Trojaner-Board - langsam und ständiges öffnen von komischen Internetseiten

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - langsam und ständiges öffnen von komischen Internetseiten (https://www.trojaner-board.de/167653-langsam-staendiges-oeffnen-komischen-internetseiten.html)

Hier die FRST logs

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015

Ran by Undertaker (administrator) on UNDERTAKER-PC on 08-06-2015 22:31:08

Running from C:\Users\Undertaker\Downloads

Loaded Profiles: Undertaker (Available Profiles: Undertaker & Shari)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Windows\meud.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

() C:\Windows\SysWOW64\PnkBstrB.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Dropbox, Inc.) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe

(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe

(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

() C:\Program Files (x86)\Opera\29.0.1795.60\opera_crashreporter.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-13] (ELAN Microelectronics Corp.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [421888 2012-11-18] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-22] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816784 2014-07-21] (LogMeIn Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [2190912 2015-05-06] (1und1 Mail und Media GmbH)

HKLM-x32\...\Run: [iScreeny] => C:\Users\Undertaker\AppData\Local\iScreeny\iScreeny.exe

HKLM-x32\...\Run: [iScreeny - Web] => C:\Users\Undertaker\AppData\Local\iScreeny\iWebScreeny.exe

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [384800 2012-10-16] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Facebook Update] => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-25] (Facebook Inc.)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1565504 2015-01-14] (Samsung)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2015-01-14] (Samsung)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [GoogleChromeAutoLaunch_DF202E42DFEEF9CE7A049D628287467C] => C:\Users\Undertaker\AppData\Local\Chromium\Application\chrome.exe [659456 2015-06-03] (The Chromium Authors)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)

AppInit_DLLs-x32: c:\progra~3\{b37b5~1\1172~1.1\nisi.dll => "c:\progra~3\{b37b5~1\1172~1.1\nisi.dll" File not found

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-02-01]

ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

Startup: C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-07-25]

ShortcutTarget: Dropbox.lnk -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled

ProxyServer: [.DEFAULT] => http=127.0.0.1:51515;https=127.0.0.1:51515

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

SearchScopes: HKLM -> {9143e921-7c9a-4d27-ac43-eaccc78cc55a} URL = 

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-1335839233-2991384071-368375801-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-02-01] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll [2010-10-25] ()

BHO-x32: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-02-01] (Oracle Corporation)

DPF: HKLM {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

DPF: HKLM {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_x64_5.0.199.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\windows\system32\npDeployJava1.dll [2012-11-05] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-02-01] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-02-01] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @popularscreensavers.com/Plugin -> C:\Program Files (x86)\PopularScreensavers\NPp5Stub.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll [2015-04-27] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1335839233-2991384071-368375801-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Undertaker\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)

FF Plugin HKU\S-1-5-21-1335839233-2991384071-368375801-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2013-10-01] ()
 

Chrome: 

=======

CHR Profile: C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-14]

CHR Extension: (Google Docs) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-14]

CHR Extension: (Google Drive) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-14]

CHR Extension: (YouTube) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-14]

CHR Extension: (Google Search) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-14]

CHR Extension: (Google Sheets) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-14]

CHR Extension: (Avira Browser Safety) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-05-14]

CHR Extension: (Bookmark Manager) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-14]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-14]

CHR Extension: (Google Wallet) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-15]

CHR Extension: (Gmail) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-14]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

StartMenuInternet: Google Chrome - chrome.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-03-22] (Advanced Micro Devices, Inc.) [File not signed]

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84256 2012-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108320 2012-10-16] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]

R2 meud; c:\windows\meud.exe [408576 2015-06-06] () [File not signed]

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [75136 2013-03-11] ()

R2 PnkBstrB; C:\windows\SysWOW64\PnkBstrB.exe [189248 2013-03-11] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [765144 2014-11-28] (Secunia)

R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-07-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [99248 2012-09-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [129216 2012-10-04] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27800 2012-09-24] (Avira Operations GmbH & Co. KG)

R1 iScreeny; C:\windows\iScreeny.sys [50840 2015-03-11] (Windows (R) Win 7 DDK provider)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-07-28] ()

S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)

S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-01-16] (Windows (R) 2003 DDK 3790 provider)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

S3 RkHit; \??\C:\windows\system32\drivers\RKHit.sys [X]

S3 taphss6; system32\DRIVERS\taphss6.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-08 17:21 - 2015-06-08 17:21 - 00243592 _____ C:\Users\Undertaker\Downloads\Firefox Setup Stub 38.0.5 (1).exe

2015-06-08 17:16 - 2015-06-08 17:16 - 00243592 _____ C:\Users\Undertaker\Downloads\Firefox Setup Stub 38.0.5.exe

2015-06-08 16:28 - 2015-06-08 13:06 - 00024064 _____ C:\windows\zoek-delete.exe

2015-06-08 15:04 - 2015-06-08 15:04 - 00000000 ___SD C:\windows\SysWOW64\GWX

2015-06-08 15:04 - 2015-06-08 15:04 - 00000000 ___SD C:\windows\system32\GWX

2015-06-08 13:58 - 2015-06-08 16:51 - 00000000 ____D C:\zoek

2015-06-08 13:10 - 2015-06-08 16:51 - 00059803 _____ C:\zoek-results.log

2015-06-08 13:06 - 2015-06-08 16:08 - 00000000 ____D C:\zoek_backup

2015-06-08 13:05 - 2015-06-08 13:06 - 01308672 _____ C:\Users\Undertaker\Downloads\zoek.exe

2015-06-07 23:20 - 2015-06-07 23:20 - 00041826 _____ C:\Users\Undertaker\Desktop\FRST.txt

2015-06-07 22:46 - 2015-06-07 22:48 - 00135230 _____ C:\Users\Undertaker\Desktop\auswahl.txt

2015-06-07 20:40 - 2015-06-07 20:40 - 00000000 ____D C:\Users\Undertaker\Downloads\RevoUninstallerPortable

2015-06-07 20:39 - 2015-06-07 20:40 - 02785665 _____ (PortableApps.com) C:\Users\Undertaker\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe

2015-06-06 23:04 - 2015-06-06 23:04 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Avira

2015-06-06 22:58 - 2015-06-06 22:58 - 00001954 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2015-06-06 22:57 - 2012-10-04 12:07 - 00129216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2015-06-06 22:57 - 2012-09-24 09:58 - 00027800 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys

2015-06-06 22:57 - 2012-09-13 15:52 - 00099248 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2015-06-06 21:36 - 2015-06-06 23:28 - 00001062 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-06-06 21:32 - 2015-06-06 21:34 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Undertaker\Downloads\mbam-setup-2.1.6.1022.exe

2015-06-06 21:17 - 2015-06-07 23:25 - 00052477 _____ C:\Users\Undertaker\Downloads\Addition.txt

2015-06-06 21:12 - 2015-06-08 22:31 - 00021611 _____ C:\Users\Undertaker\Downloads\FRST.txt

2015-06-06 21:11 - 2015-06-06 21:11 - 02108928 _____ (Farbar) C:\Users\Undertaker\Downloads\FRST64.exe

2015-06-06 19:22 - 2015-06-07 21:07 - 00000000 ____D C:\AdwCleaner

2015-06-06 13:50 - 2015-06-07 22:10 - 00173056 _____ C:\windows\Provider.dll

2015-06-06 13:50 - 2015-06-07 22:10 - 00000000 ____D C:\windows\Provider32

2015-06-06 13:50 - 2015-06-07 20:51 - 00173056 _____ C:\windows\Provider20150607221036.dll

2015-06-06 13:50 - 2015-06-07 19:50 - 00173056 _____ C:\windows\Provider20150607205118.dll

2015-06-06 13:50 - 2015-06-06 23:54 - 00173056 _____ C:\windows\Provider20150607195041.dll

2015-06-06 13:50 - 2015-06-06 22:06 - 00173056 _____ C:\windows\Provider20150606235357.dll

2015-06-06 13:50 - 2015-06-06 19:55 - 00173056 _____ C:\windows\Provider20150606220627.dll

2015-06-06 13:50 - 2015-06-06 18:06 - 00173056 _____ C:\windows\Provider20150606195541.dll

2015-06-06 13:50 - 2015-06-06 16:53 - 00173056 _____ C:\windows\Provider20150606180602.dll

2015-06-06 13:50 - 2015-06-06 15:52 - 00173056 _____ C:\windows\Provider20150606165333.dll

2015-06-06 13:50 - 2015-06-06 14:51 - 00173056 _____ C:\windows\Provider20150606155257.dll

2015-06-06 13:50 - 2015-06-06 13:50 - 00718497 _____ C:\windows\unins000.exe

2015-06-06 13:50 - 2015-06-06 13:50 - 00010273 _____ C:\windows\unins000.dat

2015-06-06 13:50 - 2015-06-02 18:30 - 00173056 _____ C:\windows\Provider20150606145136.dll

2015-06-06 13:50 - 2015-06-02 18:30 - 00101888 _____ C:\windows\Installer.exe

2015-06-06 13:48 - 2015-06-06 13:48 - 02231296 _____ C:\Users\Undertaker\Downloads\AdwCleaner_4.206.exe

2015-06-06 13:42 - 2015-06-06 13:42 - 02870984 _____ (ESET) C:\Users\Undertaker\Downloads\esetsmartinstaller_deu.exe

2015-06-06 13:26 - 2015-06-06 13:26 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Chromium

2015-06-06 13:20 - 2015-06-06 13:26 - 00000000 ___HD C:\ProgramData\eud

2015-06-06 13:18 - 2015-06-06 22:19 - 00000004 _____ C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-06-06 13:16 - 2015-06-06 13:16 - 00631296 _____ C:\windows\eud.dat

2015-06-06 13:16 - 2015-06-06 13:16 - 00408576 _____ C:\windows\meud.exe

2015-06-06 13:06 - 2015-06-06 13:20 - 00000684 _____ C:\Users\Undertaker\Downloads\project64                         .website

2015-06-06 13:06 - 2015-06-06 13:20 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Deployment

2015-06-06 13:06 - 2015-06-06 13:06 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Apps\2.0

2015-06-06 12:53 - 2015-06-06 12:53 - 00001285 _____ C:\Users\Undertaker\Desktop\setup_Project64_2.2.exe - Verknüpfung.lnk

2015-06-06 12:45 - 2015-06-06 12:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Project 64 2.2

2015-06-06 12:45 - 2015-06-06 12:53 - 00000000 ____D C:\Program Files (x86)\Project64 2.2

2015-06-06 12:39 - 2015-06-06 12:39 - 12699289 _____ C:\Users\Undertaker\Downloads\Mario Kart 64 (E).zip

2015-06-06 12:35 - 2015-06-06 12:35 - 08388608 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E) (1).v64

2015-06-06 12:34 - 2015-06-06 12:46 - 00001089 _____ C:\Users\Public\Desktop\Opera.lnk

2015-06-06 12:34 - 2015-06-06 12:34 - 00003862 _____ C:\windows\System32\Tasks\Opera scheduled Autoupdate 1433586837

2015-06-06 12:34 - 2015-06-06 12:34 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Opera Software

2015-06-06 12:34 - 2015-06-06 12:34 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Opera Software

2015-06-06 12:34 - 2015-06-06 12:33 - 00001095 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2015-06-06 12:33 - 2015-06-08 16:56 - 00000000 ____D C:\Program Files (x86)\Opera

2015-06-06 12:33 - 2015-06-06 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2015-06-06 12:33 - 2015-06-06 12:33 - 00000000 ____D C:\Program Files (x86)\7-Zip

2015-06-06 12:32 - 2015-06-06 16:12 - 00000000 ____D C:\Program Files (x86)\MiuiTab

2015-06-06 12:32 - 2015-06-06 12:31 - 01200163 _____ C:\Users\Undertaker\Downloads\7zip.exe

2015-06-06 12:21 - 2015-06-06 12:46 - 00001311 _____ C:\Users\Public\Desktop\NAVIGON Fresh.lnk

2015-06-06 12:21 - 2015-06-06 12:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NAVIGON

2015-06-06 12:21 - 2015-06-06 12:21 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-06-05 22:10 - 2015-06-05 22:11 - 01089752 _____ (Unity Technologies ApS) C:\Users\Undertaker\Downloads\UnityWebPlayer (1).exe

2015-06-04 14:56 - 2015-06-04 14:56 - 00983949 _____ C:\Users\Undertaker\Downloads\Super Mario Allstars (E).zip

2015-06-04 14:35 - 2015-06-04 14:36 - 06347644 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E) (1).zip

2015-06-04 12:44 - 2015-06-04 12:45 - 06347644 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E).zip

2015-06-04 12:39 - 2015-01-30 06:22 - 00000073 ____R C:\Users\Undertaker\Downloads\PokeMMO.sh

2015-06-02 22:00 - 2015-06-04 12:42 - 13171110 _____ C:\Users\Undertaker\Desktop\PokeMMO-Client (2).zip

2015-05-17 16:12 - 2015-05-17 16:12 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Sonic7

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\Program Files\WEB.DE MailCheck

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck

2015-05-14 20:59 - 2015-05-14 20:59 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Steam

2015-05-14 20:50 - 2015-06-08 16:51 - 00000000 ____D C:\Program Files (x86)\Steam

2015-05-14 20:50 - 2015-05-14 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2015-05-14 20:47 - 2015-05-14 20:47 - 01142128 _____ C:\Users\Undertaker\Downloads\SteamSetup.exe

2015-05-14 19:49 - 2015-05-14 19:49 - 00000000 ____D C:\ProgramData\UUdb

2015-05-14 09:38 - 2015-06-06 13:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-08 22:31 - 2014-01-02 17:54 - 00000000 ____D C:\FRST

2015-06-08 22:30 - 2015-04-14 19:11 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-06-08 22:30 - 2013-04-20 10:22 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-06-08 22:30 - 2012-12-04 14:05 - 00000948 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000UA.job

2015-06-08 22:30 - 2011-10-20 01:52 - 01271534 _____ C:\windows\WindowsUpdate.log

2015-06-08 17:02 - 2009-07-14 06:45 - 00028624 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-08 17:02 - 2009-07-14 06:45 - 00028624 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-08 16:56 - 2014-04-11 20:58 - 00000000 ____D C:\Users\Undertaker\AppData\Local\LogMeIn Hamachi

2015-06-08 16:55 - 2014-07-25 18:13 - 00000000 ___RD C:\Users\Undertaker\Dropbox

2015-06-08 16:55 - 2014-07-25 18:11 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Dropbox

2015-06-08 16:50 - 2014-05-22 17:16 - 00000008 __RSH C:\ProgramData\ntuser.pol

2015-06-08 16:50 - 2013-04-20 10:22 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-06-08 16:50 - 2013-04-06 00:59 - 00080197 _____ C:\windows\setupact.log

2015-06-08 16:50 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-06-08 16:49 - 2013-04-06 00:52 - 01088286 _____ C:\windows\PFRO.log

2015-06-08 16:28 - 2012-12-04 14:05 - 00000926 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000Core.job

2015-06-08 15:58 - 2009-07-14 05:20 - 00000000 ___HD C:\windows\system32\GroupPolicy

2015-06-08 15:58 - 2009-07-14 05:20 - 00000000 ____D C:\windows\SysWOW64\GroupPolicy

2015-06-07 22:50 - 2013-04-07 15:58 - 00000000 ____D C:\windows\ERUNT

2015-06-07 21:35 - 2014-05-22 19:43 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-06-07 21:06 - 2012-10-30 15:16 - 00000000 ____D C:\Users\Undertaker

2015-06-07 20:51 - 2013-03-28 23:41 - 00000000 ____D C:\Users\Undertaker\AppData\Local\CrashDumps

2015-06-07 19:09 - 2012-11-05 13:32 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Skype

2015-06-06 23:28 - 2014-05-22 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-06-06 23:28 - 2014-05-22 19:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-06-06 22:58 - 2012-10-30 16:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-06-06 22:56 - 2012-10-30 16:18 - 00000000 ____D C:\Program Files (x86)\Avira

2015-06-06 22:44 - 2012-10-30 16:18 - 00000000 ____D C:\ProgramData\Avira

2015-06-06 22:43 - 2012-12-06 16:46 - 00000000 ____D C:\windows\Minidump

2015-06-06 12:46 - 2015-04-17 20:10 - 00002568 _____ C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC Universe Online.lnk

2015-06-06 12:46 - 2015-02-01 15:26 - 00001761 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-06-06 12:46 - 2015-01-28 20:02 - 00001242 _____ C:\Users\Undertaker\Desktop\Revo Uninstaller.lnk

2015-06-06 12:46 - 2014-08-14 23:40 - 00001415 _____ C:\Users\Shari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-06-06 12:46 - 2014-05-19 11:26 - 00002190 _____ C:\Users\Public\Desktop\Google Earth.lnk

2015-06-06 12:46 - 2013-08-12 21:43 - 00002096 _____ C:\Users\Public\Desktop\Video Search.lnk

2015-06-06 12:46 - 2012-11-24 13:01 - 00001426 _____ C:\Users\Undertaker\Desktop\Registry kostenlos entrümpeln!.lnk

2015-06-06 12:46 - 2012-11-04 12:00 - 00001768 _____ C:\Users\Public\Desktop\Browserwahl.lnk

2015-06-06 11:18 - 2012-11-06 14:44 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\.minecraft

2015-05-24 18:06 - 2011-10-20 01:00 - 00700134 _____ C:\windows\system32\perfh007.dat

2015-05-24 18:06 - 2011-10-20 01:00 - 00149984 _____ C:\windows\system32\perfc007.dat

2015-05-24 18:06 - 2009-07-14 07:13 - 01622236 _____ C:\windows\system32\PerfStringBackup.INI

2015-05-22 20:33 - 2015-02-18 15:50 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\vlc

2015-05-17 15:47 - 2013-04-20 10:22 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-05-17 15:47 - 2013-04-20 10:22 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-05-16 13:54 - 2012-10-30 16:02 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Adobe

2015-05-15 20:08 - 2013-03-14 21:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-05-15 20:08 - 2013-03-14 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-05-15 15:41 - 2012-11-08 16:36 - 01649854 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2015-05-15 15:41 - 2012-11-08 16:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client

2015-05-15 15:40 - 2014-07-10 17:17 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-05-15 15:40 - 2013-07-31 20:03 - 00000000 ____D C:\windows\system32\MRT

2015-05-15 15:12 - 2012-11-08 16:16 - 140425016 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-05-15 15:06 - 2013-03-14 21:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-05-14 19:49 - 2013-05-10 12:24 - 00003892 _____ C:\windows\System32\Tasks\Registration 1und1 Task

2015-05-14 19:49 - 2013-05-10 12:24 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung

2015-05-14 09:38 - 2013-04-20 10:22 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Google

2015-05-14 09:38 - 2013-04-20 10:22 - 00000000 ____D C:\Program Files (x86)\Google

2015-05-13 16:36 - 2014-07-25 18:12 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
 

==================== Files in the root of some directories =======
 

2013-03-28 23:41 - 2013-03-28 23:41 - 0003584 _____ () C:\Users\Undertaker\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-03-04 22:26 - 2014-03-04 22:26 - 0091848 _____ () C:\Users\Undertaker\AppData\Local\ext_offermosquito_uninst.exe

2013-02-28 21:15 - 2014-03-14 14:34 - 1145382 ____N () C:\Users\Undertaker\AppData\Local\Tempmusic.ogg

2011-10-19 10:21 - 2011-10-19 10:22 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log

2011-10-19 10:07 - 2011-10-19 10:08 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log

2011-10-19 10:15 - 2011-10-19 10:17 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log

2011-10-19 10:09 - 2011-10-19 10:15 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log

2011-10-19 10:17 - 2011-10-19 10:21 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
 

Some files in TEMP:

====================

C:\Users\Undertaker\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxjwbg_.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-06-03 22:57
 

==================== End of log ============================

--- --- ---

[CODE]Additional
FRST Logfile:

Code:

scan result of Farbar Recovery Scan Tool (x64) Version:06-06-2015

Ran by Undertaker at 2015-06-08 22:32:32

Running from C:\Users\Undertaker\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Accounts: =============================
 

Administrator (S-1-5-21-1335839233-2991384071-368375801-500 - Administrator - Disabled)

Gast (S-1-5-21-1335839233-2991384071-368375801-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1335839233-2991384071-368375801-1005 - Limited - Enabled)

Shari (S-1-5-21-1335839233-2991384071-368375801-1001 - Limited - Enabled) => C:\Users\Shari

Undertaker (S-1-5-21-1335839233-2991384071-368375801-1000 - Administrator - Enabled) => C:\Users\Undertaker
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden

„Windows Live Messenger“ (x32 Version: 15.4.3538.0513 - „Microsoft Corporation“) Hidden

„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

7-Zip 9.38 beta (HKLM-x32\...\7-Zip) (Version:  - )

Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden

Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Atheros)

ATI Catalyst Install Manager (HKLM\...\{2E26B067-B10A-683A-7E84-5813500EE3B0}) (Version: 3.0.820.0 - ATI Technologies, Inc.)

aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 2.9.1390 - DsNET Corp)

Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)

Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden

Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 13.0.0.2735 - Avira)

BatteryLifeExtender (HKLM-x32\...\{FFD0E594-823B-4E2B-B680-720B3C852588}) (Version: 1.0.11 - Samsung)

Battlefield Heroes (HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}) (Version:  - EA Digital illusions)

Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.55 - Broadcom Corporation)

Build-a-lot (x32 Version: 2.2.0.82 - WildTangent) Hidden

Camtasia Studio 8 (HKLM-x32\...\{8F6F7194-0734-4CDA-8C04-6B766F2241A6}) (Version: 8.0.4.1060 - TechSmith Corporation)

Cassiopesa (HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Chromium) (Version: 45.0.2422.0 - Chromium)

Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2227 - CyberLink Corp.)

CyberLink Media+ Player10 (HKLM-x32\...\InstallShield_{34FBC7C4-CD31-4D93-A428-0E524EAC4586}) (Version: 10.0.1110.00 - CyberLink Corp.)

CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1130a - CyberLink Corp.)

CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)

CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3306 - CyberLink Corp.)

CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3509 - CyberLink Corp.)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Das gelobte Land (HKLM-x32\...\Das gelobte Land) (Version: 1.0.0.0 - INTENIUM GmbH)

DC Universe Online (HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\SOE-DC Universe Online) (Version: 1.0.3.183 - Sony Online Entertainment)

DEUTSCHLAND SPIELT GAME CENTER (HKLM-x32\...\DSGPlayer) (Version: 1.0.0.46 - INTENIUM GmbH)

Die Siedler 7 (HKLM-x32\...\{63860309-DA8A-4BAE-9EAE-CE1D6D79340C}) (Version: 1.12.1396 - Ubisoft)

Die Siedler III Gold Edition (HKLM-x32\...\S3) (Version:  - )

Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden

Dropbox (HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Dropbox) (Version: 3.4.6 - Dropbox, Inc.)

Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)

Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)

Easy Migration (HKLM-x32\...\{AD86049C-3D9C-43E1-BE73-643F57D83D50}) (Version: 1.0 - Samsung Electronics Co., Ltd.)

Easy Network Manager (HKLM-x32\...\{8732818E-CA78-4ACB-B077-22311BF4C0E4}) (Version: 4.4.7 - Samsung)

Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)

EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)

EasyFileShare (HKLM-x32\...\{16880765-677F-440B-B16A-BFD9B9C00012}) (Version: 1.0.12 - Samsung)

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

ETDWare PS/2-X64 8.0.7.2_WHQL (HKLM\...\Elantech) (Version: 8.0.7.2 - ELAN Microelectronic Corp.)

Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)

Farm Frenzy (x32 Version: 2.2.0.82 - WildTangent) Hidden

Fast Start (HKLM-x32\...\{77F45ECD-FAFC-45A8-8896-CFFB139DAAA3}) (Version: 2.2.0.1 - SAMSUNG)

Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{39AB2E37-1A55-4292-A5D3-971E9F70D0F8}) (Version: 2.1.32.0 - MAGIX AG)

Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)

Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden

Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)

iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)

Java 7 Update 75 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)

John Deere Drive Green (x32 Version: 2.2.0.82 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.227 - LogMeIn, Inc.)

LogMeIn Hamachi (x32 Version: 2.2.0.227 - LogMeIn, Inc.) Hidden

MAGIX Speed burnR (MSI) (HKLM-x32\...\MAGIX_{6C855B1C-FC55-4A00-9CCB-5ED6DB8770BF}) (Version: 7.0.2.6 - MAGIX AG)

MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX AG) Hidden

MAGIX Video deluxe 2014 Plus (HKLM-x32\...\MX.{9E2FEB28-7407-4009-9DC4-203EF2EF6BB7}) (Version: 13.0.0.28 - MAGIX AG)

MAGIX Video deluxe 2014 Plus (Version: 13.0.0.28 - MAGIX AG) Hidden

Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

Multimedia POP (HKLM-x32\...\{331ECF61-69AF-4F57-AC35-AFED610231C3}) (Version: 1.0 - )

MyFreeCodec (HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\MyFreeCodec) (Version:  - )

NAVIGON Fresh 3.4.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.4.1 - NAVIGON)

Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)

Opera Stable 29.0.1795.60 (HKLM-x32\...\Opera 29.0.1795.60) (Version: 29.0.1795.60 - Opera Software ASA)

PaintTool SAI Ver.1 (HKLM-x32\...\PaintToolSAI) (Version:  - )

Peggle (x32 Version: 2.2.0.82 - WildTangent) Hidden

Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden

PhoneShare (HKLM-x32\...\{3F50512F-53DF-46B1-8CCB-6C7E638CADD6}) (Version: 9.1.4 - Samsung)

Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden

Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Polar Golfer (x32 Version: 2.2.0.82 - WildTangent) Hidden

Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Project 64 version 2.2.0.3 (HKLM-x32\...\{BEB5FB69-4080-466F-96C4-F15DF271718B}_is1) (Version: 2.2.0.3 - )

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.40.126.2011 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6400 - Realtek Semiconductor Corp.)

Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)

Samsung AnyWeb Print (HKLM-x32\...\{318DBE01-1E6B-4243-84B0-210391FE789A}) (Version: 2.0.67.1 - Samsung Electronics Co., Ltd.)

Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.)

Samsung Kies (x32 Version: 2.5.2.13021_10 - Samsung Electronics Co., Ltd.) Hidden

Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version:  - Samsung Electronics Co., Ltd.)

Samsung Recovery Solution 5 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 5.0.0.10 - Samsung)

Samsung Support Center 1.0 (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.38 - Samsung)

Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.02.05.00:27 - Samsung Electronics Co., Ltd.)

Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.5.0 - Samsung Electronics Co., Ltd.)

Samsung Update Plus (HKLM-x32\...\{142D8CA7-2C6F-45A7-83E3-099AAFD99133}) (Version: 3.0.0.17 - Samsung Electronics Co., Ltd.)

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)

Secunia PSI (3.0.0.10004) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.10004 - Secunia)

Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

Solars Abenteuer (HKLM-x32\...\Solars Abenteuer) (Version: 1.0.0.0 - INTENIUM GmbH)

Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)

Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden

User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.7 - )

WEB.DE Desktop Icons (HKLM-x32\...\1&1 Mail & Media GmbH 1und1DesktopIconsInstaller) (Version: 3.0.5.0 - 1&1 Mail & Media GmbH)

WEB.DE MailCheck für Internet Explorer (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar IE8) (Version: 2.6.3.1 - 1&1 Mail & Media GmbH)

WEB.DE Softwareaktualisierung (HKLM-x32\...\1&1 Mail & Media GmbH 1und1Softwareaktualisierung) (Version: 3.0.3.0 - 1&1 Mail & Media GmbH)

WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.1.5 - WildTangent)

WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-samsung) (Version: 4.0.11.14 - WildTangent)

WildTangent Games App (HKLM-x32\...\{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-wildgames) (Version: 4.0.10.5 - WildTangent)

WindeskWinsearch 1.0 (HKLM-x32\...\WindeskWinsearch) (Version: 1.0 - PCSoftware)

Windows Live 程式集 (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)

WordCaptureX Pro (HKLM-x32\...\{139C1D95-9037-3AB3-F5F4-4A79BF6831EC}) (Version: 4.0.0 - Deskperience)

Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden

Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
 

==================== Custom CLSID (Whitelisted): ==========================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\inminet\sencolny.dll No File <==== ATTENTION

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
 

==================== Restore Points =========================
 

04-06-2015 23:58:02 Windows Update

05-06-2015 15:00:33 Windows Update

05-06-2015 23:36:42 Windows Update

06-06-2015 13:21:50 Uniblue SpeedUpMyPC installation

06-06-2015 13:22:08 Uniblue DriverScanner installation

06-06-2015 15:04:17 Windows Update

07-06-2015 20:42:44 Revo Uninstaller's restore point - Crossbrowse

07-06-2015 20:49:32 Revo Uninstaller's restore point - Internet Speed Tracker Internet Explorer Toolbar

07-06-2015 20:51:03 Revo Uninstaller's restore point - MediaPlayerVid2.4

07-06-2015 20:59:59 Revo Uninstaller's restore point - Optimizer Pro v3.2

07-06-2015 21:23:00 Windows-Sicherung

08-06-2015 13:10:24 zoek.exe restore point

08-06-2015 15:02:30 Windows Update
 

==================== Hosts content: ===============================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (Whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

Task: {0524867D-A169-481C-9A0C-198C6518875D} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)

Task: {078FFB22-9015-49A6-B981-89BC1A8126BA} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)

Task: {0BAA9BE4-9E38-44C2-A618-7F4ADEDA6DEC} - \Advanced System~Protector No Task File <==== ATTENTION

Task: {0F80DD36-32C6-459D-9D85-B556EC5B9523} - System32\Tasks\Registration 1und1 Task => C:\Program Files (x86)\1und1Softwareaktualisierung\cdsupdclient.exe [2015-01-12] (1&1 Mail & Media GmbH)

Task: {11AB16B9-224A-4B50-A8A2-0B0F05E26B70} - \Advanced System~Protector_startup No Task File <==== ATTENTION

Task: {39BCE7A0-D484-495A-B44E-E60340DE59F1} - System32\Tasks\{97BF6DCC-9FA9-46AE-AB8A-6B23DCEE672D} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.2.59.106/de/abandoninstall?page=tsProgressBar

Task: {4BBBFDEA-A4B6-4446-9011-E27435109445} - \Nropnumipre No Task File <==== ATTENTION

Task: {4F235196-2FB6-4427-8CD7-E97414AF1BC6} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)

Task: {5698F9C1-AB3B-43DC-B9DF-85285797AE4E} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000Core => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-25] (Facebook Inc.)

Task: {5B23A2EB-32F1-4969-BBA0-7C130F2B082D} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000UA => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-25] (Facebook Inc.)

Task: {5C2A08F4-45A8-4038-A631-14C64CBD25CC} - System32\Tasks\{CFD54570-C1FD-4FD8-A2A8-5AC5940FC6A2} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.3.59.107/de/abandoninstall?page=tsProgressBar

Task: {6681E283-1040-428E-A69C-D57A35C8396C} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2010-08-27] (Samsung Electronics)

Task: {6781603E-58F0-4C02-A068-E46ACA760AEC} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)

Task: {702C8509-0379-4DA2-AB52-66B5F1D28721} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe

Task: {76DC9DCF-086C-4A56-84EE-6B3B33B3E369} - \avabvbyvyc No Task File <==== ATTENTION

Task: {82C66057-B32C-448C-967C-5A0D0518D2DC} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)

Task: {961ACA20-0E01-4988-98AC-14A6FCECFC92} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)

Task: {B849DBD8-E301-4A41-A5B4-59104FA39CC8} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-09-04] (SAMSUNG Electronics)

Task: {B9EC978F-E5F4-4913-8C14-555536BC0FED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-23] (Google Inc.)

Task: {BABA9B97-7BE3-468C-A9A5-48890FF536AC} - System32\Tasks\{3675E0E0-9D70-4AFD-BB54-ED930B6B0AC7} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar

Task: {BFE3F5FD-FF42-44D4-96A9-63B74E0C6185} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)

Task: {D40E18CC-F78C-4889-B1EC-FE1EEE779F6B} - System32\Tasks\Opera scheduled Autoupdate 1433586837 => C:\Program Files (x86)\Opera\launcher.exe [2015-05-18] (Opera Software)

Task: {D6C18B2E-F7D3-41CF-9121-0F9F08632AFF} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)

Task: {DC15ED03-753C-42A7-A9EA-0D22610D8965} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)

Task: {DEE6CBD1-045A-46CB-97B6-C85EEC4331DF} - System32\Tasks\{3B277F02-A186-4B0D-ADE2-DB67C0D2B029} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsPlugin

Task: {E28C6E1A-A2E7-4705-B9E7-203E113D75D6} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)

Task: {EA29D57E-8D8E-4584-81A6-53C32CD1DF32} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)

Task: {F131EF3B-7615-4D31-9575-C8CF3EA5218A} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000Core.job => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000UA.job => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 

==================== Loaded Modules (Whitelisted) ==============
 

2011-10-20 00:34 - 2008-06-05 01:53 - 00027648 _____ () C:\windows\System32\spd__l.dll

2011-03-22 23:23 - 2011-03-22 23:23 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll

2015-06-06 13:16 - 2015-06-06 13:16 - 00408576 _____ () c:\windows\meud.exe

2013-03-11 18:10 - 2013-03-11 18:10 - 00075136 _____ () C:\windows\SysWOW64\PnkBstrA.exe

2013-03-11 18:11 - 2013-03-11 18:11 - 00189248 _____ () C:\windows\SysWOW64\PnkBstrB.exe

2011-10-19 10:15 - 2009-12-01 09:21 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

2011-03-22 23:23 - 2011-03-22 23:23 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll

2011-03-17 13:54 - 2011-03-17 13:54 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2011-03-22 23:14 - 2011-03-22 23:14 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2011-10-20 00:34 - 2010-10-21 20:22 - 00709632 _____ () C:\windows\system32\SnMinDrv.dll

2015-06-06 12:33 - 2015-05-18 09:33 - 00479352 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\opera_crashreporter.exe

2015-06-06 22:57 - 2012-09-19 19:17 - 00397088 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll

2014-10-11 14:06 - 2014-10-11 14:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll

2014-10-11 14:05 - 2014-10-11 14:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll

2011-10-19 10:29 - 2006-08-12 05:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll

2011-10-19 10:32 - 2010-07-05 12:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll

2015-05-14 20:57 - 2015-04-16 19:40 - 00776192 _____ () C:\Program Files (x86)\Steam\SDL2.dll

2015-05-14 20:57 - 2015-04-23 04:16 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll

2015-05-14 20:57 - 2015-04-23 04:16 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll

2015-05-14 20:57 - 2015-04-23 04:16 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll

2015-05-14 20:57 - 2015-06-04 20:56 - 02407104 _____ () C:\Program Files (x86)\Steam\video.dll

2015-05-14 20:57 - 2014-12-01 23:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll

2015-05-14 20:57 - 2014-12-01 23:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll

2015-05-14 20:57 - 2014-12-01 23:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll

2015-05-14 20:57 - 2014-12-01 23:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll

2015-05-14 20:57 - 2014-12-01 23:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll

2015-05-14 20:57 - 2015-06-04 20:56 - 00703168 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL

2015-06-08 16:52 - 2015-06-08 16:52 - 00043008 _____ () c:\Users\Undertaker\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxjwbg_.dll

2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\libGLESv2.dll

2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\libEGL.dll

2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll

2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll

2011-10-19 10:37 - 2010-05-07 16:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll

2009-11-02 07:20 - 2009-11-02 07:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll

2009-11-02 07:23 - 2009-11-02 07:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll

2015-05-14 20:57 - 2015-05-11 21:01 - 36302728 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll

2015-06-06 12:33 - 2015-05-18 09:33 - 01576568 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\libglesv2.dll

2015-06-06 12:33 - 2015-05-18 09:33 - 00081016 _____ () C:\Program Files (x86)\Opera\29.0.1795.60\libegl.dll
 

==================== Alternate Data Streams (Whitelisted) =========
 

(If an entry is included in the fixlist, only the ADS will be removed.)
 
 

==================== Safe Mode (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
 

==================== EXE Association (Whitelisted) ===============
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
 
 

==================== Internet Explorer trusted/restricted ===============
 

(If an entry is included in the fixlist, it will be removed from the registry.)
 

IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com

IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com

IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com

IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
 
 

==================== Other Areas ============================
 

(Currently there is no automatic fix for this section.)
 

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 192.168.2.1
 

==================== MSCONFIG/TASK MANAGER disabled items ==
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^Users^Undertaker^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk => C:\windows\pss\Facebook Messenger.lnk.Startup

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
 

==================== FirewallRules (Whitelisted) ===============
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

FirewallRules: [{69BDB9F9-4084-4D44-A408-5D5FE40CF854}] => (Allow) C:\Windows\System32\SUPDSvc.exe

FirewallRules: [{FE959C3C-AD73-4AEC-9D6C-0382232E663B}] => (Allow) C:\Windows\System32\SUPDSvc.exe

FirewallRules: [{FC7980E9-4F80-4F36-9466-37B9A18652E6}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\USDAgent.exe

FirewallRules: [{9AC24AFC-1BF5-4550-A687-2B03E4D5F7EB}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\USDAgent.exe

FirewallRules: [{AF3C80FD-369B-4DE2-ABCA-934544A40985}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe

FirewallRules: [{B3244C98-C00B-437F-8C3F-A653AAE803C0}] => (Allow) C:\Program Files (x86)\Samsung\Samsung Universal Scan Driver\ICCUpdater.exe

FirewallRules: [{D926F69B-70A3-42FD-A82C-C21EA696C819}] => (Allow) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10.exe

FirewallRules: [{36998318-A317-4EE4-8BB0-ED2245DB0DAF}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector\PDR8.EXE

FirewallRules: [{0160FD72-79D0-4FE8-B6DB-3181E6E3CBE0}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{8C945DD0-F9BF-4C19-B632-B18CE8FFF439}] => (Allow) LPort=2869

FirewallRules: [{E90973CD-FEBC-4B40-A35A-418E0E6164EE}] => (Allow) LPort=1900

FirewallRules: [{11BE53A1-B067-414F-962B-688BDAEA90FC}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

FirewallRules: [{2351B83C-CD9C-4C31-997C-3E4FC795B431}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe

FirewallRules: [{953D920C-56D5-4106-927D-F29E2AABE47D}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe

FirewallRules: [{3ED98E91-4DF3-4C25-AAE7-84551A641822}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe

FirewallRules: [{A067DEAC-2786-4A1D-8FED-55786BF80DF5}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe

FirewallRules: [{0E1F33F9-FFFC-4EA9-957C-55413CEDBD7D}] => (Allow) C:\Program Files (x86)\Ubisoft\Die Siedler 7\Data\Base\_Dbg\Bin\Release\Settlers7R.exe

FirewallRules: [{192BCA4F-2430-4ECC-A96A-E46E6EB05CA9}] => (Allow) C:\Program Files (x86)\Ubisoft\Die Siedler 7\Data\Base\_Dbg\Bin\Release\Settlers7R.exe

FirewallRules: [TCP Query User{B70B6E17-CD33-46E6-A570-EAF636D3C294}C:\program files\java\jre7\bin\java.exe] => (Block) C:\program files\java\jre7\bin\java.exe

FirewallRules: [UDP Query User{45DF2DF0-3B0B-4D43-AFF8-40DE415CDA28}C:\program files\java\jre7\bin\java.exe] => (Block) C:\program files\java\jre7\bin\java.exe

FirewallRules: [{94D83E91-1604-48D8-9EC3-0FDC56418E56}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe

FirewallRules: [{3C994419-F358-45CF-AFDF-46C91CD67A81}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe

FirewallRules: [{ECF686B6-6C0C-4FCC-A4FD-2B0F477EC990}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe

FirewallRules: [{24A2554D-2084-4082-8512-CDA23EED4381}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe

FirewallRules: [TCP Query User{081C2F5B-D6F6-44A4-8176-97E60F4B16D2}C:\users\undertaker\documents\ch@rly's slender ordner\bfheroes.exe] => (Block) C:\users\undertaker\documents\ch@rly's slender ordner\bfheroes.exe

FirewallRules: [UDP Query User{26556202-FEED-4F64-B211-BC94565F68D8}C:\users\undertaker\documents\ch@rly's slender ordner\bfheroes.exe] => (Block) C:\users\undertaker\documents\ch@rly's slender ordner\bfheroes.exe

FirewallRules: [TCP Query User{97900300-DF4D-4EBD-8C1E-AF5E53DFE6B7}C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe] => (Block) C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe

FirewallRules: [UDP Query User{9F4AE699-B9A0-4A6B-A4A9-B80E9090B895}C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe] => (Block) C:\program files (x86)\ubisoft\die siedler 7\data\base\_dbg\bin\release\settlers7r.exe

FirewallRules: [{CDD94AB4-D039-499F-AFC9-3E86919EC8BE}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{D16186FC-E02D-4A6C-9B52-3A35A4B31C41}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{D35450C6-F433-4A2F-90C5-D5CF46954119}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{8382DF1B-EDAD-4EC1-9026-379B3BCEEF61}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [TCP Query User{8318945D-F0E7-4D0C-BCBC-5CC9346F6BCA}C:\program files (x86)\java\jre7\bin\java.exe] => (Allow) C:\program files (x86)\java\jre7\bin\java.exe

FirewallRules: [UDP Query User{3214A147-E3B8-4F85-99A7-7EDC6841C740}C:\program files (x86)\java\jre7\bin\java.exe] => (Allow) C:\program files (x86)\java\jre7\bin\java.exe

FirewallRules: [TCP Query User{01C1D2AA-8E50-485A-8888-11A54A13AFFC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{7D43924B-1C4A-4BB4-9911-8E88B9DEE30D}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe

FirewallRules: [TCP Query User{1F45F5AF-987F-48C5-A065-57E5F524D51F}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe

FirewallRules: [UDP Query User{B435329B-9824-4597-803D-58D26AB856EC}C:\program files (x86)\java\jre7\bin\javaw.exe] => (Block) C:\program files (x86)\java\jre7\bin\javaw.exe

FirewallRules: [{592AF29C-2507-4B9A-BCA4-C4419F86862F}] => (Allow) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{07624F6D-D913-46F9-B23E-CD69AE0D4B17}] => (Allow) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{9BD9D9E4-CD8C-4E9A-8D4D-214823E32EF8}] => (Allow) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{851329BD-31B5-4EFC-BEBD-AF10F18B69B5}] => (Allow) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

FirewallRules: [{B16AAB12-FADC-4F35-BA9B-E8A71F6F8002}] => (Allow) C:\Users\Undertaker\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe

FirewallRules: [{3962AD47-42E6-48C5-A9F7-D79F3E94422A}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe

FirewallRules: [{5A133F43-F128-4CB3-8D04-B22A974CC9BF}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{341B296C-CB62-4911-8DB5-778FF6107847}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{66347507-7ED5-48BB-AF6E-F5A80DBE3B01}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{2B9D989B-FC96-4CBA-8B2B-5629C8EBACD4}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe

FirewallRules: [{698CA28B-DF46-4053-AEBA-EAA520076E0B}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

FirewallRules: [{6FE78FE6-2761-4A32-9691-63E29F53CCC6}] => (Allow) C:\Users\Undertaker\AppData\Local\Chromium\Application\chrome.exe
 

==================== Faulty Device Manager Devices =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (06/08/2015 08:34:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 8206
 

Error: (06/08/2015 08:34:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 8206
 

Error: (06/08/2015 08:34:47 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/08/2015 06:08:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 7753
 

Error: (06/08/2015 06:08:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 7753
 

Error: (06/08/2015 06:08:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (06/08/2015 04:51:30 PM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (06/08/2015 01:07:58 PM) (Source: SideBySide) (EventID: 80) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in

Manifest- oder Richtliniendatei "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit

einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Komponente 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (06/07/2015 11:29:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 13400
 

Error: (06/07/2015 11:29:25 PM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 13400
 
 

System errors:

=============

Error: (06/08/2015 04:55:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Google Update-Dienst (gupdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (06/08/2015 04:55:09 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Google Update-Dienst (gupdate) erreicht.
 

Error: (06/08/2015 04:53:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1053
 

Error: (06/08/2015 04:53:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )

Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.
 

Error: (06/08/2015 04:50:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%1275
 

Error: (06/08/2015 04:50:06 PM) (Source: Application Popup) (EventID: 875) (User: )

Description: Treiber atksgt.sys konnte nicht geladen werden.
 

Error: (06/08/2015 03:37:35 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)

Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070bc9 fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB3006137)
 

Error: (06/08/2015 03:09:42 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)

Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8007054f fehlgeschlagen: Update für Windows 7 für x64-basierte Systeme (KB3035583)
 

Error: (06/08/2015 02:01:37 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 

Error: (06/08/2015 02:01:37 PM) (Source: Service Control Manager) (EventID: 7030) (User: )

Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
 
 

Microsoft Office:

=========================
 

==================== Memory info =========================== 
 

Processor: AMD E-450 APU with Radeon(tm) HD Graphics

Percentage of memory in use: 17%

Total physical RAM: 8172.05 MB

Available physical RAM: 6749.74 MB

Total Pagefile: 16342.29 MB

Available Pagefile: 13519.98 MB

Total Virtual: 8192 MB

Available Virtual: 8191.85 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:365 GB) (Free:123.73 GB) NTFS

Drive d: () (Fixed) (Total:544.44 GB) (Free:0 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 931.5 GB) (Disk ID: DBCA14F4)

Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=365 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=544.4 GB) - (Type=OF Extended)

Partition 4: (Not Active) - (Size=22 GB) - (Type=27)
 

==================== End of log ============================

--- --- ---

Ich habe mir vorher Mozilla runtergezogen, aber moch nicht installiert, da ich mit dem Opera nicht so ganz klar komme. Ich hoffe, dass das kein Problem war bzw. ist.

Gruß Ani

Wie läuft der Rechner nach diesem Fix:

Schritt 1

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:

Code:

CloseProcesses:

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> 

Task: {0BAA9BE4-9E38-44C2-A618-7F4ADEDA6DEC} - \Advanced System~Protector No Task File 

Task: {11AB16B9-224A-4B50-A8A2-0B0F05E26B70} - \Advanced System~Protector_startup No Task File 

Task: {4BBBFDEA-A4B6-4446-9011-E27435109445} - \Nropnumipre No Task File 

Task: {76DC9DCF-086C-4A56-84EE-6B3B33B3E369} - \avabvbyvyc No Task File 

HKLM-x32\...\Run: [iScreeny] => C:\Users\Undertaker\AppData\Local\iScreeny\iScreeny.exe

C:\Users\Undertaker\AppData\Local\iScreeny

HKLM-x32\...\Run: [iScreeny - Web] => C:\Users\Undertaker\AppData\Local\iScreeny\iWebScreeny.exe

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [GoogleChromeAutoLaunch_DF202E42DFEEF9CE7A049D628287467C] => 

AppInit_DLLs-x32: c:\progra~3\{b37b5~1\1172~1.1\nisi.dll => "c:\progra~3\{b37b5~1\1172~1.1\nisi.dll" File not found

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 

RemoveProxy:

SearchScopes: HKLM -> {9143e921-7c9a-4d27-ac43-eaccc78cc55a} URL = 

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

R2 meud; c:\windows\meud.exe [408576 2015-06-06] () [File not signed]

c:\windows\meud.exe 

R1 iScreeny; C:\windows\iScreeny.sys [50840 2015-03-11] (Windows (R) Win 7 DDK provider)

C:\windows\iScreeny.sys 

CreateRestorePoint:

EmptyTemp:

Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.

Starte FRST und drücke auf den Fix-Button.
Das Tool erstellt eine "Fixlog.txt" -Datei.
Poste mir bitte deren Inhalt.

Hier habe ich das Fixlog

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:06-06-2015

Ran by Undertaker at 2015-06-08 23:17:38 Run:2

Running from C:\Users\Undertaker\Downloads

Loaded Profiles: Undertaker (Available Profiles: Undertaker & Shari)

Boot Mode: Normal

==============================================
 

fixlist content:

*****************

CloseProcesses:

CustomCLSID: HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32 -> 

Task: {0BAA9BE4-9E38-44C2-A618-7F4ADEDA6DEC} - \Advanced System~Protector No Task File 

Task: {11AB16B9-224A-4B50-A8A2-0B0F05E26B70} - \Advanced System~Protector_startup No Task File 

Task: {4BBBFDEA-A4B6-4446-9011-E27435109445} - \Nropnumipre No Task File 

Task: {76DC9DCF-086C-4A56-84EE-6B3B33B3E369} - \avabvbyvyc No Task File 

HKLM-x32\...\Run: [iScreeny] => C:\Users\Undertaker\AppData\Local\iScreeny\iScreeny.exe

C:\Users\Undertaker\AppData\Local\iScreeny

HKLM-x32\...\Run: [iScreeny - Web] => C:\Users\Undertaker\AppData\Local\iScreeny\iWebScreeny.exe

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [GoogleChromeAutoLaunch_DF202E42DFEEF9CE7A049D628287467C] => 

AppInit_DLLs-x32: c:\progra~3\{b37b5~1\1172~1.1\nisi.dll => "c:\progra~3\{b37b5~1\1172~1.1\nisi.dll" File not found

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 

RemoveProxy:

SearchScopes: HKLM -> {9143e921-7c9a-4d27-ac43-eaccc78cc55a} URL = 

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

R2 meud; c:\windows\meud.exe [408576 2015-06-06] () [File not signed]

c:\windows\meud.exe 

R1 iScreeny; C:\windows\iScreeny.sys [50840 2015-03-11] (Windows (R) Win 7 DDK provider)

C:\windows\iScreeny.sys 

CreateRestorePoint:

EmptyTemp:

*****************
 

Processes closed successfully.

"HKU\S-1-5-21-1335839233-2991384071-368375801-1000_Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0BAA9BE4-9E38-44C2-A618-7F4ADEDA6DEC}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0BAA9BE4-9E38-44C2-A618-7F4ADEDA6DEC}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System~Protector" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{11AB16B9-224A-4B50-A8A2-0B0F05E26B70}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{11AB16B9-224A-4B50-A8A2-0B0F05E26B70}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Advanced System~Protector_startup" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{4BBBFDEA-A4B6-4446-9011-E27435109445}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4BBBFDEA-A4B6-4446-9011-E27435109445}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Nropnumipre" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{76DC9DCF-086C-4A56-84EE-6B3B33B3E369}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{76DC9DCF-086C-4A56-84EE-6B3B33B3E369}" => key removed successfully

"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avabvbyvyc" => key removed successfully

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\iScreeny => value removed successfully

"C:\Users\Undertaker\AppData\Local\iScreeny" => File/Folder not found.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\iScreeny - Web => value removed successfully

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\Software\Microsoft\Windows\CurrentVersion\Run\\GoogleChromeAutoLaunch_DF202E42DFEEF9CE7A049D628287467C => value removed successfully

"c:\progra~3\{b37b5~1\1172~1.1\nisi.dll" => value data removed successfully.

"HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
 

========= RemoveProxy: =========
 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value removed successfully

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
 
 

========= End of RemoveProxy: =========
 

"HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9143e921-7c9a-4d27-ac43-eaccc78cc55a}" => key removed successfully

HKCR\CLSID\{9143e921-7c9a-4d27-ac43-eaccc78cc55a} => key not found. 

HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value removed successfully

meud => Service removed successfully

c:\windows\meud.exe => moved successfully.

iScreeny => Service stopped successfully.

iScreeny => Service removed successfully

C:\windows\iScreeny.sys => moved successfully.

Restore point was successfully created.

EmptyTemp: => 119 MB temporary data Removed.
 
 

The system needed a reboot.. 
 

==== End of Fixlog 23:18:29 ====

Nachdem ich den Scan laufen hab lassen, wurde der Lappi heruntergefahren. Beim Hochfahren hat er sich mehrmals wieder ausgeschalten mit dem Vermerk (sinngemäß) dass Windows updates nicht laufen würden und auf den Ausgangspunkt zurückgestellt werden.

Grüße Ani

Ja, ich meinte aber Browser usw. ob die wieder funktionieren...

Schritt 1

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 2

http://filepony.de/icon/frst.png http://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Hallo Jürgen,

kurze Zwischenmeldung. Also es läuft weitaus besser als vorher, aber noch nicht so rund wie es mal war. Das ständig Öffnen div. Internetseiten ist weg. Es arbeitete auch generell wieder bisle schneller.

Eset läuft noch hat aber wieder Dateien gefunden. Sobald es fertig ist schicke ich Dir das Logfile.

Grüße Ani

hier das Eset Logfile

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# engine=22242

# end=stopped

# remove_checked=false

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-01-31 03:39:11

# local_time=2015-01-31 04:39:11 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 8639 288138441 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 93226 174348601 0 0

# scanned=13

# found=0

# cleaned=0

# scan_time=0

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# engine=22242

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-01-31 05:33:21

# local_time=2015-01-31 06:33:21 (+0100, Mitteleuropäische Zeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1810 16777213 100 100 15489 288145291 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 100076 174355451 0 0

# scanned=299520

# found=26

# cleaned=26

# scan_time=6603

sh=6D2D5521F8C15D587F05119C714F0A431D053BE9 ft=1 fh=374f94ddfd2f4cb1 vn="Variante von Win32/Toolbar.MyWebSearch.AH evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\NPp5Stub.dll.vir"

sh=394D5B32C42AD951A2F1BA6E22A3DA2E754ABE98 ft=1 fh=bc9d2deedbf2e121 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5cjpeg.dll.vir"

sh=A358B67DA39C616383A7B0847E642BC54A63ACA0 ft=1 fh=8b6f4c896e14b7f9 vn="Variante von Win32/Toolbar.MyWebSearch.F evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5Html.dll.vir"

sh=3F81A47E189813D42F31DE4BABF42C68CA88F84E ft=1 fh=28f702c6787729c7 vn="Win32/Toolbar.MyWebSearch.AN evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5MedInt.exe.vir"

sh=A872BACD7502C7D8AC5FDED7543D5B948C852545 ft=1 fh=4b9ccd882c594a66 vn="Variante von Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5Plugin.dll.vir"

sh=20A2E417F1D8E36A536364AEE3ADD8102BA5D8AF ft=1 fh=494d20b369828d7b vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5PSSavr.scr.vir"

sh=F9CFC856EE6AE11EED88CE6998B1A576DC23E1EF ft=1 fh=a977d5a1b63af9b9 vn="Variante von Win32/Toolbar.MyWebSearch.P evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5ScrCtr.dll.vir"

sh=DCD600E86218597D57F09717CF881D4C7CAE0BB8 ft=1 fh=051f941197fd4707 vn="Win32/Toolbar.MyWebSearch.AN evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5svc.exe.vir"

sh=A186269377566984B96F190DDEF31C8E7055FDEB ft=1 fh=8a7557b9ae51b8a9 vn="Win32/Toolbar.MyWebSearch.AN evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PopularScreensavers\p5wphook.dll.vir"

sh=BEC6B95D047100118D70D9504479C36A797B9B06 ft=1 fh=e155e3de02881385 vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\TrayDownloader.exe.vir"

sh=BEFC0099864AA52ABB0A3B99793A5A1BF525401D ft=1 fh=64b34719c3735e0d vn="Variante von Win32/ELEX.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\WinZipper\winzipersvc.exe.vir"

sh=E3F8B8FE0BBC22CBB743C688ED79E0BF73FCCFE5 ft=1 fh=a81abe411291deb5 vn="Variante von Win32/Somoto.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Local\FilesFrog Update Checker\update_checker.exe.vir"

sh=3A6B895DC791135C7B424D6A3AB327EB59ED2462 ft=1 fh=f63cb4459345e5cd vn="Win32/AdWare.Snoozer.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Roaming\SCheck\ntdllinst.exe.vir"

sh=2BFAB9A9CA8BA01F9DF0E7BDA6758B7376C9D4F2 ft=1 fh=5eaeac4ca4c59724 vn="Win32/AdWare.Snoozer.A Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Roaming\Snz\Snz.exe.vir"

sh=568B7040522AE31BE5FF0BD450B7D0B7A218E7A1 ft=1 fh=bb7982953e0dc058 vn="Variante von Win32/ELEX.BF evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\UNDERT~1\AppData\Local\Temp\Desk365\eInstall\eInstall.exe.vir"

sh=C940F4029FE46A5F7B471214AC683B5FEBB26831 ft=1 fh=e14799081e7d1361 vn="Variante von Win64/Systweak.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\windows\System32\roboot64.exe.vir"

sh=AAA29097B1E5A7098E19A38F1200E636EE1C3A1E ft=1 fh=6b75069f13c3f94c vn="Win64/AdvancedSystemProtector.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\windows\System32\sasnative64.exe.vir"

sh=20A2E417F1D8E36A536364AEE3ADD8102BA5D8AF ft=1 fh=494d20b369828d7b vn="Win32/Toolbar.MyWebSearch evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\windows\SysWOW64\p5PSSavr.scr.vir"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsbAC51.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsc8D10.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsg9B0.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsqB8DF.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsr122A.exe"

sh=AF92022A73E072242A8B95BC42475BDB244E0A30 ft=1 fh=0f1d648c9e10fd22 vn="Variante von Win32/ELEX.Q evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\fullpackage_temp1388606446\tmp\desk365.exe"

sh=C7241007662586F5DE3A9F9927CFBD9D52A52AC9 ft=1 fh=a7692001af61d921 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsv619A\SpSetup.exe"

sh=B1BDB5FB986F06CD3D267F2CC9AE1DF56CB72604 ft=1 fh=e1fd281970e36a4a vn="Variante von Win32/SoftPulse.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Undertaker\Downloads\New player.exe"

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# end=init

# utc_time=2015-06-06 11:49:52

# local_time=2015-06-06 01:49:52 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 24200

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# end=updated

# utc_time=2015-06-06 11:53:45

# local_time=2015-06-06 01:53:45 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# engine=24200

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-06-06 02:28:07

# local_time=2015-06-06 04:28:07 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 14262 185230737 0 0

# scanned=281012

# found=261

# cleaned=251

# scan_time=9262

sh=3ADED111BA4C362714DD914AF2875D25390F9141 ft=1 fh=960d55973837187f vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung" ac=I fn="C:\Users\All Users\eud\68AF2947C1C44DD293728E1BD02FFCBB\setup.exe"

sh=F5107D4315C28F6E6A0F94CAD8414D0EE4B1B1E5 ft=1 fh=36723e1fa1633655 vn="Variante von Win32/Amonetize.BQ evtl. unerwÃ¼nschte Anwendung" ac=I fn="C:\Users\All Users\eud\8A2D122CC0E547C9B2D0CDBC8A110E13\setup.exe"

sh=DD2277D66E16DCBB318C28D67EAB24716CC149CC ft=1 fh=4e67ba056e2d11ad vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung" ac=I fn="C:\Users\All Users\eud\C5B5185A661540D0BCCB74956D7A231B\setup.exe"

sh=E7864F0EE835B0E9BBBAC4848D77C14AD868FE7F ft=1 fh=b2f90e20e2c55da2 vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung" ac=I fn="C:\Users\All Users\GrcToTxHhyb\xBcGKPMoYeq.exe"

sh=C4E57DAEF690333727FCE6BB1662A8318BCE933E ft=1 fh=5d0cf4788eaffe6b vn="Variante von MSIL/Adware.PullUpdate.P Anwendung" ac=I fn="C:\Users\All Users\Nropnumipre\1.0.1.0\altohria.exe"

sh=DD2277D66E16DCBB318C28D67EAB24716CC149CC ft=1 fh=4e67ba056e2d11ad vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung" ac=I fn="C:\Users\All Users\{274f2602-ce97-2b59-274f-f2602ce9980b}\hqghumeaylnlf.exe"

sh=AFF2FDF60083C588EF8CBC8349DD35EC2A5069E3 ft=1 fh=19efcee151207436 vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung" ac=I fn="C:\Users\All Users\{a7e20bb6-0b0d-9564-a7e2-20bb60b02ed8}\hqghumeaylnlf.exe"

sh=AC597FF4CDB2DDBF589DF3B167DB49829DF30F81 ft=1 fh=3993e54b2ba8c468 vn="Variante von Win32/Adware.ConvertAd.RU Anwendung" ac=I fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOUY1GGG\SearchUpdater[1].exe"

sh=EE2B47CD226597EBCD65966869530E6697CB0F5A ft=1 fh=dfba533877d5a86f vn="Variante von Win32/Adware.EoRezo.AZ Anwendung" ac=I fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WIWZY0KX\setup_gmsd_de[1].exe"

sh=3705670AF8CD8741D870A62B421EC5696A97BEFC ft=1 fh=097437150c7024d4 vn="Mehrere Bedrohungen" ac=I fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y9Y3YUFA\SmartWebInstaller[1].exe"

sh=5B95315844B22672C2E867D8E3D45D9F05ED2016 ft=1 fh=6e4c94e41237e20f vn="Win32/Somoto.Q evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-1335839233-2991384071-368375801-1000\$ROVTBOK.exe"

sh=5B95315844B22672C2E867D8E3D45D9F05ED2016 ft=1 fh=6e4c94e41237e20f vn="Win32/Somoto.Q evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\$Recycle.Bin\S-1-5-21-1335839233-2991384071-368375801-1000\$RVZV6T8.exe"

sh=E2C833EEE68FDD07D916E2EE74A9C4A23BE37DEE ft=1 fh=9e162fcde915f174 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\8hUninstall Allin1Convert.dll"

sh=1AC7049A62CACCF4E8A6D9D1C4E34A94653B1139 ft=1 fh=c71c00115e1ca870 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\588c3280-483f-4ff6-b4ca-8a53e94287ce\6d0d0443-afb0-43a9-82fe-b0e8cd520bf5.dll"

sh=6FE6BF52A63C5B4C81D7CAE588BA9262A4C18ADA ft=1 fh=ec4a48e12e3e07e8 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\588c3280-483f-4ff6-b4ca-8a53e94287ce\836316b1-706d-42d3-a5c0-8dece58f9bae.dll"

sh=1AC7049A62CACCF4E8A6D9D1C4E34A94653B1139 ft=1 fh=c71c00115e1ca870 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\588c3280-483f-4ff6-b4ca-8a53e94287ce\90bb36f8-7662-4aa2-bea7-8de0b6ad1b0b.dll"

sh=CEED135E7F1F511AFD6E9B782FDF35B0026C872D ft=1 fh=c71c001131777565 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\588c3280-483f-4ff6-b4ca-8a53e94287ce\c9740ebb-633b-4061-b991-a34c9d1fb410.dll"

sh=6291A7A68A0EBF8778F0E85FF95F6E52D1416F66 ft=1 fh=c71c0011881e7530 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\588c3280-483f-4ff6-b4ca-8a53e94287ce\da03763f-77f8-424f-9b27-69994d02e853.dll"

sh=CEED135E7F1F511AFD6E9B782FDF35B0026C872D ft=1 fh=c71c001131777565 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\66eb7326-d26b-4ed7-8b75-f11540f0061d\5dd3134a-bd10-462f-8eb6-ae1099b30090.dll"

sh=6FE6BF52A63C5B4C81D7CAE588BA9262A4C18ADA ft=1 fh=ec4a48e12e3e07e8 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\850b14a9-df9b-49e0-86a9-17f782850ec2\2f93031a-0ea8-485f-9e78-d327f9a56056.dll"

sh=E2C833EEE68FDD07D916E2EE74A9C4A23BE37DEE ft=1 fh=9e162fcde915f174 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hbar.dll"

sh=47588E8E5A2034DA062CD6E61D7072809C265366 ft=1 fh=bd6b7f873a46cf67 vn="Variante von Win32/Toolbar.MyWebSearch.AE evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hbarsvc.exe"

sh=4CA4CF526BAB3ACF1E6A649F6AAA232D2AC41868 ft=1 fh=bdd8282939c97a30 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\APPINTEGRATORSTUB.DLL"

sh=D07B6FD168B29CE7BC7DDEC0EEEBA0E005EB9431 ft=1 fh=d76e053361562658 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\AppIntegratorStub64.dll"

sh=6291A7A68A0EBF8778F0E85FF95F6E52D1416F66 ft=1 fh=c71c0011881e7530 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\bcd6e4c4-84bf-4654-934b-210101b6db64\8683a6bd-3a72-4bb7-bb47-48d57993f06d.dll"

sh=4EC929D6BE7D06CB6281EBF70FCE5BE03DDB309C ft=1 fh=c71c0011a7cb1c10 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-1-6.exe"

sh=C20DC31DEEAFC3E32F3835A436364ED12D129259 ft=1 fh=c0004d1523bd152c vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-1-7.exe"

sh=A5DF65AE0903C89CC67F496AA6547B03D5A3381F ft=1 fh=c71c001193cfd791 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-10.exe"

sh=232F19FE4050FB5BCF779B1DF00F8B1A983C2635 ft=1 fh=dc698ee1853e4aff vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-11.exe"

sh=6F156A9DE89A1123345D0F677F284EA96C850560 ft=1 fh=d858145b45a041ce vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-5.exe"

sh=B3768E9F106C3D146B8353F174B5B478C4871858 ft=1 fh=c71c0011c34419d0 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-6.exe"

sh=4B96FCF8156DA318F26F91DD4A2672D97567E6ED ft=1 fh=c71c00110938d088 vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-64.exe"

sh=C20DC31DEEAFC3E32F3835A436364ED12D129259 ft=1 fh=c0004d1523bd152c vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\a0cbec6e-4f75-4f43-a882-1a9edf46b195-7.exe"

sh=1AC7049A62CACCF4E8A6D9D1C4E34A94653B1139 ft=1 fh=c71c00115e1ca870 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\bf248b6a-483a-4ab2-8e4e-8a9b59cf9f54.dll"

sh=A5DF65AE0903C89CC67F496AA6547B03D5A3381F ft=1 fh=c71c001193cfd791 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\UninstallBrw.exe"

sh=5420CB4321794E61E5E9546B94E5080D64E84328 ft=1 fh=bad1f37e5afe25ac vn="Variante von Win32/Toolbar.CrossRider.CM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserApp3.7\utils.exe"

sh=555BB7FF6B3882DF297BFC79630BF4E72985E8A3 ft=1 fh=20854e81e19fb965 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-1-6.exe"

sh=71F08CE80DF58FC854052E420AB2E8DFB90863A3 ft=1 fh=7158980c03886419 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-1-7.exe"

sh=A8FB537498A8E1540071F23D8164D2D548106E24 ft=1 fh=6c64c6fc753e4a4b vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-11.exe"

sh=A8FB537498A8E1540071F23D8164D2D548106E24 ft=1 fh=6c64c6fc753e4a4b vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-3.exe"

sh=C52937D614A2765FCA8DD369957FA0D7ECBD0A7E ft=1 fh=fea6144196165d79 vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-5.exe"

sh=F5F0D5934076971C6AF22DF209FBDDA08008185F ft=1 fh=567c64e8421bcceb vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-6.exe"

sh=B81442BFDC18B0EB001492325C5AAEB1AC7C1EF5 ft=1 fh=a748035b0d25eb19 vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-64.exe"

sh=71F08CE80DF58FC854052E420AB2E8DFB90863A3 ft=1 fh=7158980c03886419 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\6ed91930-41af-4297-8930-5e8db03633db-7.exe"

sh=6FE6BF52A63C5B4C81D7CAE588BA9262A4C18ADA ft=1 fh=ec4a48e12e3e07e8 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\e072eb25-924b-4946-8cfa-49bc20028090.dll"

sh=DCEE285BC4E45E63BF35EE0DA0AA1D3506013B0C ft=1 fh=d736e88561590461 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\UninstallBrw.exe"

sh=31BFC7B2C2D20CEA848EB4CC1A526FBD6F512882 ft=1 fh=8ba551090ae4bb69 vn="Variante von Win32/Toolbar.CrossRider.CM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\BrowserV04.06\utils.exe"

sh=7502B48484E2E0FEC6CF2CDB3342E2F31F6BA58B ft=1 fh=92d319fc306ceca1 vn="Variante von Win32/Toolbar.CrossRider.CN evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\utility.exe"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll"

sh=AA088E332A04E0DA5F642F1DCAF1A7AE5504AE32 ft=1 fh=d57b73a769c2ed5d vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_586\gamesdesktop_widget.exe"

sh=AEF28FDD7E1BD4890C30865E3778387DCD603F7A ft=1 fh=75592af96d7955cf vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_586\gmsd_de_586.exe"

sh=FB9155497AFABD1D6E056B22523315F8128A8B1A ft=1 fh=65f70e9c8673894e vn="Variante von Win32/Adware.EoRezo.AZ Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_586\predm.exe"

sh=2E8E1D4BBA2C0E5AA7CEBA830B571AABB9D564AA ft=1 fh=4945052ca92a18ad vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_592\gamesdesktop_widget.exe"

sh=5297148365BE8A4E908EEEF0AF3FE85ACCC0B993 ft=1 fh=1313b653cee940ef vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_592\gmsd_de_592.exe"

sh=0C51F709CA885624F4BF37CA639A9FFCFF248A89 ft=1 fh=b68934cf7505ed02 vn="Variante von Win32/Adware.EoRezo.AZ Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\gmsd_de_592\predm.exe"

sh=6AA0E22699B2E8D6C644F2CAAED9561DD6229362 ft=1 fh=9e53404adbf6d918 vn="Variante von Win32/Packed.Komodia.A verdÃ¤chtige Datei (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\HighlightSearches\ABDLL.dll"

sh=59CAF453F6EB81A5436F4426C08219E4696B8FCB ft=1 fh=95ae5d39d3ca602c vn="Variante von Win32/Packed.Komodia.A verdÃ¤chtige Datei (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\HighlightSearches\abenginecert.dll"

sh=754B75E6B64D6B01129361DD40BBD3B61EB4D1C6 ft=1 fh=5515f5076d96fb29 vn="Variante von Win32/Packed.Komodia.A verdÃ¤chtige Datei (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\HighlightSearches\abenginewd.dll"

sh=0119B4C28815D7986DA549D5F7DCA0718A9E3FD8 ft=1 fh=4311010adafd499b vn="Win32/Adware.Flinject.A Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\HighlightSearches\iren3006.exe"

sh=E0359B12A990BB29A0DB03E0FEDD5D84FB760EB3 ft=1 fh=600949467ccd7b6e vn="Variante von Win32/Adware.Vitruvian.F Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Infonaut_1.10.0.14\Service\insvc.exe"

sh=E2C833EEE68FDD07D916E2EE74A9C4A23BE37DEE ft=1 fh=9e162fcde915f174 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tbar.dll"

sh=47588E8E5A2034DA062CD6E61D7072809C265366 ft=1 fh=bd6b7f873a46cf67 vn="Variante von Win32/Toolbar.MyWebSearch.AE evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tbarsvc.exe"

sh=9F5A321AE114FC1A18879D9020B858F38D2B3E89 ft=1 fh=bf44e0c89f37d168 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tbprtct.dll"

sh=F099D51F0AD47D96B5A590BCDFC1CC1F8749DD65 ft=1 fh=a780294ee5143a96 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tdatact.dll"

sh=21D7D87AD8231E253747555C0EF523281B301731 ft=1 fh=1ccff04835db7f03 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tdlghk.dll"

sh=B53F3279B1FD544923C76A3DD70A1491C6C771C0 ft=1 fh=f6c7d42c7e589fa1 vn="Variante von Win64/Toolbar.MyWebSearch.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tdlghk64.dll"

sh=A70939B7F5D70B3362AF7E409FE5694CD0332F42 ft=1 fh=52cbc77cb56ac7b3 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tfeedmg.dll"

sh=7A0D74B0F762389FC64212073902C53BAB06EF93 ft=1 fh=45fa6db7aba0514d vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9thighin.exe"

sh=3E6A3D2F7BED9458A6463483C84B5455EB6FD001 ft=1 fh=3d34a9c7920b0ace vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9thkstub.dll"

sh=9EB7640F7FB0B699C6DF75E66C7E8C0D9E21F3CC ft=1 fh=38be5ef24383a5d0 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9thtmlmu.dll"

sh=BDADBCED025A8A20B40049CC17414E198FEF4E81 ft=1 fh=f9bdd3e0e43cc208 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9thttpct.dll"

sh=4CD512C5942F1DEEE5ACB26559BB9FC6B4A8204E ft=1 fh=a878d59d734b935e vn="Variante von Win32/Toolbar.MyWebSearch.AE evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tidle.dll"

sh=60906D0380A0B29D67B153784C4F78432FC99986 ft=1 fh=34ae1a71b9c6839b vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tmedint.exe"

sh=76657B4BFF0FD6BD949A0E15337FBABEFD8AB326 ft=1 fh=cac4f013d6372fb6 vn="Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tmlbtn.dll"

sh=1F72EFEF3BCA27FFF74DBEF4C08762B2D9BA3E15 ft=1 fh=fd2482e65b8791ab vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tPlugin.dll"

sh=99E81D983023608B908F7A8390CE995C253030D7 ft=1 fh=d2071bce09b9bac6 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9treghk.dll"

sh=4BA5E4C514C254C7248F6FA6B540A9ABC2805565 ft=1 fh=273cb58db048e71e vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tregiet.dll"

sh=EDC6F99BCAC6616FC160FE0240F5101580F528D0 ft=1 fh=5f6023e1200c1318 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tscript.dll"

sh=CA89F61D9A80272F560256F312A537F777A87AEF ft=1 fh=d92df48e556aedca vn="Variante von Win32/Toolbar.MyWebSearch.P evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tskin.dll"

sh=77D0C33BAC54A50FB83438215C73F493CD7BBF9E ft=1 fh=d15ef7d26608f47d vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tskplay.exe"

sh=E7A14A77EAAE6CB9FC6CC487B1CE1CB70C063502 ft=1 fh=a479c3fc682024f1 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tSrcAs.dll"

sh=72489280930F183E34FE5AF817F207A5EB65F8D4 ft=1 fh=033eb58713fd33d4 vn="Variante von Win32/Toolbar.MyWebSearch.AA evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9ttpinst.dll"

sh=9736DD448F1751787A8457AFE3D789543A327C9C ft=1 fh=ea966f1845a5c441 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\APPINTEGRATOR.EXE"

sh=A526A314F90D61F8132D8E2DB5982ABBFE022C1D ft=1 fh=3c4a262bc57b3aff vn="Win64/Toolbar.MyWebSearch.D evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\AppIntegrator64.exe"

sh=4CA4CF526BAB3ACF1E6A649F6AAA232D2AC41868 ft=1 fh=bdd8282939c97a30 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\APPINTEGRATORSTUB.DLL"

sh=D07B6FD168B29CE7BC7DDEC0EEEBA0E005EB9431 ft=1 fh=d76e053361562658 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\AppIntegratorStub64.dll"

sh=BAB6681DE94799B603E62C40D171D74C7842FB17 ft=1 fh=33cf14314fda0344 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\ASSISTMONITOR.DLL"

sh=899D23DE4C2379EDFBD2E9FE7F09550771D038D4 ft=1 fh=c3e98bbd9f35c6ba vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\ASSISTMONITOR64.DLL"

sh=2AFE6690FA1CF56D287C31A9857578363F5A2D67 ft=1 fh=027fcd1b6271324d vn="Variante von Win32/Toolbar.MyWebSearch.Z evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\CREXT.DLL"

sh=DF8A6BBA205666A6F7C0ACBDF09BF6E8EB136EA0 ft=1 fh=8cd7f253e514d7ea vn="Win32/Toolbar.MyWebSearch.AR evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\CrExtP9t.exe"

sh=94BC264068D497F6D2042E171E4D044B77028C7B ft=1 fh=93c4f6f450d54597 vn="Win32/Toolbar.MyWebSearch.AR evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\DPNMNGR.DLL"

sh=73FCC496487920A14146D46A787454F89B5F793E ft=1 fh=5386ecf351ab8164 vn="Variante von Win32/Toolbar.MyWebSearch.AO evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\FF-NativeMessagingDispatcher.dll"

sh=811ECD5DF9B0E23850C4204A6DDFB245873559B2 ft=1 fh=eca32475fc9beef3 vn="Win32/Toolbar.MyWebSearch.AR evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\HKFXMGR.DLL"

sh=A6DE9AF875A9AD9D97330755826C48C2B332EA74 ft=1 fh=335223835e132def vn="Win64/Toolbar.MyWebSearch.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\HKFXMGR64.DLL"

sh=C4E4F01CA5F0B4ED10F796C102FF8BDEF6B6B678 ft=1 fh=fba9786493da4386 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\HPG.DLL"

sh=75A91B8490235724542C34E4EA62D4DB8443B7D8 ft=1 fh=02c55ebfd7926ce0 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\Hpg64.dll"

sh=FB594A15D77C57A0E0BB41FB17383D80877E6CEE ft=1 fh=ffe6c0c499ffa4e3 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\T8EPMSUP.DLL"

sh=6DA69E00DCB0DA9D648EB5D63F895ED020447618 ft=1 fh=43b4b1abba357bad vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\T8EXTEX.DLL"

sh=388DD4FF1E3CF6BFCF34DED0C86E154C1D3EE73E ft=1 fh=35048c9d01a08485 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\T8EXTPEX.DLL"

sh=139FBF5145FB3A0FEDA5EE93DF36BE7E00B90817 ft=1 fh=b2180dc33cd50010 vn="Variante von Win32/Toolbar.MyWebSearch.AS evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\T8HTML.DLL"

sh=A187B0341C1444615B4E0D4A6B8BED3F4599CA3A ft=1 fh=b7685368d5405ed9 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\T8TICKER.DLL"

sh=0EB06DF026A32B1CA4B335088948B66247506EAF ft=1 fh=4f153c8941af29df vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\TOOLBARGUARD.DLL"

sh=48873B11EC917BD1358D544DF131C74D0DFAE052 ft=1 fh=38dee7cd1cd56751 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\TOOLBARGUARD64.DLL"

sh=2D869BF4DADFCE0CC46A67F701673D40E9A4AA6F ft=1 fh=56c6eeed92f2e3bb vn="Win32/Toolbar.MyWebSearch.AI evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\TPIMANAGERCONSOLE.EXE"

sh=E5EF5447933372B3B7237635F12D5CD1BE4EF5CC ft=1 fh=b94dd24e0709c2a4 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\VERIFY.DLL"

sh=A6C707660A23BF1CA6AB60D4DE4E60C2BA794976 ft=1 fh=b653663677980fb3 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL"

sh=A66AA13DA54773B2408FF28A24456E959EAFE46D ft=1 fh=86e6eee54614f6c8 vn="Variante von Win64/Toolbar.MyWebSearch.C evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL"

sh=1F5CB72E95336B2FE932CB549E75A2C523D1001C ft=1 fh=560481649e2dfeec vn="Variante von Win32/Toolbar.MyWebSearch.AF evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE"

sh=0A8E345E03D2DA368C1792B4F619F64100BCF6AE ft=1 fh=4d6f7278f0aca2ee vn="Variante von Win32/Toolbar.MyWebSearch.AR evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\assists\ie_enable\ARBITER.DLL"

sh=B5451BCDA721D129822FBB7A40997418F374EB72 ft=1 fh=fc7d835392c3df3e vn="Variante von Win32/Toolbar.MyWebSearch.AR evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\assists\ie_enable\ARBITER64.DLL"

sh=228BC6939045E3838E94C4BA6DEA1389AE3157DB ft=1 fh=c71c0011f3027171 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-1-6.exe"

sh=23546BA52D425D88CC2BEF2FDC9071B527E65F2C ft=1 fh=9c89dd7fd2dc94b7 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-1-7.exe"

sh=B8DD22B2DCFABFA525311208431C82E1230A1B8F ft=1 fh=c71c0011a44a5513 vn="Variante von Win32/Toolbar.CrossRider.CO evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-10.exe"

sh=8DE229683D100878ADA7945FA2DF6D8FE3FAF8B3 ft=1 fh=d4df386475425c90 vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-11.exe"

sh=8DE229683D100878ADA7945FA2DF6D8FE3FAF8B3 ft=1 fh=d4df386475425c90 vn="Variante von Win32/Toolbar.CrossRider.CH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-3.exe"

sh=2275DA2EFA6C448E741D251C45B021CA28612325 ft=1 fh=9ff5ab0ab27e3bc3 vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-5.exe"

sh=E7584B41B14D8F972AB84E0D175F103354937CFD ft=1 fh=c71c00111fa9f3b3 vn="Variante von Win32/Toolbar.CrossRider.BZ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-6.exe"

sh=D5129FD3BCC7CB2A1298D607AD8B1034C9CAF21C ft=1 fh=c71c00114a8ee9ef vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-64.exe"

sh=23546BA52D425D88CC2BEF2FDC9071B527E65F2C ft=1 fh=9c89dd7fd2dc94b7 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\4acdf6a3-65a5-4183-a39b-7753275a47f4-7.exe"

sh=6291A7A68A0EBF8778F0E85FF95F6E52D1416F66 ft=1 fh=c71c0011881e7530 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\a0d4f97f-e246-407d-9a5d-5ccb3dbbaa5f.dll"

sh=C9710DF61C380BBEFAC3F24832F9D69475514098 ft=1 fh=2ec9ed37c69f3be0 vn="Variante von Win32/Toolbar.CrossRider.CM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MediaPlayerVid2.4\utils.exe"

sh=C3DEFA5E775E1CE7EEA8FAE67FA3E504A513DF4F ft=1 fh=eb3ef09612dbcc7f vn="Win32/ELEX.BM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\BrowerWatchCH.dll"

sh=7F80338F92F336DF2F747EE304EA99F98733D7EF ft=1 fh=a20bcc0e72d988a6 vn="Win32/ELEX.BM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\BrowerWatchFF.dll"

sh=5D628376391A827A818B0A079B64EE457AE9B82A ft=1 fh=c71c0011e2e7a7a5 vn="Variante von Win32/ELEX.DH evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\BrowserAction.dll"

sh=34560DDE92CC541AE16932D02887F5CE880DC4C8 ft=1 fh=e95166d450b773b3 vn="Variante von Win32/ELEX.CY evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\CmdShell.exe"

sh=A71D8EBDBF6DB1BF2092D520DBD79481F74F141C ft=1 fh=e8458438005d3d26 vn="Variante von Win32/ELEX.DK evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\HPNotify.exe"

sh=948691DF20AD5F76AEBE6CE8DBA1F967C8B6BD0F ft=1 fh=fe4bd6b5ea25d889 vn="Win32/ELEX.BM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\IeWatchDog.dll"

sh=AD657A3DC5DBF10DF06ED9F94DEF410FCC9429F9 ft=1 fh=ae00004d8419e992 vn="Variante von Win32/Thinknice.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\MiuiTab\SupTab.dll"

sh=D5B50C0B56701CBB4406604706306FC548030192 ft=1 fh=ec0e8afeda570a30 vn="Variante von Win32/Adware.SpeedingUpMyPC.AG Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptimizerPro.exe"

sh=0A515DA6F7C0CADF80716E444B1ED2A2681BF35B ft=1 fh=359901d5daddbd2f vn="Variante von Win32/Adware.SpeedingUpMyPC.AD Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProGuard.exe"

sh=5D01C8785EBEEE4CBEECCA5CA54E9A6AA16EF5D4 ft=1 fh=d622c00b87743adf vn="Variante von Win32/OptimizerPro.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProHelper.dll"

sh=73ACC29929B4149908218C35013C69D6FD423647 ft=1 fh=e36c240e99ee56b1 vn="Variante von Win32/Adware.SpeedingUpMyPC.AC Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProLauncher.exe"

sh=619E1E0E060F79389D8DE26FF9C6E9C871B5A988 ft=1 fh=066910ac89cd5f93 vn="Variante von Win32/Adware.MultiPlug.IX Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProMon.dll"

sh=221EDF8BD77C962A40F74949275D8F5BF3C9E36A ft=1 fh=6ae2997102109d0c vn="Variante von Win32/Adware.SpeedingUpMyPC.AE Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProReminder.exe"

sh=5F1B01599D243FABD4684F230CBD67FAE67A1F8D ft=1 fh=054d731785d682cb vn="Variante von Win32/Adware.SpeedingUpMyPC.AG Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProSchedule.exe"

sh=B482F7A880EAA47FCB467E2C727B7379FB746F7D ft=1 fh=76b7eab4c96c7ab8 vn="Variante von Win32/Adware.SpeedingUpMyPC.AG Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProSmartScan.exe"

sh=C92B61FDA5A2D79DBDB6BEF38EBD8DA24779209B ft=1 fh=508c896cd91f6bd9 vn="Win32/Adware.SpeedingUpMyPC.AG Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProStart.exe"

sh=E6648C7DB90623C3F0244410426ED831FBF2E2EF ft=1 fh=41f9d845935f8e31 vn="Variante von Win32/Adware.SpeedingUpMyPC.AG Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Optimizer Pro 3.95\OptProUninstaller.exe"

sh=34219B422AAABCDE6D35FEFED1741C06C93A0663 ft=1 fh=4bed8d9997982404 vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.pun"

sh=CEED135E7F1F511AFD6E9B782FDF35B0026C872D ft=1 fh=c71c001131777565 vn="Variante von Win32/Toolbar.CrossRider.CG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\25b74a27-85cd-48a4-8e0a-5cb1163ade69.dll"

sh=D7975DF2EBC2A6299D3FF13483A642092D9B9D20 ft=1 fh=c71c00116f793630 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-1-6.exe"

sh=8FD6E610E5F64283F8A263BAF43E78DA2243E7EA ft=1 fh=782b185a0a829073 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-1-7.exe"

sh=03A12FECCEDC98AAF1AA4E67A75382FCD64F942C ft=1 fh=c71c00116622a638 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-10.exe"

sh=59A1FFFE0BA24F57C623FD11C8DDE76909AE7342 ft=1 fh=222cd515fc5fbe76 vn="Variante von Win32/Toolbar.CrossRider.BV evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-11.exe"

sh=EA3A99D2E5F31D64759F74E69E07A4B3A6B0586D ft=1 fh=03b0f8174074b76c vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-5.exe"

sh=7E864202B17E579E79ED2B9C59C76A8EB7B3F54D ft=1 fh=c71c001155f398de vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-6.exe"

sh=922956A124D7F4FE344181D90E9FEF98A058342D ft=1 fh=c71c001145b328a0 vn="Variante von Win64/Toolbar.Crossrider.N evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-64.exe"

sh=8FD6E610E5F64283F8A263BAF43E78DA2243E7EA ft=1 fh=782b185a0a829073 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\c9a5ce26-662c-40a2-9648-87facc485c97-7.exe"

sh=03A12FECCEDC98AAF1AA4E67A75382FCD64F942C ft=1 fh=c71c00116622a638 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\UninstallBrw.exe"

sh=ADA170FD986DFABCC0058D0498717E99DAA3CB25 ft=1 fh=cc8dae8c4c38f072 vn="Variante von Win32/Toolbar.CrossRider.CM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Sm23mS\utils.exe"

sh=B3D876F6D7D40E26610D9CFFC6D18928F4644A72 ft=1 fh=c71c0011de18eb58 vn="Variante von Win32/Toolbar.Montiera.Y evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\StartPoint\startpoint\1.3.23.0\napdgpoh.dll"

sh=68183CB2C0AD0AC1DACCA86F562E488EDC1433C5 ft=1 fh=c71c0011a880fe32 vn="Variante von Win32/Toolbar.Montiera.AD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\StartPoint\startpoint\1.3.23.0\poieidjC.dll"

sh=17BCF17053CE423F45EB12B08BAEAAF36B2A8D8D ft=1 fh=e574ffa8cd40d853 vn="Variante von Win32/Toolbar.Montiera.AB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\StartPoint\startpoint\1.3.23.0\res.dll"

sh=90435ADBE3A15F9FB079404737A0E209F879B25E ft=1 fh=f3f20b89feab9800 vn="Variante von Win32/Toolbar.Montiera.Q evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\StartPoint\startpoint\1.3.23.0\startpoint.exe"

sh=7C59CA8FDFB68DAF50C3D291465446AC1D4FE4FF ft=1 fh=488f608aa4a29396 vn="Variante von Win32/Toolbar.Montiera.R evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\StartPoint\startpoint\1.3.23.0\startup.exe"

sh=E09CFC697BAB4933BDEFF42401B13C2AF509DFBF ft=1 fh=c71c001115c400b1 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\System NotifierV05.06\d2df547c-f525-4d5b-9dfe-1dc20fbde0e5-10.exe"

sh=33194DE23FDC0061414036A60A5029605B3A11C1 ft=1 fh=e206c117e920fd0a vn="Variante von Win32/Toolbar.CrossRider.CC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\System NotifierV05.06\d2df547c-f525-4d5b-9dfe-1dc20fbde0e5-5.exe"

sh=E09CFC697BAB4933BDEFF42401B13C2AF509DFBF ft=1 fh=c71c001115c400b1 vn="Variante von Win32/Toolbar.CrossRider.CD evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\System NotifierV05.06\UninstallBrw.exe"

sh=148983444308484E79DC3A80765B7D29BB4CF23F ft=1 fh=75c5d5481f3cba99 vn="Variante von Win32/Toolbar.CrossRider.CM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\System NotifierV05.06\utils.exe"

sh=2C9EAC868877425E8707995A96140F6521DCAA64 ft=1 fh=c458c560ec55c6a0 vn="Win32/SpeedUpMyPC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Uniblue\SpeedUpMyPC\speedupmypc.exe"

sh=77E4E1AE908F954E5282E14AAFF6BC24218A87FF ft=1 fh=774bc0e6f98522b2 vn="Win32/UniBlue.D evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Program Files (x86)\Uniblue\SpeedUpMyPC\thirdpartyinstaller.exe"

sh=3ADED111BA4C362714DD914AF2875D25390F9141 ft=1 fh=960d55973837187f vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\eud\68AF2947C1C44DD293728E1BD02FFCBB\setup.exe"

sh=F5107D4315C28F6E6A0F94CAD8414D0EE4B1B1E5 ft=1 fh=36723e1fa1633655 vn="Variante von Win32/Amonetize.BQ evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\eud\8A2D122CC0E547C9B2D0CDBC8A110E13\setup.exe"

sh=DD2277D66E16DCBB318C28D67EAB24716CC149CC ft=1 fh=4e67ba056e2d11ad vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\eud\C5B5185A661540D0BCCB74956D7A231B\setup.exe"

sh=E7864F0EE835B0E9BBBAC4848D77C14AD868FE7F ft=1 fh=b2f90e20e2c55da2 vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\GrcToTxHhyb\xBcGKPMoYeq.exe"

sh=54F597960E46135214CCB1574125D4A9FD2F6D57 ft=1 fh=d090186774b9114a vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\GrcToTxHhyb\dat\bpIjYIlEJJ.exe"

sh=CFA726C451DD815F9C491059C16DD7FEAE62E8AB ft=1 fh=0868c8abd765084f vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\GrcToTxHhyb\dat\HonlOJg.dll"

sh=B2B9394D7F7B7E70750B4190EA0CC78DA7183941 ft=1 fh=34c925a9fd8b1320 vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\GrcToTxHhyb\dat\sGNjwQhowTs.exe"

sh=69D79009DF2853C067B182E77776E042D9A6F808 ft=1 fh=32f8e63a48089df9 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\GrcToTxHhyb\dat\XPpqelmwZ.dll"

sh=C4E57DAEF690333727FCE6BB1662A8318BCE933E ft=1 fh=5d0cf4788eaffe6b vn="Variante von MSIL/Adware.PullUpdate.P Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\Nropnumipre\1.0.1.0\altohria.exe"

sh=DD2277D66E16DCBB318C28D67EAB24716CC149CC ft=1 fh=4e67ba056e2d11ad vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\{274f2602-ce97-2b59-274f-f2602ce9980b}\hqghumeaylnlf.exe"

sh=AFF2FDF60083C588EF8CBC8349DD35EC2A5069E3 ft=1 fh=19efcee151207436 vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\ProgramData\{a7e20bb6-0b0d-9564-a7e2-20bb60b02ed8}\hqghumeaylnlf.exe"

sh=54F597960E46135214CCB1574125D4A9FD2F6D57 ft=1 fh=d090186774b9114a vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\All Users\GrcToTxHhyb\dat\bpIjYIlEJJ.exe"

sh=CFA726C451DD815F9C491059C16DD7FEAE62E8AB ft=1 fh=0868c8abd765084f vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\All Users\GrcToTxHhyb\dat\HonlOJg.dll"

sh=B2B9394D7F7B7E70750B4190EA0CC78DA7183941 ft=1 fh=34c925a9fd8b1320 vn="Variante von MSIL/Adware.PullUpdate.G.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\All Users\GrcToTxHhyb\dat\sGNjwQhowTs.exe"

sh=69D79009DF2853C067B182E77776E042D9A6F808 ft=1 fh=32f8e63a48089df9 vn="Variante von MSIL/Adware.PullUpdate.K.gen Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\All Users\GrcToTxHhyb\dat\XPpqelmwZ.dll"

sh=637F778178623B6520BFC2232E74EC1695A45311 ft=1 fh=82c7277898e5f077 vn="Variante von Win32/Amonetize.ET evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\7721\Updater.exe"

sh=39EFB4F1FB078E913A962E257CF5BB37EA8B09DE ft=1 fh=548fd630e13b1bd4 vn="Variante von Win32/Toolbar.CrossRider.BX evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Apps\2.0\ZJ4DRMMZ.JTG\EQTECP39.6XR\setu...app_a304de035277f5b8_0000.0002_4484a0edd4274667\7.exe"

sh=DA201942334E863767B2BAEF85C6558083F51907 ft=1 fh=8f7c0dd18879a3d0 vn="Variante von Win32/Toolbar.CrossRider.BX evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Apps\2.0\ZJ4DRMMZ.JTG\EQTECP39.6XR\setu...app_a304de035277f5b8_0000.0002_4484a0edd4274667\7db.exe"

sh=2ECA6C5CE0CFE9BC9D0B373EC0DEA71648F22F79 ft=1 fh=7d3d244d2ef632a9 vn="Variante von Win32/SoftPulse.AG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Apps\2.0\ZJ4DRMMZ.JTG\EQTECP39.6XR\setu...app_a304de035277f5b8_0000.0002_4484a0edd4274667\SetupWizard.exe"

sh=2ECA6C5CE0CFE9BC9D0B373EC0DEA71648F22F79 ft=1 fh=7d3d244d2ef632a9 vn="Variante von Win32/SoftPulse.AG evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Apps\2.0\ZJ4DRMMZ.JTG\EQTECP39.6XR\setup.exe_a304de035277f5b8_0000.0002_none_21804ebbb9399cd3\SetupWizard.exe"

sh=FB15C7C9B14C6DBD2DCE0B4A760869CB4D1F833D ft=1 fh=b7caddf2abd65f22 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\avabvbyvyc\avabvbyvyc.exe"

sh=5FB62DCDE51B16CDA29184FB277B3B3A0E942AAD ft=1 fh=dd69925897059ae7 vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\avabvbyvyc\pbqrmvbub"

sh=8EF70124B55B9ACE24CD7D97D7A09304CE893F55 ft=1 fh=6a7f77f8846ed93c vn="Variante von Win32/Adware.EoRezo.AJ Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\gmsd_de_586\upgmsd_de_586.exe"

sh=A17F293F50E44E58B5E05A227627BB34A02D3E09 ft=1 fh=854009827ef6268b vn="Variante von Win32/Adware.EoRezo.AJ Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\gmsd_de_592\upgmsd_de_592.exe"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhkmcfanijhphphomamdkaejjadkhgn\1.26.69_0\extensionData\plugins\91.js"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\jecgbfoconhopjngaaijjgffhokohlac\1.26.78_0\extensionData\plugins\91.js"

sh=5F0AEF7F21118E78D601DCD7310379880A34A782 ft=1 fh=0b745618ce20a8c9 vn="Variante von Win32/Adware.ConvertAd.RU Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOUY1GGG\dawr[1].exe"

sh=458D93ACB54C46BEC9F2AE459D4074736E414035 ft=1 fh=360861b198e36f2b vn="Variante von Win32/Adware.Vitruvian.F Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WIWZY0KX\infonaut-setup-1.10.0.14[1].exe"

sh=276654DF113ADAB3BC02D86BFED35A4EA9999696 ft=1 fh=6b2b8cc544551537 vn="Variante von MSIL/Adware.Imali.A Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y9Y3YUFA\FinalInstaller_dotnet4[1].exe"

sh=6142578CD21CF27FD3C1B3A4F0626DE9FC6DF275 ft=1 fh=a0b7e9a9340cf144 vn="Variante von Win32/PriceGong.C evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\SmartWeb\SmartWebApp.exe"

sh=AA2BA9D6607589A3C93D1C760E3512EC8E61F968 ft=1 fh=f770637cdb111250 vn="Win32/Adware.ConvertAd.RC Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\SmartWeb\SmartWebHelper.exe"

sh=080016256C564232771ED8D6EFFC94ECAECAD316 ft=1 fh=bfc1d533ef10baf8 vn="Variante von Win32/PriceGong.C evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\SmartWeb\swhk.dll"

sh=32BE00C9B8BD83BF621E433EC87DE21B08F82098 ft=1 fh=a4fbdca8e8e73dc7 vn="Variante von Win32/PriceGong.C evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\SmartWeb\__u.exe"

sh=B253BF86450F621FDC9201CDAD4A55DA96017963 ft=1 fh=c71c00114a630ed5 vn="Variante von Win32/Adware.AddLyrics.EB Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\00E35A2E-3B5A-BD25-0A1E-9E0608E342C2.exe"

sh=75AEA67991FB7D648B76D175EE1470F9E9196CF5 ft=1 fh=5edd4c3530b7ec84 vn="Variante von Win32/Toolbar.CrossRider.CN evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\2329.exe"

sh=BA69863A06DEC1E50A9CAB3E1C9110395916E1DD ft=1 fh=4a75c7c1672e5db7 vn="MSIL/MyPCBackup.G evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\7978850eae7c485da5eaa3983f21c276362934.exe"

sh=FC303F1BAEA7921AB38347354597F4B246DF378F ft=1 fh=f2a3c0226c04b131 vn="Variante von Win32/Packed.ScrambleWrapper.O evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\9577.exe"

sh=74007051A43C26DEF9A55CD3F2411935EC272EDA ft=1 fh=c71c0011d46ebcbc vn="Variante von Win32/Adware.AddLyrics.EB Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\C430378F-9825-863D-B65C-DF593C22CCD4.exe"

sh=0FCE37322332ABBD64BB09FF43EFD365D99C43E2 ft=1 fh=3ae6a14ff9b7bde5 vn="Variante von Win32/Amonetize.EX evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\Launcher__10272.exe"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\npglobalupdateUpdate4.dll.old6d65c6"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\npglobalupdateUpdate4.dll.old72ce58"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\npglobalupdateUpdate4.dll.old73f9bb"

sh=D68EE7FF15C185692D231C2252B5F2A60BF3434B ft=1 fh=37c42276c7e5e86c vn="Variante von Win32/Adware.ConvertAd.RU Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsr7386.tmp"

sh=0E8C60C946A762CF1966E77D30A3120F164C916F ft=1 fh=848af645ba02d5de vn="Mehrere Bedrohungen (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\optprosetup.exe"

sh=17BCF17053CE423F45EB12B08BAEAAF36B2A8D8D ft=1 fh=e574ffa8cd40d853 vn="Variante von Win32/Toolbar.Montiera.AB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\res.dll"

sh=276654DF113ADAB3BC02D86BFED35A4EA9999696 ft=1 fh=6b2b8cc544551537 vn="Variante von MSIL/Adware.Imali.A Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\sdf17C6.exe"

sh=F468E5973CE8739246CF2D69770EA006CD6455A6 ft=1 fh=a54f9f106924b16d vn="Variante von Win32/Adware.EoRezo.AZ Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\setup_gmsd_de.exe"

sh=8EEEA0BAFF588CE7767C1AEB585C3CEC2C91A2C1 ft=1 fh=53e569f094787791 vn="Win32/Toolbar.Conduit.U evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\sp-downloader.exe"

sh=22382617DB4646AF8E8FABB82B9C6806C1EE69AF ft=1 fh=ce4f9555655f62e9 vn="Variante von Win32/Toolbar.Montiera.Z evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\startpoint_1.exe"

sh=7C59CA8FDFB68DAF50C3D291465446AC1D4FE4FF ft=1 fh=488f608aa4a29396 vn="Variante von Win32/Toolbar.Montiera.R evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\startup.exe"

sh=84F883BAF5554D8EB81D684D158E5A6E474F57DE ft=1 fh=bcc928928aeafc50 vn="Mehrere Bedrohungen (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\supoptsetup.exe"

sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\VOPackage_1712.exe"

sh=04E7997F9E3F54C4096F6EFA419255DF103E02C2 ft=1 fh=c299b02826b3aabc vn="Variante von Win32/Adware.MultiPlug.IX Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\__tmp_14c8c197"

sh=0D6B2D3643639F9EC66C70D1A7722245667ECFD1 ft=1 fh=e84e3080d857d3e0 vn="Variante von Win32/TrojanDropper.Addrop.A Trojaner (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\18dee22d-696a-42b5-af70-d4b43aba95ba\setup.exe"

sh=82C521854E6CA1E7E0BD705C3D14B86FE573449D ft=1 fh=9ac5482a2a938eb0 vn="Win32/MyPCBackup.E evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\29df34a9-d7a6-473f-a79e-e913025dee08\aff_setup.exe"

sh=DDEF8A30CA0234DDCCF55D962D5FA5D2AC69FF7F ft=1 fh=a5703f9a0977c112 vn="Variante von Win32/TrojanDropper.Addrop.A Trojaner (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\5700eee2-c2ac-4178-af5a-ac07652e79ba\setup.exe"

sh=83EAC6DBE1FAFF6EB3ED28CC1B8649DA0957E3F2 ft=1 fh=f7e973f0bce1b407 vn="Variante von Win32/Adware.AddLyrics.EA Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\6eeb9639-3564-4e66-afd8-cfa1231633c1\5555-1007_checkmeup.exe"

sh=75AEA67991FB7D648B76D175EE1470F9E9196CF5 ft=1 fh=5edd4c3530b7ec84 vn="Variante von Win32/Toolbar.CrossRider.CN evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\7852253b-3f69-4e78-b736-a48f7fa9df65\installer.exe"

sh=3BC912E6FE1D4D55143FADE94C37B9EC9848F3E7 ft=1 fh=d3cf5ab729158244 vn="Variante von Win32/DealPly.AC evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\8b4a2d26-152c-4b7e-aad7-cb7ce7065044\pfinst.exe"

sh=09219936CA587BEDA7F7F6822F4A04677D654A67 ft=1 fh=26012f658a8f2f4d vn="Win32/SpeedUpMyPC.A evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\8bde2600-2839-4a70-8dc0-7baf6032f5c4\speedupmypc.exe"

sh=C02ADEDC3558F497047BCDA26868704EA5F0A74A ft=1 fh=2c6fb0c3e3cf0927 vn="Variante von Win32/UniBlue.F evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\8f6db47d-825c-4f46-b513-0d551ff4d66e\driverscanner.exe"

sh=AFF2FDF60083C588EF8CBC8349DD35EC2A5069E3 ft=1 fh=19efcee151207436 vn="Variante von Win32/Adware.SpeedingUpMyPC.Y Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\96ecc2d4-5f35-4a5a-8158-691a3ede5835\superoptimizersetup.exe"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\comh.175841\npglobalupdateUpdate4.dll"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\comh.283105\npglobalupdateUpdate4.dll"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\comh.287132\npglobalupdateUpdate4.dll"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\comh.414634\npglobalupdateUpdate4.dll"

sh=776F41599C9EBE28C07489680EEBDB727E1BFE5A ft=1 fh=c71c00119a74eb7c vn="Variante von Win32/AlteredSoftware.E evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\comh.43039\npglobalupdateUpdate4.dll"

sh=DF28E75AC8B16247ED808EC675AE3AAC90FB0A75 ft=1 fh=d28c05e7d0dc64b6 vn="Variante von Win32/Packed.ScrambleWrapper.O evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\d77197fd-cfe5-4a6b-b88f-3c1f5f4f3fa8\mini_installer.exe"

sh=7F957E33EC8C36FEFA323AA53F6AEEF7DF6F392C ft=1 fh=b1fc0c915d6e3f25 vn="Win32/ELEX.BM evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\E592A50D-87A9-437F-9F9B-31AA642D3A9Bmp\tmp\XTab_Setup(2521).exe"

sh=D0033C082AB4324079D445FC192FD6E8768BD14F ft=1 fh=ef238d643c94d7fe vn="Variante von MSIL/Adware.Imali.A Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\OfferInstaller.exe"

sh=EB87326A84DFDC99667B774F835B0D5600C2A763 ft=1 fh=704fbe3ee9c75a9a vn="Variante von Win32/Packed.ScrambleWrapper.O evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\fba20fff-f392-4e32-9cf0-2e8ff409dcbd\smarts23.exe"

sh=3C32EDAB74289123017109748703BD9F40D49E77 ft=1 fh=4a8bc0dddcf98733 vn="Win32/SpeedUpMyPC evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\is-JJ9NO.tmp\sp-standalone-setup.exe"

sh=3D54E50558FF95716445E744582D45670CA343D5 ft=1 fh=32bd0438717e7272 vn="Variante von MSIL/Adware.PullUpdate.A Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsc4D29.tmp\Helper.dll"

sh=807E17AB1B98177E135D30941B45081960D1E866 ft=1 fh=211e050d94f6a57b vn="Variante von Win32/Somoto.G evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nseC04.tmp\install37376.exe"

sh=6191FE26E7E1D24C0466D72A86DFA62F859F4AE3 ft=1 fh=e607585d368752f5 vn="Variante von Win32/Conduit.SearchProtect.Y evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nss99E2.tmp\SPtool.dll"

sh=807E17AB1B98177E135D30941B45081960D1E866 ft=1 fh=211e050d94f6a57b vn="Variante von Win32/Somoto.G evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsx3095.tmp\install55541.exe"

sh=807E17AB1B98177E135D30941B45081960D1E866 ft=1 fh=211e050d94f6a57b vn="Variante von Win32/Somoto.G evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\nsz9743.tmp\install28203.exe"

sh=DAD15D6F626AB7F5851FCC4B50A0F92191D815C9 ft=1 fh=47ba3de07316b200 vn="Variante von Win32/BrowseFox.AI evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Local\Temp\~nsu.tmp\Au_.exe"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\2Ovhr6lC1.exe"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\gSyGSmIu0Kf3G.exe"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\pPZCdWJiOzyjMMPjw.exe"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\QmNpb01D3S9.exe"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\qYVcguT.exe"

sh=B2007EDC886AA67707E5FC33B67A5DBDB2A5B46A ft=1 fh=076abd41a3ae762f vn="Variante von Win32/Adware.Hicosmea.F Anwendung (GesÃ¤ubert durch LÃ¶schen (nach dem nÃ¤chsten Neustart) - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\inminet\forvercu.dll"

sh=F146943C7C494247ED9874C9A2A05C520DC4218A ft=1 fh=6a46a12ee6b9eab3 vn="Variante von Win64/Adware.Hicosmea.F Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\inminet\sencolny.dll"

sh=0229DB0DE638CE84AA0A86AC3DB43BCD8080058B ft=1 fh=c71c001139045390 vn="Variante von Win32/ELEX.CP evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\mystartsearch\UninstallManager.exe"

sh=00F24F2A81D016556083E9D60918A0A98F54CDF6 ft=1 fh=03dd67ab78e93074 vn="Variante von Win32/BrowseFox.AI evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\OpenCandy\C9A23D2F0CA54C19A9A68C83D4AFBC73\setup0213.exe"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\Opera Software\Opera Stable\Extensions\idhkmcfanijhphphomamdkaejjadkhgn\1.26.69_0\extensionData\plugins\91.js"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\Opera Software\Opera Stable\Extensions\jecgbfoconhopjngaaijjgffhokohlac\1.26.78_0\extensionData\plugins\91.js"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\Opera Software\Opera Stable\Extensions\mdcoemfeknnmifgkfoncjfoohdljddmp\1.26.43_0\extensionData\plugins\91.js"

sh=5352255EEC0A36DD703B32226CC7F65D70F65475 ft=0 fh=0000000000000000 vn="VBS/Kryptik.DY Trojaner (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\Tny_cassiopesa\UpdateProc\bkup.dat"

sh=05FC70FCA7CCDB54CE3D6778AEADB58A32431BB2 ft=1 fh=704d2e4b074cd8f4 vn="Win32/Adware.ConvertAd.AQ Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\VOPackage\Uninstall.exe"

sh=F2251A7A386675FE43902ADC0525D33672C8BB84 ft=1 fh=e069b17bc5bd2e6a vn="Variante von Win32/Adware.ConvertAd.KZ.gen Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\AppData\Roaming\VOPackage\VOPackage.exe"

sh=5B95315844B22672C2E867D8E3D45D9F05ED2016 ft=1 fh=6e4c94e41237e20f vn="Win32/Somoto.Q evtl. unerwÃ¼nschte Anwendung (gelÃ¶scht - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\Downloads\setup_Project64_2.2.exe"

sh=A8F7603007D8A682B8FBD4E13860656019F2B9ED ft=1 fh=899932df795582a7 vn="Variante von Win32/InstallCore.ZM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\Downloads\zipinstall (1).exe"

sh=A8F7603007D8A682B8FBD4E13860656019F2B9ED ft=1 fh=899932df795582a7 vn="Variante von Win32/InstallCore.ZM evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Users\Undertaker\Downloads\zipinstall.exe"

sh=0EC30DF742984EA79C49703698D5777B1BCC6F42 ft=1 fh=e77459d120c26c8f vn="Variante von Win32/TrojanDownloader.Adcurl.A Trojaner (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Windows\eud.exe"

sh=3765E3E87C40F1C09307F4830E0949A69A478516 ft=1 fh=1debd3177207603f vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Windows\AppPatch\AppPatch64\VCLdr64.dll"

sh=040A9305A597029A3F386ADBA2FAFBB51A5ECCB7 ft=1 fh=70d6beee8c110f8f vn="Variante von Win32/ClientConnect.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\Windows\AppPatch\nbin\VC32Loader.dll"

sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Mehrere Bedrohungen (Enthielt infizierte Datei(en))" ac=C fn="${Memory}"

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# end=init

# utc_time=2015-06-09 04:31:09

# local_time=2015-06-09 06:31:09 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 24248

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# end=updated

# utc_time=2015-06-09 04:32:58

# local_time=2015-06-09 06:32:58 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=3443acd88fc8674dac7167902eb27d02

# engine=24248

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-06-09 06:56:47

# local_time=2015-06-09 08:56:47 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Avira Desktop'

# compatibility_mode=1804 16775165 100 96 251918 299299497 171931 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 101260 185506057 0 0

# scanned=284715

# found=8

# cleaned=8

# scan_time=8628

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp\1.26.82_0\extensionData\plugins\91.js.vir"

sh=C2CDF8F5CF8F8E7082898326B1937499DEFA5C63 ft=1 fh=4dce2de995a2d99e vn="Variante von Win32/Toolbar.CrossRider.CB evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Roaming\4TKchDi.exe.vir"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Undertaker\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp\1.26.82_0\extensionData\plugins\91.js.vir"

sh=2AAB40288A33E431480E904BD7A9A9C6D065B3D0 ft=1 fh=b484f4b7f98c653e vn="Variante von Win64/Systweak.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\windows\System32\roboot64.exe.vir"

sh=925C6299BED0F09E398A3E00E7A04C2DE949C169 ft=1 fh=2cb424d9f7c23c92 vn="Win64/AdvancedSystemProtector.A evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\windows\System32\sasnative64.exe.vir"

sh=C10B86D92672390E8650D4FDD918DBDC92F94841 ft=1 fh=a7217baf7e13087b vn="Win32/TrojanDownloader.Adcurl.D Trojaner (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\FRST\Quarantine\C\windows\meud.exe.xBAD"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\zoek_backup\C_Users_Undertaker_AppData_Roaming_Opera Software_Opera Stable_Extensions_ablgnpngfaaficpckehadaljnjgjkhbi\1.26.55_0\extensionData\plugins\91.js"

sh=FDE9F4F014512E0C786BD5EACD3DD5CD8941F860 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwÃ¼nschte Anwendung (GesÃ¤ubert durch LÃ¶schen - in QuarantÃ¤ne kopiert)" ac=C fn="C:\zoek_backup\C_Users_Undertaker_AppData_Roaming_Opera Software_Opera Stable_Extensions_fijhlnmmmgflacagjecncpmpnhjieggk\1.26.47_0\extensionData\plugins\91.js"

hier noch das FRST

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:06-06-2015

Ran by Undertaker (administrator) on UNDERTAKER-PC on 09-06-2015 21:06:30

Running from C:\Users\Undertaker\Downloads

Loaded Profiles: Undertaker (Available Profiles: Undertaker & Shari)

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11 (Default browser not detected!)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(AMD) C:\Windows\System32\atiesrxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

() C:\Windows\SysWOW64\PnkBstrB.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe

(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe

(Dropbox, Inc.) C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe

(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(1und1 Mail und Media GmbH) C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe

(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe

(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe

(CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

() C:\Program Files (x86)\Opera\29.0.1795.60\opera_crashreporter.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Opera Software) C:\Program Files (x86)\Opera\29.0.1795.60\opera.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-13] (ELAN Microelectronics Corp.)

HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [421888 2012-11-18] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-22] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3816784 2014-07-21] (LogMeIn Inc.)

HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)

HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)

HKLM-x32\...\Run: [MailCheck IE Broker] => C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck_Broker.exe [2190912 2015-05-06] (1und1 Mail und Media GmbH)

HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [384800 2012-10-16] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Facebook Update] => C:\Users\Undertaker\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-25] (Facebook Inc.)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [1565504 2015-01-14] (Samsung)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2015-01-14] (Samsung)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)

HKU\S-1-5-21-1335839233-2991384071-368375801-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-02-01]

ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)

Startup: C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2014-07-25]

ShortcutTarget: Dropbox.lnk -> C:\Users\Undertaker\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com

SearchScopes: HKU\S-1-5-21-1335839233-2991384071-368375801-1000 -> {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-02-01] (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)

BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll [2010-10-25] ()

BHO-x32: WEB.DE MailCheck BHO -> {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} -> C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-02-01] (Oracle Corporation)

DPF: HKLM {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab

DPF: HKLM {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_x64_5.0.199.0.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

Handler-x32: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files (x86)\WEB.DE MailCheck\IE\WEB.DE_MailCheck.dll [2015-05-06] (1und1 Mail und Media GmbH)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\windows\system32\npDeployJava1.dll [2012-11-05] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-02-18] ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.75.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-02-01] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.75.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-02-01] (Oracle Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)

FF Plugin-x32: @popularscreensavers.com/Plugin -> C:\Program Files (x86)\PopularScreensavers\NPp5Stub.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\6\NP_wtapp.dll [2015-04-27] ()

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-1335839233-2991384071-368375801-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Undertaker\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)

FF Plugin HKU\S-1-5-21-1335839233-2991384071-368375801-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2013-10-01] ()
 

Chrome: 

=======

CHR Profile: C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-05-14]

CHR Extension: (Google Docs) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-05-14]

CHR Extension: (Google Drive) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-05-14]

CHR Extension: (YouTube) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-05-14]

CHR Extension: (Google Search) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-05-14]

CHR Extension: (Google Sheets) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-05-14]

CHR Extension: (Avira Browser Safety) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-05-14]

CHR Extension: (Bookmark Manager) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-14]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-05-14]

CHR Extension: (Google Wallet) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-15]

CHR Extension: (Gmail) - C:\Users\Undertaker\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-14]

CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

StartMenuInternet: Google Chrome - chrome.exe
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-03-22] (Advanced Micro Devices, Inc.) [File not signed]

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84256 2012-10-16] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108320 2012-10-16] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)

R2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1858048 2012-01-23] (MAGIX AG) [File not signed]

S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®) [File not signed]

R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)

R2 PnkBstrA; C:\windows\SysWOW64\PnkBstrA.exe [75136 2013-03-11] ()

R2 PnkBstrB; C:\windows\SysWOW64\PnkBstrB.exe [189248 2013-03-11] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () [File not signed]

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [765144 2014-11-28] (Secunia)

R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2013-07-28] ()

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [99248 2012-09-13] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [129216 2012-10-04] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27800 2012-09-24] (Avira Operations GmbH & Co. KG)

R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2013-07-28] ()

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)

S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-01-16] (Windows (R) 2003 DDK 3790 provider)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [File not signed]

S3 RkHit; \??\C:\windows\system32\drivers\RKHit.sys [X]

S3 taphss6; system32\DRIVERS\taphss6.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
 
 

==================== One Month Created files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-08 17:21 - 2015-06-08 17:21 - 00243592 _____ C:\Users\Undertaker\Downloads\Firefox Setup Stub 38.0.5 (1).exe

2015-06-08 17:16 - 2015-06-08 17:16 - 00243592 _____ C:\Users\Undertaker\Downloads\Firefox Setup Stub 38.0.5.exe

2015-06-08 16:28 - 2015-06-08 13:06 - 00024064 _____ C:\windows\zoek-delete.exe

2015-06-08 13:58 - 2015-06-08 16:51 - 00000000 ____D C:\zoek

2015-06-08 13:10 - 2015-06-08 16:51 - 00059803 _____ C:\zoek-results.log

2015-06-08 13:06 - 2015-06-08 16:08 - 00000000 ____D C:\zoek_backup

2015-06-08 13:05 - 2015-06-08 13:06 - 01308672 _____ C:\Users\Undertaker\Downloads\zoek.exe

2015-06-07 23:20 - 2015-06-07 23:20 - 00041826 _____ C:\Users\Undertaker\Desktop\FRST.txt

2015-06-07 22:46 - 2015-06-07 22:48 - 00135230 _____ C:\Users\Undertaker\Desktop\auswahl.txt

2015-06-07 20:40 - 2015-06-07 20:40 - 00000000 ____D C:\Users\Undertaker\Downloads\RevoUninstallerPortable

2015-06-07 20:39 - 2015-06-07 20:40 - 02785665 _____ (PortableApps.com) C:\Users\Undertaker\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe

2015-06-06 23:04 - 2015-06-06 23:04 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Avira

2015-06-06 22:58 - 2015-06-06 22:58 - 00001954 _____ C:\Users\Public\Desktop\Avira Control Center.lnk

2015-06-06 22:57 - 2012-10-04 12:07 - 00129216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2015-06-06 22:57 - 2012-09-24 09:58 - 00027800 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys

2015-06-06 22:57 - 2012-09-13 15:52 - 00099248 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2015-06-06 21:36 - 2015-06-06 23:28 - 00001062 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-06-06 21:32 - 2015-06-06 21:34 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Undertaker\Downloads\mbam-setup-2.1.6.1022.exe

2015-06-06 21:17 - 2015-06-08 22:34 - 00048165 _____ C:\Users\Undertaker\Downloads\Addition.txt

2015-06-06 21:12 - 2015-06-09 21:06 - 00020235 _____ C:\Users\Undertaker\Downloads\FRST.txt

2015-06-06 21:11 - 2015-06-06 21:11 - 02108928 _____ (Farbar) C:\Users\Undertaker\Downloads\FRST64.exe

2015-06-06 19:22 - 2015-06-07 21:07 - 00000000 ____D C:\AdwCleaner

2015-06-06 13:50 - 2015-06-07 22:10 - 00173056 _____ C:\windows\Provider.dll

2015-06-06 13:50 - 2015-06-07 22:10 - 00000000 ____D C:\windows\Provider32

2015-06-06 13:50 - 2015-06-07 20:51 - 00173056 _____ C:\windows\Provider20150607221036.dll

2015-06-06 13:50 - 2015-06-07 19:50 - 00173056 _____ C:\windows\Provider20150607205118.dll

2015-06-06 13:50 - 2015-06-06 23:54 - 00173056 _____ C:\windows\Provider20150607195041.dll

2015-06-06 13:50 - 2015-06-06 22:06 - 00173056 _____ C:\windows\Provider20150606235357.dll

2015-06-06 13:50 - 2015-06-06 19:55 - 00173056 _____ C:\windows\Provider20150606220627.dll

2015-06-06 13:50 - 2015-06-06 18:06 - 00173056 _____ C:\windows\Provider20150606195541.dll

2015-06-06 13:50 - 2015-06-06 16:53 - 00173056 _____ C:\windows\Provider20150606180602.dll

2015-06-06 13:50 - 2015-06-06 15:52 - 00173056 _____ C:\windows\Provider20150606165333.dll

2015-06-06 13:50 - 2015-06-06 14:51 - 00173056 _____ C:\windows\Provider20150606155257.dll

2015-06-06 13:50 - 2015-06-06 13:50 - 00718497 _____ C:\windows\unins000.exe

2015-06-06 13:50 - 2015-06-06 13:50 - 00010273 _____ C:\windows\unins000.dat

2015-06-06 13:50 - 2015-06-02 18:30 - 00173056 _____ C:\windows\Provider20150606145136.dll

2015-06-06 13:50 - 2015-06-02 18:30 - 00101888 _____ C:\windows\Installer.exe

2015-06-06 13:48 - 2015-06-06 13:48 - 02231296 _____ C:\Users\Undertaker\Downloads\AdwCleaner_4.206.exe

2015-06-06 13:42 - 2015-06-06 13:42 - 02870984 _____ (ESET) C:\Users\Undertaker\Downloads\esetsmartinstaller_deu.exe

2015-06-06 13:26 - 2015-06-06 13:26 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Chromium

2015-06-06 13:20 - 2015-06-06 13:26 - 00000000 ___HD C:\ProgramData\eud

2015-06-06 13:18 - 2015-06-06 22:19 - 00000004 _____ C:\windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7

2015-06-06 13:16 - 2015-06-06 13:16 - 00631296 _____ C:\windows\eud.dat

2015-06-06 13:06 - 2015-06-06 13:20 - 00000684 _____ C:\Users\Undertaker\Downloads\project64                         .website

2015-06-06 13:06 - 2015-06-06 13:20 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Deployment

2015-06-06 13:06 - 2015-06-06 13:06 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Apps\2.0

2015-06-06 12:53 - 2015-06-06 12:53 - 00001285 _____ C:\Users\Undertaker\Desktop\setup_Project64_2.2.exe - Verknüpfung.lnk

2015-06-06 12:45 - 2015-06-06 12:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Project 64 2.2

2015-06-06 12:45 - 2015-06-06 12:53 - 00000000 ____D C:\Program Files (x86)\Project64 2.2

2015-06-06 12:39 - 2015-06-06 12:39 - 12699289 _____ C:\Users\Undertaker\Downloads\Mario Kart 64 (E).zip

2015-06-06 12:35 - 2015-06-06 12:35 - 08388608 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E) (1).v64

2015-06-06 12:34 - 2015-06-06 12:46 - 00001089 _____ C:\Users\Public\Desktop\Opera.lnk

2015-06-06 12:34 - 2015-06-06 12:34 - 00003862 _____ C:\windows\System32\Tasks\Opera scheduled Autoupdate 1433586837

2015-06-06 12:34 - 2015-06-06 12:34 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Opera Software

2015-06-06 12:34 - 2015-06-06 12:34 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Opera Software

2015-06-06 12:34 - 2015-06-06 12:33 - 00001095 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2015-06-06 12:33 - 2015-06-08 23:38 - 00000000 ____D C:\Program Files (x86)\Opera

2015-06-06 12:33 - 2015-06-06 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

2015-06-06 12:33 - 2015-06-06 12:33 - 00000000 ____D C:\Program Files (x86)\7-Zip

2015-06-06 12:32 - 2015-06-06 16:12 - 00000000 ____D C:\Program Files (x86)\MiuiTab

2015-06-06 12:32 - 2015-06-06 12:31 - 01200163 _____ C:\Users\Undertaker\Downloads\7zip.exe

2015-06-06 12:21 - 2015-06-06 12:46 - 00001311 _____ C:\Users\Public\Desktop\NAVIGON Fresh.lnk

2015-06-06 12:21 - 2015-06-06 12:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NAVIGON

2015-06-06 12:21 - 2015-06-06 12:21 - 00000000 ____D C:\ProgramData\boost_interprocess

2015-06-05 22:10 - 2015-06-05 22:11 - 01089752 _____ (Unity Technologies ApS) C:\Users\Undertaker\Downloads\UnityWebPlayer (1).exe

2015-06-04 14:56 - 2015-06-04 14:56 - 00983949 _____ C:\Users\Undertaker\Downloads\Super Mario Allstars (E).zip

2015-06-04 14:35 - 2015-06-04 14:36 - 06347644 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E) (1).zip

2015-06-04 12:44 - 2015-06-04 12:45 - 06347644 _____ C:\Users\Undertaker\Downloads\Super Mario 64 (D, F, E).zip

2015-06-04 12:39 - 2015-01-30 06:22 - 00000073 ____R C:\Users\Undertaker\Downloads\PokeMMO.sh

2015-06-02 22:00 - 2015-06-04 12:42 - 13171110 _____ C:\Users\Undertaker\Desktop\PokeMMO-Client (2).zip

2015-05-17 16:12 - 2015-05-17 16:12 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Sonic7

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WEB.DE MailCheck

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\Program Files\WEB.DE MailCheck

2015-05-15 09:45 - 2015-05-15 09:45 - 00000000 ____D C:\Program Files (x86)\WEB.DE MailCheck

2015-05-14 20:59 - 2015-05-14 20:59 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Steam

2015-05-14 20:50 - 2015-06-08 23:34 - 00000000 ____D C:\Program Files (x86)\Steam

2015-05-14 20:50 - 2015-05-14 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam

2015-05-14 20:47 - 2015-05-14 20:47 - 01142128 _____ C:\Users\Undertaker\Downloads\SteamSetup.exe

2015-05-14 19:49 - 2015-05-14 19:49 - 00000000 ____D C:\ProgramData\UUdb

2015-05-14 09:38 - 2015-06-06 13:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
 

==================== One Month Modified files and folders ========
 

(If an entry is included in the fixlist, the file/folder will be moved.)
 

2015-06-09 21:06 - 2014-01-02 17:54 - 00000000 ____D C:\FRST

2015-06-09 20:52 - 2013-04-20 10:22 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-06-09 20:34 - 2015-04-14 19:11 - 00778416 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-06-09 20:34 - 2015-04-14 19:11 - 00142512 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-06-09 20:34 - 2015-04-14 19:11 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2015-06-09 20:34 - 2015-04-14 19:11 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-06-09 20:15 - 2011-10-20 01:52 - 01469342 _____ C:\windows\WindowsUpdate.log

2015-06-09 19:28 - 2012-12-04 14:05 - 00000948 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000UA.job

2015-06-09 18:40 - 2012-12-04 14:05 - 00000926 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1335839233-2991384071-368375801-1000Core.job

2015-06-09 18:30 - 2009-07-14 06:45 - 00028624 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-06-09 18:30 - 2009-07-14 06:45 - 00028624 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-06-09 18:29 - 2013-04-20 10:22 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-06-08 23:39 - 2014-04-11 20:58 - 00000000 ____D C:\Users\Undertaker\AppData\Local\LogMeIn Hamachi

2015-06-08 23:37 - 2014-07-25 18:13 - 00000000 ___RD C:\Users\Undertaker\Dropbox

2015-06-08 23:37 - 2014-07-25 18:11 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Dropbox

2015-06-08 23:33 - 2013-04-06 00:59 - 00080477 _____ C:\windows\setupact.log

2015-06-08 23:33 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-06-08 16:50 - 2014-05-22 17:16 - 00000008 __RSH C:\ProgramData\ntuser.pol

2015-06-08 16:49 - 2013-04-06 00:52 - 01088286 _____ C:\windows\PFRO.log

2015-06-08 15:58 - 2009-07-14 05:20 - 00000000 ___HD C:\windows\system32\GroupPolicy

2015-06-08 15:58 - 2009-07-14 05:20 - 00000000 ____D C:\windows\SysWOW64\GroupPolicy

2015-06-07 22:50 - 2013-04-07 15:58 - 00000000 ____D C:\windows\ERUNT

2015-06-07 21:35 - 2014-05-22 19:43 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-06-07 21:06 - 2012-10-30 15:16 - 00000000 ____D C:\Users\Undertaker

2015-06-07 20:51 - 2013-03-28 23:41 - 00000000 ____D C:\Users\Undertaker\AppData\Local\CrashDumps

2015-06-07 19:09 - 2012-11-05 13:32 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Skype

2015-06-06 23:28 - 2014-05-22 19:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-06-06 23:28 - 2014-05-22 19:42 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-06-06 22:58 - 2012-10-30 16:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2015-06-06 22:56 - 2012-10-30 16:18 - 00000000 ____D C:\Program Files (x86)\Avira

2015-06-06 22:44 - 2012-10-30 16:18 - 00000000 ____D C:\ProgramData\Avira

2015-06-06 22:43 - 2012-12-06 16:46 - 00000000 ____D C:\windows\Minidump

2015-06-06 12:46 - 2015-04-17 20:10 - 00002568 _____ C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DC Universe Online.lnk

2015-06-06 12:46 - 2015-02-01 15:26 - 00001761 _____ C:\Users\Public\Desktop\iTunes.lnk

2015-06-06 12:46 - 2015-01-28 20:02 - 00001242 _____ C:\Users\Undertaker\Desktop\Revo Uninstaller.lnk

2015-06-06 12:46 - 2014-08-14 23:40 - 00001415 _____ C:\Users\Shari\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-06-06 12:46 - 2014-05-19 11:26 - 00002190 _____ C:\Users\Public\Desktop\Google Earth.lnk

2015-06-06 12:46 - 2013-08-12 21:43 - 00002096 _____ C:\Users\Public\Desktop\Video Search.lnk

2015-06-06 12:46 - 2012-11-24 13:01 - 00001426 _____ C:\Users\Undertaker\Desktop\Registry kostenlos entrümpeln!.lnk

2015-06-06 12:46 - 2012-11-04 12:00 - 00001768 _____ C:\Users\Public\Desktop\Browserwahl.lnk

2015-06-06 11:18 - 2012-11-06 14:44 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\.minecraft

2015-05-24 18:06 - 2011-10-20 01:00 - 00700134 _____ C:\windows\system32\perfh007.dat

2015-05-24 18:06 - 2011-10-20 01:00 - 00149984 _____ C:\windows\system32\perfc007.dat

2015-05-24 18:06 - 2009-07-14 07:13 - 01622236 _____ C:\windows\system32\PerfStringBackup.INI

2015-05-22 20:33 - 2015-02-18 15:50 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\vlc

2015-05-17 15:47 - 2013-04-20 10:22 - 00004106 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-05-17 15:47 - 2013-04-20 10:22 - 00003854 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-05-16 13:54 - 2012-10-30 16:02 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Adobe

2015-05-15 20:08 - 2013-03-14 21:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-05-15 20:08 - 2013-03-14 21:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-05-15 15:41 - 2012-11-08 16:36 - 01649854 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2015-05-15 15:41 - 2012-11-08 16:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client

2015-05-15 15:40 - 2014-07-10 17:17 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-05-15 15:40 - 2013-07-31 20:03 - 00000000 ____D C:\windows\system32\MRT

2015-05-15 15:12 - 2012-11-08 16:16 - 140425016 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-05-15 15:06 - 2013-03-14 21:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-05-14 19:49 - 2013-05-10 12:24 - 00003892 _____ C:\windows\System32\Tasks\Registration 1und1 Task

2015-05-14 19:49 - 2013-05-10 12:24 - 00000000 ____D C:\Program Files (x86)\1und1Softwareaktualisierung

2015-05-14 09:38 - 2013-04-20 10:22 - 00000000 ____D C:\Users\Undertaker\AppData\Local\Google

2015-05-14 09:38 - 2013-04-20 10:22 - 00000000 ____D C:\Program Files (x86)\Google

2015-05-13 16:36 - 2014-07-25 18:12 - 00000000 ____D C:\Users\Undertaker\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
 

==================== Files in the root of some directories =======
 

2013-03-28 23:41 - 2013-03-28 23:41 - 0003584 _____ () C:\Users\Undertaker\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

2014-03-04 22:26 - 2014-03-04 22:26 - 0091848 _____ () C:\Users\Undertaker\AppData\Local\ext_offermosquito_uninst.exe

2013-02-28 21:15 - 2014-03-14 14:34 - 1145382 ____N () C:\Users\Undertaker\AppData\Local\Tempmusic.ogg

2011-10-19 10:21 - 2011-10-19 10:22 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log

2011-10-19 10:07 - 2011-10-19 10:08 - 0000113 _____ () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log

2011-10-19 10:15 - 2011-10-19 10:17 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log

2011-10-19 10:09 - 2011-10-19 10:15 - 0000106 _____ () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log

2011-10-19 10:17 - 2011-10-19 10:21 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
 

Some files in TEMP:

====================

C:\Users\Undertaker\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpwmh6wl.dll
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2015-06-03 22:57
 

==================== End of log ============================

LG Ani

http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?

Hallo Jürgen,
soweit arbeitet der Lappi wieder ganz normal.
Ich danke Dir recht herzlich für die Hilfe.
Ich habe allerdings noch eine weitere kurze Frage. Ich habe hier auf einem
Laufwerk sehr viele Backup Dateien. Kann ich die einfach so löschen und
immer die Neueste behalten? Denn das Laufwerk ist proppenvoll.

Danke und lg
Ani

Melde mich heute abend ausführlicher. ;)

Hallo
Ich dachte ich melde mich nochmal weil in den letzten Tagen nichts mehr kam. Muss ich noch die Programme bereinigen?
LG Ani

Hallo,
Du hättest nach 24 Stunden eine PN schicken sollen, steht in meinem 1. Posting. Hab das übersehen, weil ich ja schon geantwortet hatte. ;)

Java 7 Update 75 das bitte deinstallieren und bei Bedarf mit der aktuellen Version ersetzen.

Nach der Ausführung von DelFix kannst Du ein neues Systembackup machen. Wie das geht ist weiter unten verlinkt.

>>clean<<
Wir haben es geschafft! :abklatsch:
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.

Meine Kauf-Empfehlung:

http://deeprybka.trojaner-board.de/eset/ESS.png
ESET Smart Security

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware scannen.

Optional:
http://filepony.de/icon/noscript.png NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hallo,
so jetzt hab ich alles drüberlaufen lassen und auch das delfix. Läuft alles wie geschmiert.

Vielen lieben Dank

LG
Ani

Gerne. Machs gut! ;)