|
Plagegeister aller Art und deren Bekämpfung: www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neuWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.10.2013, 18:32 | #1 |
| www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu Hallo, seit kurzem installiert sich - trotz Aktualisierung der Startseit auf Google - immer wieder folgende Suchmaschine: www.searchnu.com/410 Vermutlich habe ich mir beim Herunterladen eines Fotobearbeitungsprogramms dieses Programm eingefangen. Was kann ich tun, um es wieder zu entfernen? Ein Antivirenprogramm habe ich nicht installiert, weil ich nach einem Fehler in "Antivir" dieses Programm nicht mehr vollständig entfernen konnte und somit eine Neuinstallation nicht möglich ist. Wäre sehr dankbar für Hilfe. Ich bin allerdings lediglich Anwender und habe vom Programmieren keine Ahnung. Supernicky |
22.10.2013, 18:40 | #2 |
/// TB-Ausbilder | www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neuMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
24.10.2013, 19:25 | #3 |
| www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu FRST Logfile:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-10-2013 01 Ran by MEDION (administrator) on MEDION-PC on 24-10-2013 20:15:13 Running from C:\Users\MEDION\Downloads Microsoft Windows 7 Home Premium (X86) OS Language: German Standard Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) =================== () C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe (Teruten) C:\Windows\system32\FsUsbExService.Exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Protexis Inc.) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe () C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe () C:\Program Files\CyberLink\Shared files\RichVideo.exe (Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Wistron) C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron Corp.) C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.) C:\Program Files\Launch Manager\WButton.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (Wistron Corp.) C:\Program Files\Launch Manager\WisLMSvc.exe (Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Jumping Bytes) C:\Program Files\Mobile Master\MMAgent.exe (Tobit.Software) C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Launcher.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin (Brother Industries, Ltd.) C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe (Jumping Bytes) C:\Program Files\Mobile Master\MMScan.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\system32\wuauclt.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McUicnt.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9177632 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1423904 2010-04-23] (Realtek Semiconductor) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [HotkeyApp] - C:\Program Files\Launch Manager\HotkeyApp.exe [200704 2009-12-14] (Wistron) HKLM\...\Run: [LMgrVolOSD] - C:\Program Files\Launch Manager\OSD.exe [348960 2009-12-12] (Wistron Corp.) HKLM\...\Run: [LMgrOSD] - "C:\Program Files\Launch Manager\OSDCtrl.exe" HKLM\...\Run: [Wbutton] - C:\Program Files\Launch Manager\Wbutton.exe [413696 2010-01-13] (Wistron Corp.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1594664 2009-12-11] (Synaptics Incorporated) HKLM\...\Run: [CLMLServer] - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink) HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [663552 2007-03-12] (Brother Industries, Ltd.) HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [65536 2007-01-26] (Brother Industries, Ltd.) HKLM\...\Run: [NPSStartup] - [x] HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.) HKLM\...\Run: [NBAgent] - C:\Program Files\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG) HKLM\...\Run: [LexwareInfoService] - C:\Program Files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339312 2010-09-15] (Haufe-Lexware GmbH & Co. KG) HKLM\...\Run: [IntelliPoint] - c:\Program Files\Microsoft IntelliPoint\ipoint.exe [1821576 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe HKCU\...\Run: [msnmsgr] - "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background HKCU\...\Run: [AutoStartNPSAgent] - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe [102400 2011-11-06] (Samsung Electronics Co., Ltd.) HKCU\...\Run: [MMAgent] - C:\Program Files\Mobile Master\MMAgent.exe [1392480 2011-10-24] (Jumping Bytes) HKCU\...\Run: [rfxsrvtray] - C:\Program Files\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software) MountPoints2: F - F:\.\Setup.exe AUTORUN=1 MountPoints2: {01bed707-faef-11e2-a2f0-806e6f6e6963} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {73e90739-fc2c-11e2-a1d5-00262dc0c3a7} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {73e9074c-fc2c-11e2-a1d5-00262dc0c3a7} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38e9e-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38eae-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38ebf-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38ed1-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38ee5-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38f07-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38f1b-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38f30-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {76e38f4b-fcef-11e2-8fa3-001e101f36d9} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {9bc06ccd-f888-11e2-a46f-00262dc0c3a7} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {9bc06ce8-f888-11e2-a46f-00262dc0c3a7} - F:\.\Setup.exe AUTORUN=1 MountPoints2: {d0762778-7a16-11e0-b1db-485d6075ddb4} - F:\CD_Start.exe MountPoints2: {e63f7c9a-fc22-11e2-90cb-001e101fb45e} - F:\.\Setup.exe AUTORUN=1 HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs HKU\Default User\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs AppInit_DLLs: [ ] () Startup: C:\Users\Kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () Startup: C:\Users\MEDION\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/410 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd URLSearchHook: (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=9477485D6075DDB4&affID=125036&tsp=5032 SearchScopes: HKCU - {2BAE751A-5EC2-4BD6-90C5-10BF14CA65C4} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 SearchScopes: HKCU - {B3784655-AFED-473B-BF8F-AA15000D924F} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} SearchScopes: HKCU - {D77EFFB8-A7DA-4089-9918-BAD71B43F53B} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=NRO&o=101917&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=EV&apn_dtid=YYYYYYYYDE&apn_uid=2AE7D9FE-FDA6-46EF-B0BA-17B7EB579C85&apn_sauid=DEE6D656-5A4B-4F4E-A865-6EB4800ABB6C BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKLM - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKLM - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File Toolbar: HKCU - &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab Handler: haufereader - No CLSID Value - Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default FF user.js: detected! => C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\user.js FF DefaultSearchEngine: Search Results FF SearchEngineOrder.1: Search Results FF SelectedSearchEngine: Search Results FF Homepage: https://www.google.de FF Keyword.URL: hxxp://dts.search-results.com/sr?src=ffb&appid=0&systemid=410&sr=0&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @Nero.com/KM - C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\babylon.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\conduit.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-1.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-2.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-3.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-4.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-5.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin-6.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\icqplugin.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\searchgol.xml FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\searchplugins\Search_Results.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: No Name - C:\Users\MEDION\AppData\Roaming\Mozilla\Firefox\Profiles\t3ftmbby.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} FF HKLM\...\Thunderbird\Extensions: [{857610fe-b36c-47f2-b4fa-6b7affe0cf5a}] - C:\Program Files\Mobile Master\ext\1\ FF Extension: Mobile Master Add-In - C:\Program Files\Mobile Master\ext\1\ ========================== Services (Whitelisted) ================= R2 ALDITALKVerbindungsassistent_Service; C:\Program Files\ALDITALKVerbindungsassistent\ALDITALKVerbindungsassistent_Service.exe [342984 2011-09-13] () R3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [687400 2011-11-25] (Nero AG) R2 Radio.fx; C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] () R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [244904 2010-02-10] () R3 WisLMSvc; C:\Program Files\Launch Manager\WisLMSvc.exe [118560 2009-10-23] (Wistron Corp.) S2 AntiVirSchedulerService; "C:\Program Files\Avira\AntiVir Desktop\sched.exe" [x] S2 AntiVirService; "C:\Program Files\Avira\AntiVir Desktop\avguard.exe" [x] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [66616 2011-07-14] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [138192 2011-07-14] (Avira GmbH) R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation) R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36608 2009-04-07] () S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [657408 2009-07-14] (Ralink Technology Corp.) S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [90112 2009-03-20] (MCCI) S3 ss_bmdfl; C:\Windows\System32\DRIVERS\ss_bmdfl.sys [14976 2009-03-20] (MCCI Corporation) S3 ss_bmdm; C:\Windows\System32\DRIVERS\ss_bmdm.sys [121856 2009-03-20] (MCCI Corporation) S1 HWiNFO32; \??\f:\DIAGNOSE\HWiNFO32\HWiNFO32.SYS [x] S3 uxddrv; \??\F:\uxddrv86.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-24 20:05 - 2013-10-24 20:05 - 01955412 _____ (Farbar) C:\Users\MEDION\Downloads\FRST64.exe 2013-10-24 20:04 - 2013-10-24 20:04 - 00000000 ____D C:\FRST 2013-10-24 20:03 - 2013-10-24 20:03 - 01088113 _____ (Farbar) C:\Users\MEDION\Downloads\FRST.exe 2013-10-18 00:54 - 2013-10-22 18:45 - 00000000 ____D C:\ProgramData\boost_interprocess 2013-10-18 00:54 - 2013-10-18 01:25 - 00000000 ____D C:\Program Files\Free mp3 Wma Converter 2013-10-18 00:54 - 2013-10-18 00:54 - 00001168 _____ C:\Users\Public\Desktop\Get The Best Facebook Chat Messenger.lnk 2013-10-18 00:54 - 2013-10-18 00:54 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\FreeAudioPack 2013-10-18 00:54 - 2011-09-29 14:20 - 02084864 _____ (NCT Company Ltd.) C:\Windows\system32\AudDesign.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 01986560 _____ (NCT Company Ltd.) C:\Windows\system32\AudFile.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 01212416 _____ (NCT Company Ltd.) C:\Windows\system32\AudioInfos.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00479232 _____ (NCT Company Ltd.) C:\Windows\system32\AudioVisu.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00458752 _____ (NCT Company Ltd.) C:\Windows\system32\AudPlayer.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00454656 _____ (NCT Company Ltd.) C:\Windows\system32\AudioRecord.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00417792 _____ (NCT Company Ltd.) C:\Windows\system32\AudDisplay.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00348160 _____ (NCT Company Ltd.) C:\Windows\system32\WMAFile.dll 2013-10-18 00:54 - 2011-09-29 14:20 - 00164144 _____ (Microsoft Corporation) C:\Windows\system32\COMCT232.OCX 2013-10-18 00:54 - 2011-09-29 14:20 - 00116296 _____ C:\Windows\system32\NCTWMAProfiles.prx 2013-10-18 00:54 - 2011-09-29 14:19 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\MSCMCFR.DLL 2013-10-18 00:54 - 2011-09-29 14:19 - 00119568 _____ (Microsoft Corporation) C:\Windows\system32\VB6FR.DLL 2013-10-18 00:54 - 2011-09-29 14:19 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\VB6STKIT.DLL 2013-10-18 00:54 - 2011-09-29 14:19 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\Mscc2fr.dll 2013-10-18 00:54 - 2011-09-29 14:19 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\CMDLGFR.DLL 2013-10-18 00:54 - 2011-09-29 14:19 - 00021504 _____ (Microsoft Corporation) C:\Windows\system32\TABCTFR.DLL 2013-10-18 00:54 - 2011-09-29 14:19 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\inetfr.DLL 2013-10-18 00:52 - 2013-10-18 00:52 - 00458744 _____ (Bandoo Media Inc) C:\Users\MEDION\Downloads\Setup21_FreeConverter.exe 2013-10-15 14:08 - 2013-10-15 14:09 - 00739856 _____ (Google Inc.) C:\Users\MEDION\Downloads\chrome_installer_30.0.1599.66.exe 2013-10-15 13:49 - 2013-10-15 13:49 - 22537616 _____ (Mozilla) C:\Users\MEDION\Downloads\Firefox_Setup_de24.0.exe 2013-10-13 20:34 - 2013-10-13 20:42 - 07940096 _____ C:\Users\MEDION\Documents\Kevin 19 Geb Karte.ppt 2013-10-12 11:37 - 2013-10-12 11:37 - 00000079 _____ C:\Windows\wininit.ini 2013-10-12 10:59 - 2013-10-12 11:00 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\MEDION\Downloads\spybotsd-2.1.21-SR2.exe 2013-10-11 22:50 - 2013-10-11 22:50 - 00001024 _____ C:\Users\Public\Desktop\Shape Collage.lnk 2013-10-11 22:50 - 2013-10-11 22:50 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\OpenCandy 2013-10-11 22:50 - 2013-10-11 22:50 - 00000000 ____D C:\Program Files\Shape Collage 2013-10-11 22:48 - 2013-10-11 22:48 - 01074928 _____ (Shape Collage Inc.) C:\Users\MEDION\Downloads\ShapeCollage-2.5.3-Setup.exe 2013-10-11 15:50 - 2013-10-11 15:50 - 00002045 _____ C:\Users\Public\Desktop\Radio.fx.LNK 2013-10-11 15:50 - 2013-10-11 15:50 - 00002031 _____ C:\Users\Public\Desktop\djukebox.LNK 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\Tobit 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Program Files\Tobit Radio.fx 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Program Files\Common Files\Tobit 2013-10-11 15:50 - 2012-01-19 12:15 - 03537752 _____ (Tobit.Software) C:\Windows\RXSUnins.exe 2013-10-11 15:50 - 2012-01-19 12:15 - 03537752 _____ (Tobit.Software) C:\Windows\RXCUnins.exe 2013-10-11 15:50 - 2012-01-03 11:38 - 02681344 _____ C:\Windows\system32\dvmsg.dll 2013-10-11 15:47 - 2013-10-11 15:48 - 16786448 _____ (Tobit.Software) C:\Users\MEDION\Downloads\radio-fx.exe 2013-10-06 23:40 - 2013-10-06 23:40 - 26944328 _____ (DVDVideoSoft Ltd. ) C:\Users\MEDION\Downloads\FreeYouTubeToMP3Converter(1).exe 2013-10-06 23:40 - 2013-10-06 23:40 - 01128840 _____ (Koyote-Lab Inc) C:\Users\MEDION\Downloads\FreeVideoConverterSetup-r135-n-bf.exe 2013-10-06 23:40 - 2013-10-06 23:40 - 01128840 _____ (Koyote-Lab Inc) C:\Users\MEDION\Downloads\FreeVideoConverterSetup-r135-n-bf(1).exe 2013-10-05 00:04 - 2013-10-15 13:51 - 00000000 ____D C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2013-10-24 20:11 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\tracing 2013-10-24 20:09 - 2013-05-31 22:48 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-10-24 20:05 - 2013-10-24 20:05 - 01955412 _____ (Farbar) C:\Users\MEDION\Downloads\FRST64.exe 2013-10-24 20:04 - 2013-10-24 20:04 - 00000000 ____D C:\FRST 2013-10-24 20:03 - 2013-10-24 20:03 - 01088113 _____ (Farbar) C:\Users\MEDION\Downloads\FRST.exe 2013-10-24 19:56 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-24 19:56 - 2009-07-14 06:34 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-24 19:55 - 2011-09-05 18:05 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-10-24 19:55 - 2011-05-09 10:29 - 01826886 _____ C:\Windows\WindowsUpdate.log 2013-10-24 19:49 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-24 19:49 - 2009-07-14 06:39 - 00109683 _____ C:\Windows\setupact.log 2013-10-22 19:19 - 2011-09-05 18:05 - 00001098 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-10-22 18:45 - 2013-10-18 00:54 - 00000000 ____D C:\ProgramData\boost_interprocess 2013-10-22 18:44 - 2011-05-09 10:17 - 00172754 _____ C:\Windows\PFRO.log 2013-10-18 01:25 - 2013-10-18 00:54 - 00000000 ____D C:\Program Files\Free mp3 Wma Converter 2013-10-18 00:54 - 2013-10-18 00:54 - 00001168 _____ C:\Users\Public\Desktop\Get The Best Facebook Chat Messenger.lnk 2013-10-18 00:54 - 2013-10-18 00:54 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\FreeAudioPack 2013-10-18 00:52 - 2013-10-18 00:52 - 00458744 _____ (Bandoo Media Inc) C:\Users\MEDION\Downloads\Setup21_FreeConverter.exe 2013-10-18 00:28 - 2012-01-21 23:35 - 00000000 ____D C:\Users\MEDION\AppData\Local\Nero_AG 2013-10-17 20:09 - 2010-06-29 00:30 - 01500018 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-15 17:43 - 2012-05-27 11:06 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-10-15 14:15 - 2011-09-05 18:05 - 00000000 ____D C:\Users\MEDION\AppData\Local\Google 2013-10-15 14:09 - 2013-10-15 14:08 - 00739856 _____ (Google Inc.) C:\Users\MEDION\Downloads\chrome_installer_30.0.1599.66.exe 2013-10-15 13:51 - 2013-10-05 00:04 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-10-15 13:51 - 2012-02-27 20:32 - 00001109 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-10-15 13:49 - 2013-10-15 13:49 - 22537616 _____ (Mozilla) C:\Users\MEDION\Downloads\Firefox_Setup_de24.0.exe 2013-10-13 20:42 - 2013-10-13 20:34 - 07940096 _____ C:\Users\MEDION\Documents\Kevin 19 Geb Karte.ppt 2013-10-12 23:35 - 2011-07-14 20:12 - 00002014 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2013-10-12 23:35 - 2011-07-14 20:12 - 00000000 ____D C:\Program Files\McAfee Security Scan 2013-10-12 11:37 - 2013-10-12 11:37 - 00000079 _____ C:\Windows\wininit.ini 2013-10-12 11:07 - 2012-02-27 22:36 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-10-12 11:00 - 2013-10-12 10:59 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\MEDION\Downloads\spybotsd-2.1.21-SR2.exe 2013-10-11 22:50 - 2013-10-11 22:50 - 00001024 _____ C:\Users\Public\Desktop\Shape Collage.lnk 2013-10-11 22:50 - 2013-10-11 22:50 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\OpenCandy 2013-10-11 22:50 - 2013-10-11 22:50 - 00000000 ____D C:\Program Files\Shape Collage 2013-10-11 22:48 - 2013-10-11 22:48 - 01074928 _____ (Shape Collage Inc.) C:\Users\MEDION\Downloads\ShapeCollage-2.5.3-Setup.exe 2013-10-11 15:50 - 2013-10-11 15:50 - 00002045 _____ C:\Users\Public\Desktop\Radio.fx.LNK 2013-10-11 15:50 - 2013-10-11 15:50 - 00002031 _____ C:\Users\Public\Desktop\djukebox.LNK 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Users\MEDION\AppData\Roaming\Tobit 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Program Files\Tobit Radio.fx 2013-10-11 15:50 - 2013-10-11 15:50 - 00000000 ____D C:\Program Files\Common Files\Tobit 2013-10-11 15:48 - 2013-10-11 15:47 - 16786448 _____ (Tobit.Software) C:\Users\MEDION\Downloads\radio-fx.exe 2013-10-11 13:42 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF 2013-10-09 21:07 - 2011-06-08 20:06 - 00000000 ____D C:\Users\Eimi\AppData\Local\Mozilla 2013-10-09 18:09 - 2012-10-20 19:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-10-09 18:09 - 2011-07-14 20:14 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2013-10-06 23:40 - 2013-10-06 23:40 - 26944328 _____ (DVDVideoSoft Ltd. ) C:\Users\MEDION\Downloads\FreeYouTubeToMP3Converter(1).exe 2013-10-06 23:40 - 2013-10-06 23:40 - 01128840 _____ (Koyote-Lab Inc) C:\Users\MEDION\Downloads\FreeVideoConverterSetup-r135-n-bf.exe 2013-10-06 23:40 - 2013-10-06 23:40 - 01128840 _____ (Koyote-Lab Inc) C:\Users\MEDION\Downloads\FreeVideoConverterSetup-r135-n-bf(1).exe 2013-10-06 21:33 - 2011-05-15 22:29 - 00000000 ____D C:\Users\MEDION\AppData\Local\Mozilla Some content of TEMP: ==================== C:\Users\Eimi\AppData\Local\Temp\AskSLib.dll C:\Users\Eimi\AppData\Local\Temp\contentDATs.exe C:\Users\Eimi\AppData\Local\Temp\drm_dialogs.dll C:\Users\Eimi\AppData\Local\Temp\drm_dyndata_7260005.dll C:\Users\Kevin\AppData\Local\Temp\AskSLib.dll C:\Users\Kevin\AppData\Local\Temp\contentDATs.exe C:\Users\MEDION\AppData\Local\Temp\installhelper.dll C:\Users\MEDION\AppData\Local\Temp\SetupDataMngr_Searchqu.exe C:\Users\MEDION\AppData\Local\Temp\SRAssetsHelper.dll C:\Users\MEDION\AppData\Local\Temp\_isED5F.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-11 16:28 Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-10-2013 01 Ran by MEDION at 2013-10-24 20:16:22 Running from C:\Users\MEDION\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== Acrobat.com (Version: 1.6.65) Adobe AIR (Version: 1.5.0.7220) Adobe Flash Player 11 ActiveX (Version: 11.9.900.117) Adobe Flash Player 11 Plugin (Version: 11.9.900.117) Adobe Reader 9.3 MUI (Version: 9.3.0) Adobe Shockwave Player 11.6 (Version: 11.6.8.638) ALDI TALK Verbindungsassistent (Version: ALDI TALK 4.0) Apple Application Support (Version: 2.3) Apple Software Update (Version: 2.1.3.127) Ashampoo Burning Studio (Version: 9.23.0) Ashampoo Photo Commander (Version: 8.1.0) Ashampoo Snap (Version: 3.4.0) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.27) Brother MFL-Pro Suite (Version: 1.00) Cisco EAP-FAST Module (Version: 2.2.14) Cisco LEAP Module (Version: 1.0.19) Cisco PEAP Module (Version: 1.1.6) Contenta Converter PREMIUM CorelDRAW Essentials 4 CorelDRAW Essentials 4 - Content (Version: 4.0) CorelDRAW Essentials 4 - Draw (Version: 4.0) CorelDRAW Essentials 4 - Filters (Version: 4.0) CorelDRAW Essentials 4 - ICA (Version: 4.0) CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0) CorelDRAW Essentials 4 - Lang BR (Version: 4.0) CorelDRAW Essentials 4 - Lang DE (Version: 4.0) CorelDRAW Essentials 4 - Lang EN (Version: 4.0) CorelDRAW Essentials 4 - Lang ES (Version: 4.0) CorelDRAW Essentials 4 - Lang FR (Version: 4.0) CorelDRAW Essentials 4 - Lang IT (Version: 4.0) CorelDRAW Essentials 4 - Lang NL (Version: 4.0) CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0) CorelDRAW Essentials 4 - Windows Shell Extension CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1) CorelDRAW Essentials 4 (Version: 4.0) CyberLink LabelPrint (Version: 2.5.2602) CyberLink MediaShow (Version: 5.0.1410a) CyberLink MediaShow Espresso (Version: 5.5.1412_24021) CyberLink PhotoNow (Version: 1.1.6904) CyberLink Power2Go (Version: 6.1.3602c) CyberLink PowerDirector (Version: 8.0.2718) CyberLink PowerDVD 9 (Version: 9.0.2925.52) CyberLink PowerDVD Copy (Version: 1.5.1306) CyberLink PowerProducer (Version: 5.0.2.2326) CyberLink YouCam (Version: 3.0.2626) ElsterFormular für Privatanwender (Version: 12.3.2.6814p) Free YouTube to MP3 Converter version 3.12.9.725 (Version: 3.12.9.725) Google Earth (Version: 7.1.1.1888) Google Update Helper (Version: 1.3.21.165) Haali Media Splitter Haufe iDesk-Browser (Version: 10.10.14.0000) Haufe iDesk-Service (Version: 10.10.25.7810) High-Definition Video Playback (Version: 11.1.10500.2.65) Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2141) Intel(R) Management Engine Components (Version: 6.0.0.1179) Intel(R) Rapid Storage Technology (Version: 9.6.0.1014) J2SE Runtime Environment 5.0 Update 9 (Version: 1.5.0.90) Java 7 Update 9 (Version: 7.0.90) Java Auto Updater (Version: 2.1.9.0) Java(TM) 6 Update 22 (Version: 6.0.220) Junk Mail filter update (Version: 14.0.8117.416) Konz 2012 (Version: 1.00.0000) Launch Manager V1.5.0.8 (Version: 1.5.0.8) Lexware Info Service (Version: 2.70.00.0081) Lidl-Fotos McAfee Security Scan Plus (Version: 3.8.130.8) Medion Home Cinema (Version: 8.0.1505) Mein CEWE FOTOBUCH (Version: 5.0.3) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6012.5000) Microsoft Choice Guard (Version: 2.0.48.0) Microsoft IntelliPoint 8.2 (Version: 8.20.468.0) Microsoft Office 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Starter 2010 - Deutsch (Version: 14.0.4763.1000) Microsoft Search Enhancement Pack (Version: 3.0.127.0) Microsoft Silverlight (Version: 4.0.60531.0) Microsoft SQL Server 2005 Compact Edition [DEU] (Version: 3.1.0000) Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000) Microsoft Sync Framework Runtime Native v1.0 (x86) (Version: 1.0.1215.0) Microsoft Sync Framework Services Native v1.0 (x86) (Version: 1.0.1215.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Windows Debugging Symbols (Version: 7601) Mobile Master (Version: 7.9.10) Mobile Master 7.9.10 (Version: 7.9.10) Mozilla Firefox 24.0 (x86 de) (Version: 24.0) Mozilla Maintenance Service (Version: 24.0) MSVCRT (Version: 14.0.1468.721) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) Nero 11 (Version: 11.0.11200) Nero 11 Disc Menus Basic (Version: 11.0.11200.12.0) Nero 11 Effects Basic (Version: 11.0.11400.14.0) Nero 11 Image Samples (Version: 11.0.11200.12.0) Nero 11 Kwik Themes Basic (Version: 11.0.11200.12.0) Nero 11 PiP Effects Basic (Version: 11.0.11400.14.0) Nero Audio Pack 1 (Version: 11.0.11500.110.0) Nero BackItUp 11 (Version: 6.0.18000.19.100) Nero BackItUp 11 Help (CHM) (Version: 11.0.10200) Nero Backup Drivers (Version: 1.0.11100.8.0) Nero Burning ROM 11 (Version: 11.0.12500.24.100) Nero Burning ROM 11 Help (CHM) (Version: 11.0.10300) Nero ControlCenter 11 (Version: 11.0.12700.0.27) Nero ControlCenter 11 Help (CHM) (Version: 11.0.10300) Nero Core Components 11 (Version: 11.0.15600.1.17) Nero CoverDesigner 11 (Version: 6.0.10800.11.100) Nero CoverDesigner 11 Help (CHM) (Version: 11.0.10300) Nero Express 11 (Version: 11.0.11900.24.100) Nero Express 11 Help (CHM) (Version: 11.0.10300) Nero Kwik Media (Version: 1.10.24000.138.100) Nero Kwik Media Help (CHM) (Version: 11.0.10200) Nero Recode 11 (Version: 5.0.13600.34.100) Nero Recode 11 Help (CHM) (Version: 11.0.10300) Nero RescueAgent 11 (Version: 4.0.10600.10.100) Nero RescueAgent 11 Help (CHM) (Version: 11.0.10400) Nero SoundTrax 11 (Version: 5.0.10700.6.100) Nero SoundTrax 11 Help (CHM) (Version: 11.0.10400) Nero Update (Version: 11.0.11500.28.0) Nero Video 11 (Version: 8.0.14600.27.100) Nero Video 11 Help (CHM) (Version: 11.0.10300) Nero WaveEditor 11 (Version: 6.0.11100.7.100) Nero WaveEditor 11 Help (CHM) (Version: 11.0.10400) nero.prerequisites.msi (Version: 11.0.20008) OpenOffice.org 3.3 (Version: 3.3.9567) PC Connectivity Solution (Version: 8.15.0.0) phase6_18 (Version: 1.80.0000) PlayReady PC Runtime x86 (Version: 1.3.0) QuickTime (Version: 7.74.80.86) Radio.fx Realtek High Definition Audio Driver (Version: 6.0.1.6096) Realtek USB 2.0 Card Reader (Version: 6.1.7600.30121) REALTEK Wireless LAN Driver (Version: 1.00.0145) SAMSUNG Mobile Composite Device Software Samsung Mobile Modem Device Software SAMSUNG Mobile Modem Driver Set Samsung Mobile phone USB driver Drive Software SAMSUNG Mobile USB Modem 1.0 Software SAMSUNG Mobile USB Modem Software Samsung New PC Studio (Version: 1.00.0000) Samsung New PC Studio USB Driver Installer (Version: 1.00.0000) SAMSUNG USB Mobile Device Software SamsungConnectivityCableDriver (Version: 6.83.6.2.1) Shape Collage Skype Click to Call (Version: 5.6.8442) Skype™ 5.5 (Version: 5.5.124) Steuer 2010 (Version: 17.00.00.0062) Steuer 2011 (Version: 19.00.7304) Steuer-Hilfesammlung 2010 (Version: 17.0.0.0) swMSM (Version: 12.0.0.1) Synaptics Pointing Device Driver (Version: 14.0.19.0) VLC media player 1.1.11 (Version: 1.1.11) welcome (Version: 11.0.21500.0.4) Windows Live Anmelde-Assistent (Version: 5.000.818.5) Windows Live Communications Platform (Version: 14.0.8117.416) Windows Live Essentials (Version: 14.0.8117.0416) Windows Live Essentials (Version: 14.0.8117.416) Windows Live Fotogalerie (Version: 14.0.8117.416) Windows Live Mail (Version: 14.0.8117.0416) Windows Live Movie Maker (Version: 14.0.8117.0416) Windows Live Sync (Version: 14.0.8117.416) Windows Live Toolbar (Version: 14.0.8117.416) Windows Live Writer (Version: 14.0.8117.0416) Windows Live-Uploadtool (Version: 14.0.8014.1029) Windows Media Encoder 9 Series Windows Media Encoder 9 Series (Version: 9.00.2980) Windows Media Player Firefox Plugin (Version: 1.0.0.8) Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) (Version: 10/12/2007 6.85.4.0) ==================== Restore Points ========================= 18-08-2013 17:00:19 Windows-Sicherung 30-08-2013 23:07:48 Windows-Sicherung 01-09-2013 19:46:35 Windows-Sicherung 10-09-2013 17:49:58 Windows-Sicherung 19-09-2013 21:52:16 Windows-Sicherung 23-09-2013 16:12:43 Windows-Sicherung 29-09-2013 20:21:56 Windows-Sicherung 06-10-2013 19:31:55 Windows-Sicherung 13-10-2013 18:21:35 Windows-Sicherung 17-10-2013 18:17:48 Windows Update 17-10-2013 18:32:17 Windows-Sicherung 17-10-2013 21:47:31 Windows-Sicherung 17-10-2013 22:16:57 Windows-Sicherung 17-10-2013 22:18:16 Windows-Sicherung 17-10-2013 22:31:15 Removed Nero Backup Drivers. 17-10-2013 22:32:44 Removed Nero 11. 17-10-2013 22:34:46 Removed Nero 11. 17-10-2013 22:39:50 Removed Nero 11. 22-10-2013 16:55:08 Windows-Sicherung ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {075AF1D7-E233-4EE4-990D-4E1CA7AB9628} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2009-07-14] (Microsoft Corporation) Task: {0FBDEE8F-EE61-4C6B-9A37-AAB92E8F7FCE} - System32\Tasks\{CC07D7BE-CCC2-475D-ADF2-5911E6EBFEC1} => C:\Program Files\Skype\\Phone\Skype.exe [2011-10-13] (Skype Technologies S.A.) Task: {1FEA5357-EA59-4BDE-8030-C571B360B60F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {2C957D6C-CC0C-4E2C-B908-629B898CB0D3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-05] (Google Inc.) Task: {438A42C6-9BCA-4975-8432-50E6FAB87F68} - System32\Tasks\GoforFilesUpdate => C:\Program Files\GoforFiles\GFFUpdater.exe Task: {5EF7D2DD-A022-4120-812E-F75295238DCF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-09-05] (Google Inc.) Task: {788AB593-2AF3-4A71-9273-40AF62070A81} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated) Task: {E137918D-A13D-457E-A848-BE6773002F37} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {EB1E747B-899B-4984-88A0-DE5671FB6637} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll 2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll 2013-10-11 15:50 - 2013-06-03 13:06 - 09907712 _____ () C:\Program Files\Tobit Radio.fx\Client\TOBITCLT.dll 2013-10-11 15:50 - 2013-05-16 14:28 - 00242688 _____ () C:\Program Files\Tobit Radio.fx\Client\rfx-client$.ger 2011-01-17 17:19 - 2011-11-06 21:00 - 00985088 _____ () C:\Program Files\OpenOffice.org 3\program\libxml2.dll 2013-10-05 00:04 - 2013-09-11 04:26 - 03279768 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\Users\MEDION\Downloads\email_7411_20120930153649.eml:OECustomProperty ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service" ==================== Faulty Device Manager Devices ============= Name: HWiNFO32 Kernel Driver Description: HWiNFO32 Kernel Driver Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: HWiNFO32 Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (10/18/2013 00:52:58 AM) (Source: Microsoft-Windows-Backup) (User: NT-AUTORITÄT) Description: Fehler bei der um 2013-10-17T22:18:16.223483300Z gestarteten Sicherung. Fehlercode: "2147942402" (%%2147942402). Suchen Sie in den Ereignisdetails nach einer Lösung, und führen Sie die Sicherung erneut aus, nachdem das Problem behoben wurde. Error: (10/18/2013 00:37:51 AM) (Source: MsiInstaller) (User: NT-AUTORITÄT) Description: Fehler beim Beenden einer Windows Installer-Transaktion: . Fehler 5 beim Beenden der Transaktion. Error: (10/11/2013 04:31:52 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. Error: (10/11/2013 04:27:57 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (10/11/2013 03:22:47 PM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/11/2013 00:11:07 AM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/09/2013 03:19:29 PM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/06/2013 09:31:30 PM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/04/2013 11:07:49 PM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (09/23/2013 07:58:09 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig. System errors: ============= Error: (10/24/2013 07:49:12 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: HWiNFO32 Error: (10/24/2013 07:49:06 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Guard" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/24/2013 07:49:04 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Planer" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/22/2013 06:44:54 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: HWiNFO32 Error: (10/22/2013 06:44:48 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Guard" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/22/2013 06:44:48 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Planer" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/17/2013 08:04:32 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: HWiNFO32 Error: (10/17/2013 08:04:25 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Guard" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/17/2013 08:04:25 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Avira AntiVir Planer" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/15/2013 05:44:19 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: HWiNFO32 Microsoft Office Sessions: ========================= Error: (10/18/2013 00:52:58 AM) (Source: Microsoft-Windows-Backup)(User: NT-AUTORITÄT) Description: 2013-10-17T22:18:16.223483300Z2147942402%%2147942402 Error: (10/18/2013 00:37:51 AM) (Source: MsiInstaller)(User: NT-AUTORITÄT) Description: 5(NULL)(NULL)(NULL)(NULL) Error: (10/11/2013 04:31:52 PM) (Source: SideBySide)(User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 Error: (10/11/2013 04:27:57 PM) (Source: SideBySide)(User: ) Description: C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (10/11/2013 03:22:47 PM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/11/2013 00:11:07 AM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/09/2013 03:19:29 PM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/06/2013 09:31:30 PM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (10/04/2013 11:07:49 PM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Error: (09/23/2013 07:58:09 PM) (Source: SideBySide)(User: ) Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3 ==================== Memory info =========================== Percentage of memory in use: 40% Total physical RAM: 2934.6 MB Available physical RAM: 1747.36 MB Total Pagefile: 5867.48 MB Available Pagefile: 4593.73 MB Total Virtual: 2047.88 MB Available Virtual: 1893.22 MB ==================== Drives ================================ Drive c: (BOOT) (Fixed) (Total:424.66 GB) (Free:268.92 GB) NTFS Drive d: (Recover) (Fixed) (Total:40 GB) (Free:19.61 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 884D7A8E) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=425 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=40 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ --- --- --- Hallo Matthias, hoffentlich hab ich alles richtig gemacht und du kannst mit den Daten etwas anfangen. Gruß Supernicky |
25.10.2013, 17:41 | #4 |
/// TB-Ausbilder | www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu Servus, Schritt 1 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3 Downloade Dir bitte Malwarebytes Anti-Malware
Bitte poste mit deiner nächsten Antwort
|
29.10.2013, 11:49 | #5 |
/// TB-Ausbilder | www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
31.10.2013, 10:01 | #6 |
/// TB-Ausbilder | www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu Thema auf Wunsch des Users wieder aufgenommen. Bitte poste die gewünschten Logdateien. |
04.11.2013, 17:02 | #7 |
/// TB-Ausbilder | www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu Fehlende Rückmeldung Dieses Thema wurde aus den Abos gelöscht. Somit bekomme ich keine Benachrichtigung über neue Antworten. PM an mich falls Du denoch weiter machen willst. Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist. Jeder andere bitte hier klicken und einen eigenen Thread erstellen! |
Themen zu www.searchnu.com/410 - ungewollte Suchmaschine aktiviert sich immer wieder neu |
aktiviert, aktualisierung, antivirenprogramm, anwender, dankbar, entferne, entfernen, fehler, folge, folgende, google, herunterladen, immer wieder, installier, installiert, konnte, kurzem, neu, neuinstallation, nicht installiert, nicht mehr, nicht möglich, programmieren, suchmaschine, trotz, ungewollte, vollständig |