PEGT");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.MdmFGpy6eTjyS0bF.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.ZvqtEhdEa7X79ffG.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.cookie.previous_page.value", "%22hxxp%3A//start.iminent.com/de-DE/newtab/%23ref%3DNewTab%22");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.co.uk%22%2C%22amazon.com%22%[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.accf7276cd388480f88355b680025e1cagmailcom71387.71387.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22deal[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.af04aefc88ba04db5917375513b63d2761c0acb40234c4912b8ce35e3901228adcom57563.57563.internaldb.__ICM_LITE__blacklist_domain.value", "%7B%22SLIDERS%22%3A%5B%226pm.com%22%2C%22amazon.c[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.af04aefc88ba04db5917375513b63d2761c0acb40234c4912b8ce35e3901228adcom57563.57563.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.crossrider.bic", "14e9ab5d489c8155bf6e8def973422d3");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.fnprTKRPzQ0XbvnL.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.quick_start.enable_search1", false);
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.quick_start.sd.closeWindowWithLastTab_prev_state", false);
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("extensions.u6FAJmxBVjsYnKmE.scode", "(function(){try{if(window.location.href.indexOf(\"rjaHqHg6rdnHqdC8rTC7pjrEqdC\")>-1){return;}}catch(e){}try{var d=[[\"www.ewoss.com\",\"livewebcams.xyz\[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.BirthDate", "1437900771");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.LayoutId", "1");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent._oaZGabJJ8Q_", "{\"cpt\":0,\"cpr\":0,\"s\":0,\"es\":1}");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.adapters", "{\"www.kbdadsfast.com\":{\"CountryCode\":\"DE\",\"NoAds\":false,\"Status\":2,\"AdapterKey\":\"default_adapter\",\"v\":true,\"p\":0,\"t\":1,\"th\":1.1,\"expireTime\":\"14[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.cifs", "1");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.enableToolbar", "true");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.enabledAds", "obsolete");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.externalScripts", "{\"value\":[{\"addonUid\":\"b7110a40-a16f-4a12-a411-bd0b6014905a\",\"name\":\"Superfish\",\"addonId\":2,\"url\":\"//www.best-deals-products.com/ws/sf_main.jsp\",\[...]
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.newtabredirect", "true");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.nomsi", "true");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.searchindex", "1");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.trackExternalScripts14", "1437932654360");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.trackExternalScripts2", "1437932652462");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.version", "9.30.5.1");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("iminent.versioning", "{\"CurrentVersion\":\"9.30.5.1\",\"InstallEventCTime\":1438364753062,\"InstallEvent\":\"True\"}");
[C:\Users\VeraHagge\AppData\Roaming\Mozilla\Firefox\Profiles\mysac76v.default-1436698072516\prefs.js] [Preference] Found : user_pref("keyword.URL", "hxxp://www-searching.com/search.aspx?site=shdefault&prd=smw&pid=s&shr=d&q={searchTerms}&s=F7Qztutdk0004,247f26b0-fdfb-4617-8f07-f92d0163f339,");

*************************

C:\AdwCleaner[S1].txt - [28960 octets] - [25/08/2015 10:59:46]

########## EOF - C:\AdwCleaner[S1].txt - [29024 octets] ##########
--- --- ---
AdwCleaner Logfile:
Code:
# AdwCleaner v5.000 - Logfile created 27/08/2015 at 10:12:13
# Updated 14/08/2015 by Xplode
# Database : 2015-08-25.1 [Server]
# Operating system : Windows 8.1 Connected  (x64)
# Username : VeraHagge - BINE-VERA
# Running from : C:\Users\VeraHagge\Downloads\antivir\adwcleaner_5.000.exe
# Option : Scan

***** [ Services ] *****


***** [ Folders ] *****


***** [ Files ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****


***** [ Web browsers ] *****


*************************

C:\AdwCleaner[C1].txt - [30187 octets] - [25/08/2015 11:01:17]
C:\AdwCleaner[C2].txt - [1229 octets] - [25/08/2015 11:33:29]
C:\AdwCleaner[C3].txt - [1192 octets] - [26/08/2015 09:47:17]
C:\AdwCleaner[S1].txt - [29963 octets] - [25/08/2015 10:59:46]
C:\AdwCleaner[S2].txt - [1105 octets] - [25/08/2015 11:08:28]
C:\AdwCleaner[S3].txt - [1086 octets] - [26/08/2015 09:45:19]

########## EOF - C:\AdwCleaner[S1].txt - [30153 octets] ##########
--- --- ---

So, alles gemacht.
Für mich war es jetzt einmal wichtig zu erfahren ob auf dem Weg die Restauration von Windows schneller geht als durch eine Neuinstallation und ob ich auch wieder Vertrauen in meinen Rechner habe.
Ich finde das ist ein gangbarer Weg und ich bedanke mich sehr.

allerdings geht das Windows update nicht mehr

schrauber 28.08.2015 15:37

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131