Windows Version Installer

Albertron24 · 15.04.2014, 15:27

Hallo
Ich habe ein Problem mit meinem Laptop und ich geh davon aus das er von vielen Viren befallen ist, allerdings tut mein antiviren Prog. (AVG Antivir) nicht viel dagegen.
Aber erstmal zu dem Symptom

Es öffnet sich ständig ein Installationsfenster von "Windows Version Installer" was auch immer das ist, ich habe es jedenfalls ständig abgebrochen dazu muss ich ncoh sagen das der "Windows Version Installer" auf Englisch erscheint, hab mal danach gegooglet und gelesen das es Spyware sein soll allerdings hat Malwarebytes nichts gefunden.
Mein Laptop ist seitdem auch sehr langsam und unstabil (Programme schließen sich einfach mal bzw. Laptop stürzt auch mal ab) unten hab ich mit FRST64 eine Log erstellt vielleicht kann da jemand was darauf erkennen.
Vielen Dank vorab!
Grüße

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-04-2014
Ran by HP (administrator) on HP-HP on 15-04-2014 16:20:51
Running from C:\Users\HP\Desktop\Downloaded Music\FRST-OlderVersion
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
() C:\Program Files (x86)\Mobogenie\MgAssist.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
() C:\Program Files (x86)\Join Air\AssistantServices.exe
() C:\Users\HP\AppData\Roaming\VOPackage\VOsrv.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe
() C:\Program Files (x86)\Join Air\UIExec.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Dropbox, Inc.) C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2096424 2010-05-28] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-06-26] (Alcor Micro Corp.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-07-03] (IDT, Inc.)
HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [611896 2010-01-20] ()
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [TotalMediaTVMonitor] => C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe [307200 2010-04-13] (ArcSoft, Inc.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [161304 2013-08-16] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe [386584 2013-08-16] (Intel Corporation)
HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe [415256 2013-08-16] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-24] (Intel Corporation)
HKLM-x32\...\Run: [HP Envy Guides AutoPlay] => C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe [76584 2010-03-24] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [UIExec] => C:\Program Files (x86)\Join Air\UIExec.exe [132096 2009-10-10] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [574008 2011-07-11] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [766656 2014-01-09] ()
HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2014-04-08] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\WB: C:\Program Files (x86)\Stardock\MyColors\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-24] (Microsoft Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-20\...\Run: [Sidebar] => C:\Program Files\Windows Sidebar\Sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements Organizer 8.0\CAHeadless\ElementsAutoAnalyzer.exe [615808 2009-09-18] (Adobe Systems Incorporated)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [135160 2014-01-28] (PC Utilities Software Limited)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Users\HP\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=3593ca628f6847d2a90446de1e0397ef-4d613c8a6f5ea5be571be9f71d862bf0db7aae92 /CMPID=0214c
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [Facebook Update] => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-03-18] (Facebook Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {1690130a-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {16901315-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {31270651-c8f1-11e1-b728-1cc1debd7609} - F:\Startme.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {8ffb419d-892c-11e1-a437-e02a82294275} - F:\autorun.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {91878652-f5fb-11e1-8440-806e6f6e6963} - G:\windows\Install.exe
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500420AS_5VJ8RJSY&ts=1393416409&type=default&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500420AS_5VJ8RJSY&ts=1393416409&type=default&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.awesomehp.com/web/?type=ds&ts=1393082980&from=tugs&uid=ST9500420AS_5VJ8RJSY&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.awesomehp.com/?type=hp&ts=1393082980&from=tugs&uid=ST9500420AS_5VJ8RJSY
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.awesomehp.com/?type=hp&ts=1393082980&from=tugs&uid=ST9500420AS_5VJ8RJSY
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1393082980&from=tugs&uid=ST9500420AS_5VJ8RJSY&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1393082980&from=tugs&uid=ST9500420AS_5VJ8RJSY&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {C8E24698-A530-4FAA-ABED-EDD2284D3409} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319741&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1B4D0C9A-4465-4EAF-95AB-218F1AC1AE5D&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S2 70e6ca8c; C:\Program Files (x86)\Optimizer Pro\OptProCrashSvc.dll [186496 2014-02-22] ()
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
S3 hpdoccardsvc; C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\doccardsvc.exe [83240 2010-03-24] (Hewlett-Packard Developement Company, L.P.)
R2 MgAssistService; C:\Program Files (x86)\Mobogenie\MgAssist.exe [63168 2014-02-23] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2102072 2013-12-18] (AVG)
R2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [246272 2009-10-10] ()
R2 VOsrv; C:\Users\HP\AppData\Roaming\VOPackage\VOsrv.exe [61464 2014-02-21] ()
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [425104 2014-02-26] (Taiwan Shui Mu Chih Ching Technology Limited.)

==================== Drivers (Whitelisted) ====================

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-04-18] (Mobile Connector)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
S3 smsbda; C:\Windows\System32\drivers\smsbda.sys [63648 2012-04-18] (Siano)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2013-12-16] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-13 11:59 - 2014-04-15 11:55 - 00001079 _____ () C:\Users\HP\Desktop\Continue VuuPC Installation.lnk
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:53 - 2014-04-11 14:59 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-04-10 14:12 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 14:12 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 14:12 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 14:12 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 14:12 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 14:12 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 14:12 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 14:12 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 14:12 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 14:12 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 14:12 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 14:12 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 14:12 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 14:12 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 16:47 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 16:47 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 16:47 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 16:47 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 16:47 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 16:47 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 16:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 16:47 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-05 03:35 - 2014-04-05 03:35 - 00000000 _____ () C:\Windows\SysWOW64\shoF43E.tmp
2014-03-18 14:49 - 2014-03-18 14:49 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-03-17 21:22 - 2014-03-28 21:29 - 00000000 ____D () C:\Users\HP\Desktop\Ausbildung Bewerbung
2014-03-17 18:35 - 2014-04-13 00:06 - 00000000 ____D () C:\Users\HP\Desktop\Neuer Ordner
2014-03-17 13:46 - 2014-03-17 13:46 - 00000000 __RSD () C:\Users\HP\Documents\My Stationery

==================== One Month Modified Files and Folders =======

2014-04-15 16:20 - 2014-01-16 23:27 - 00000000 ____D () C:\FRST
2014-04-15 16:05 - 2012-09-14 19:45 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Skype
2014-04-15 15:57 - 2012-06-16 18:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-15 14:08 - 2010-11-22 01:58 - 02030746 _____ () C:\Windows\WindowsUpdate.log
2014-04-15 13:54 - 2014-03-09 20:31 - 00000916 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA.job
2014-04-15 13:54 - 2014-03-09 20:31 - 00000894 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core.job
2014-04-15 11:55 - 2014-04-13 11:59 - 00001079 _____ () C:\Users\HP\Desktop\Continue VuuPC Installation.lnk
2014-04-15 11:36 - 2012-12-26 23:54 - 00003168 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForHP
2014-04-15 11:36 - 2012-12-26 23:54 - 00000320 _____ () C:\Windows\Tasks\HPCeeScheduleForHP.job
2014-04-15 11:35 - 2012-07-28 15:23 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-04-15 11:35 - 2012-06-27 16:52 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-04-15 11:33 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-15 11:33 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-15 11:30 - 2014-02-19 13:35 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-15 11:27 - 2014-02-26 14:07 - 00000000 ____D () C:\Program Files (x86)\WinZipper
2014-04-15 11:26 - 2013-09-25 16:11 - 00000000 ___RD () C:\Users\HP\Dropbox
2014-04-15 11:26 - 2013-09-25 16:09 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Dropbox
2014-04-15 11:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-15 11:24 - 2009-07-14 06:51 - 00182941 _____ () C:\Windows\setupact.log
2014-04-13 00:06 - 2014-03-17 18:35 - 00000000 ____D () C:\Users\HP\Desktop\Neuer Ordner
2014-04-12 21:24 - 2010-09-25 19:53 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-04-12 21:24 - 2010-09-25 19:53 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-04-12 21:24 - 2009-07-14 07:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-12 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 16:49 - 2010-11-22 02:08 - 00426370 _____ () C:\Windows\PFRO.log
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-11 14:59 - 2014-04-10 18:53 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-04-11 14:59 - 2012-09-22 18:34 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-11 13:07 - 2013-04-27 11:56 - 00001165 _____ () C:\Windows\SysWOW64\InstallUtil.InstallLog
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 14:12 - 2013-07-13 01:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 14:07 - 2012-07-28 15:20 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 13:17 - 2012-06-16 18:46 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-06 15:50 - 2012-03-26 16:30 - 00066648 _____ () C:\Users\HP\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-06 03:19 - 2013-04-11 17:28 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SoftGrid Client
2014-04-05 03:35 - 2014-04-05 03:35 - 00000000 _____ () C:\Windows\SysWOW64\shoF43E.tmp
2014-03-28 21:29 - 2014-03-17 21:22 - 00000000 ____D () C:\Users\HP\Desktop\Ausbildung Bewerbung
2014-03-28 10:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-25 22:01 - 2012-03-26 16:27 - 00000000 ____D () C:\Users\HP
2014-03-25 01:45 - 2014-03-02 10:06 - 00000000 ____D () C:\ProgramData\AVG
2014-03-18 14:49 - 2014-03-18 14:49 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-03-18 14:49 - 2014-03-09 20:31 - 00003886 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA
2014-03-18 14:49 - 2014-03-09 20:31 - 00003518 _____ () C:\Windows\System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core
2014-03-18 01:18 - 2014-01-13 00:56 - 00000000 ____D () C:\Users\HP\Documents\Andreea
2014-03-17 15:28 - 2013-10-13 23:09 - 00000000 ____D () C:\Users\HP\Documents\Manuel
2014-03-17 13:46 - 2014-03-17 13:46 - 00000000 __RSD () C:\Users\HP\Documents\My Stationery

Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\36808-93901-counter-strike.exe
C:\Users\HP\AppData\Local\Temp\7za.exe
C:\Users\HP\AppData\Local\Temp\AskSLib.dll
C:\Users\HP\AppData\Local\Temp\autorun.dll
C:\Users\HP\AppData\Local\Temp\AutoRun.exe
C:\Users\HP\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\BackupSetup.exe
C:\Users\HP\AppData\Local\Temp\Browser_Helper_Companion_DE.exe
C:\Users\HP\AppData\Local\Temp\drm_dialogs.dll
C:\Users\HP\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\HP\AppData\Local\Temp\Extract.exe
C:\Users\HP\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\HP\AppData\Local\Temp\HPQSi.exe
C:\Users\HP\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe
C:\Users\HP\AppData\Local\Temp\Install_ipswDownloader_v15.exe
C:\Users\HP\AppData\Local\Temp\instloffer.exe
C:\Users\HP\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdrv7.dll
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdui7.dll
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
C:\Users\HP\AppData\Local\Temp\Resource.exe
C:\Users\HP\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\HP\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\HP\AppData\Local\Temp\SHSetup.exe
C:\Users\HP\AppData\Local\Temp\SIMEEI2Installer.exe
C:\Users\HP\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe
C:\Users\HP\AppData\Local\Temp\SP50656.exe
C:\Users\HP\AppData\Local\Temp\SP52264.exe
C:\Users\HP\AppData\Local\Temp\SP52407.exe
C:\Users\HP\AppData\Local\Temp\SP53462.exe
C:\Users\HP\AppData\Local\Temp\SP53546.exe
C:\Users\HP\AppData\Local\Temp\sp54620.exe
C:\Users\HP\AppData\Local\Temp\SP54714.exe
C:\Users\HP\AppData\Local\Temp\SP55150.exe
C:\Users\HP\AppData\Local\Temp\SP55151.exe
C:\Users\HP\AppData\Local\Temp\SP55493.exe
C:\Users\HP\AppData\Local\Temp\sp58915.exe
C:\Users\HP\AppData\Local\Temp\sp64126.exe
C:\Users\HP\AppData\Local\Temp\SpOrder.dll
C:\Users\HP\AppData\Local\Temp\sqlite3.exe
C:\Users\HP\AppData\Local\Temp\Uninstaller.exe
C:\Users\HP\AppData\Local\Temp\UninstallerGer.dll
C:\Users\HP\AppData\Local\Temp\UninstallerIta.dll
C:\Users\HP\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\HP\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\HP\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\HP\AppData\Local\Temp\VP6Install.exe
C:\Users\HP\AppData\Local\Temp\VP6VFW.dll
C:\Users\HP\AppData\Local\Temp\VuuPCSetup_full.exe
C:\Users\HP\AppData\Local\Temp\WtgDriverInstallX.dll
C:\Users\HP\AppData\Local\Temp\YontooIEClient.dll
C:\Users\HP\AppData\Local\Temp\_kvvuz17.dll
C:\Users\HP\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 18:11

==================== End Of Log ============================

sunjojo · 15.04.2014, 16:11

Hallo Albertron24,

mein Name ist Jonas und ich werde dir bei deiner Bereinigung helfen. Diese kann mit viel Arbeit für dich verbunden sein. Bevor wir anfangen können, lies bitte die Bereinigungsregeln und Hinweise:

Regeln zum Ablauf der Bereinigung

Arbeite die Anleitungen und Schritte sorgfältig und nacheinander ab.
Wenn du etwas nicht verstehst oder du dir unsicher bist, frage nach und schildere das Problem, so gut es geht. Handle nicht auf eigene Faust.
- Die Ausführung diverser Bereinigungsprogramme (mit Scripts aus anderen Threads) können dein Betriebssystem zerschießen!
Die Bereinigung eines Rechners in verschiedenen Foren zur selben Zeit ist verboten (Crossposting).

Installiere oder deinstalliere keine zusätzlichen Programme, lösche keine Dateien und führe nicht selbstständig Systemupdates durch.

Die Symptome können verschwunden sein, jedoch bedeutet das Verschwinden von äußeren Merkmalen einer Infektion nicht, dass du wieder clean bist.
- Ich werde dir ein eindeutiges Clean geben, solange arbeite bitte mit.

Hinweis

Die von uns benutzten Programme erstellen meist ein Ergebnisprotokoll (Logfile genannt). Bitte füge alle von mir in einem Schritt geforderten Logfiles in einer Antwort/einem Post ein.
- http://www.trojaner-board.de/137229-...code-tags.html; Falls das Logfile zu groß für einen Post ist, teile es in zwei/mehrere Posts.

Wenn du alles gelesen hast, kann es losgehen. Bitte speichere alle Programme auf dem Desktop und führe sie von dort aus.

Bitte poste noch die Addition.txt. Wenn diese nicht findest/bereits gelöscht hast, nochmal FRST starten -> Haken bei Addition.txt und auf Scan drücken

.

Albertron24 · 19.04.2014, 22:04

Vielen Dank für die Antwort Jonas!

Hab mir alles durchgelesen und bin soweit bereit, hier kommt noch die addition mit und dann kannst du mir sagen welche Programme ich laden soll und welche ich wie anzuwenden habe ;-)
Vielen Dank und frohes Osterfest!

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2014
Ran by HP at 2014-04-19 23:03:00
Running from C:\Users\HP\Desktop\Downloaded Music
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

4500_G510gm_Help (x32 Version: 000.0.439.000 - Hewlett-Packard) Hidden
4500G510gm (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
4500G510gm_Software_Min (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Premiere Elements 8.0 (HKLM-x32\...\PremElem80) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Premiere Elements 8.0 (x32 Version: 8.0.1 - Adobe Systems Incorporated) Hidden
Adobe Reader 9.5.5 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{33C7BB7A-4C65-4605-A0CD-76C38F59B0A3}) (Version: 1.2.517.35221 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.2.517.35221 - Alcor Micro Corp.) Hidden
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft TotalMedia TV (HKLM-x32\...\{D4ACEA9C-5597-4B1C-BF07-AA44BBDD3F87}) (Version: 1.0.82.170 - ArcSoft)
Assassin's Creed Revelations 1.03 (HKLM-x32\...\{33A22B2D-55BA-4508-B767-BF2E9C21A73F}) (Version: 1.03 - Ubisoft)
ATI Catalyst Install Manager (HKLM\...\{5D612990-5264-5737-5787-3173B4227EFA}) (Version: 3.0.790.0 - ATI Technologies, Inc.)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4569 - AVG Technologies)
AVG 2014 (Version: 14.0.3882 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4569 - AVG Technologies) Hidden
AVG PC TuneUp 2014 (de-DE) (x32 Version: 14.0.1001.295 - AVG) Hidden
AVG PC TuneUp 2014 (HKLM-x32\...\AVG PC TuneUp) (Version: 14.0.1001.295 - AVG)
AVG PC TuneUp 2014 (x32 Version: 14.0.1001.295 - AVG) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom 2070 Bluetooth 3.0 (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.5600 - Broadcom Corporation)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0909.1412.23625 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0909.1412.23625 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0909.1412.23625 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0909.1412.23625 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help English (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help French (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help German (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0909.1411.23625 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0909.1412.23625 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0909.1412.23625 - ATI) Hidden
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.372.000 - Hewlett-Packard) Hidden
Die Sims™ 2 (HKLM-x32\...\{2C82E097-694E-44ea-A947-2750679469CF}) (Version:  - Electronic Arts)
DocMgr (x32 Version: 130.0.000.000 - Ihr Firmenname) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
DVD Menu Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{FB4BB287-37F9-4E27-9C4D-2D3882E08EFF}) (Version: 4.1.4121 - Hewlett-Packard)
DVD Menu Pack for HP MediaSmart Video (x32 Version: 4.1.4121 - Hewlett-Packard) Hidden
Echoes of the Past: Das Schloss der Schatten (HKLM-x32\...\BFG-Echoes of the Past - Das Schloss der Schatten) (Version:  - )
Echoes of the Past: Das versteinerte Koenigshaus (HKLM-x32\...\BFG-Echoes of the Past - Das versteinerte Koenigshaus) (Version:  - )
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
Free Audio Converter version 5.0.30.1029 (HKLM-x32\...\Free Audio Converter_is1) (Version: 5.0.30.1029 - DVDVideoSoft Ltd.)
Free Audio Dub version 1.7.9.908 (HKLM-x32\...\Free Audio Dub_is1) (Version: 1.7.9.908 - DVDVideoSoft Ltd.)
Free Disc Burner version 3.0.20.1230 (HKLM-x32\...\Free Disc Burner_is1) (Version: 3.0.20.1230 - DVDVideoSoft Ltd.)
Free Studio version 5.6.3.723 (HKLM-x32\...\Free Studio_is1) (Version: 5.6.3.723 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.23.219 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.23.219 - DVDVideoSoft Ltd.)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM\...\{3623E33A-6E9A-442F-9628-570C28E01EDF}) (Version: 4.1.9.1 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Documentation (HKLM-x32\...\{90EAAEE0-C4C9-4386-AC38-77EE88255666}) (Version: 1.1.1.0 - Hewlett-Packard)
HP ENVY Document Card Utilities (HKLM-x32\...\{FEC7B56F-A010-4866-809E-F5082CF5BB8C}) (Version: 1.0.5 - Hewlett-Packard)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP MediaSmart DVD (HKLM-x32\...\InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}) (Version: 4.1.4229 - Hewlett-Packard)
HP MediaSmart DVD (x32 Version: 4.1.4229 - Hewlett-Packard) Hidden
HP MediaSmart Movies and TV (HKLM\...\{4B4E2FA2-3B1E-4147-99DB-5033981D8C2F}) (Version: 1.0.0.10 - Hewlett-Packard)
HP MediaSmart Music (HKLM-x32\...\InstallShield_{91A34181-9FAD-43AB-A35F-E7A8945B7E1C}) (Version: 4.1.4215 - Hewlett-Packard)
HP MediaSmart Music (x32 Version: 4.1.4215 - Hewlett-Packard) Hidden
HP MediaSmart Photo (HKLM-x32\...\InstallShield_{6DAF8CDC-9B04-413B-A0F2-BCC13CF8A5BF}) (Version: 4.1.4211 - Hewlett-Packard)
HP MediaSmart Photo (x32 Version: 4.1.4211 - Hewlett-Packard) Hidden
HP MediaSmart SmartMenu (HKLM\...\{731A1D36-BF17-4C76-B7E7-CC055AF8C54E}) (Version: 3.1.1.12 - Hewlett-Packard)
HP MediaSmart Video (HKLM-x32\...\InstallShield_{D12E3E7F-1B13-4933-A915-16C7DD37A095}) (Version: 4.1.4214 - Hewlett-Packard)
HP MediaSmart Video (x32 Version: 4.1.4214 - Hewlett-Packard) Hidden
HP MediaSmart Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.1.3024 - Hewlett-Packard)
HP MediaSmart Webcam (x32 Version: 4.1.3024 - Hewlett-Packard) Hidden
HP Officejet 4500 G510g-m (HKLM\...\{E5083D57-D93F-404C-A91F-1C50D67C2BEB}) (Version: 13.0 - HP)
HP Officejet 4620 series - Grundlegende Software für das Gerät (HKLM\...\{B16F9E6E-1388-472C-98C3-F32D397EF85D}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 4620 series Hilfe (HKLM-x32\...\{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}) (Version: 6.0.0 - Hewlett Packard)
HP Power Manager (HKLM-x32\...\{E44578C7-4667-4124-8BC2-1161BCA54978}) (Version: 1.4.4 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{285F722C-0E45-47DE-B38E-5B3B10FA4A7C}) (Version: 2.5.2 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{97486FBE-A3FC-4783-8D55-EA37E9D171CC}) (Version: 5.005.000.001 - Hewlett-Packard)
HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iCloud (HKLM\...\{EAFB2AD8-D92B-464C-8D97-B9CB94703C4A}) (Version: 3.0.2.163 - Apple Inc.)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6289.0 - IDT)
Intel Digital Logo (HKLM-x32\...\{0635AEC4-0E4E-4641-9CD0-07D98428EA5A}) (Version: 1.0.5 - Hewlett-Packard Company)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.1.1001 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.02.00.1002 - Intel Corporation)
ipswDownloader 1.5 (HKLM-x32\...\ipswDownloader) (Version: 1.5 - Sergey 'iOrange' Kudlay)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 20 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Java(TM) 6 Update 20 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216020FF}) (Version: 6.0.200 - Sun Microsystems, Inc.)
Join Air (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.1 - ZTE Corporation)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
LogonStudio (HKLM-x32\...\{B299E757-BE69-489D-AE78-D58ED9A73E8D}) (Version: 1.7.15 - Stardock)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Margrave Die Tochter des Schmieds (HKLM-x32\...\Margrave Die Tochter des Schmieds) (Version:  - )
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Max Payne 3 version 1.02 (HKLM-x32\...\{75D84EF7-0D8C-4e70-MAXP3-7B42A5D4E0EB}_is1) (Version: 1.02 - Black_Box)
MediaPlayerEnhance (HKLM-x32\...\MediaPlayerEnhance) (Version: 1.34.2.13 - Feven) <==== ATTENTION
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 2.1.6519.0 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8107.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Security Client DE-DE Language Pack (Version: 2.0.0657.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobogenie (HKLM-x32\...\Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION
Movie Theme Pack for HP MediaSmart Video (HKLM-x32\...\InstallShield_{3023EBDA-BF1B-4831-B347-E5018555F26E}) (Version: 4.1.4030 - Hewlett-Packard)
Movie Theme Pack for HP MediaSmart Video (x32 Version: 4.1.4030 - Hewlett-Packard) Hidden
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Network64 (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
ObjectDock Free (HKLM-x32\...\ObjectDock Free) (Version: 2.0 - Stardock Corporation)
ObjectDock Free (x32 Version: 2.0 - Stardock Corporation) Hidden
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
OpenOffice 4.0.0 (HKLM-x32\...\{B28DBCBA-60F8-40ED-B35B-F510C327946C}) (Version: 4.00.9702 - Apache Software Foundation)
Opera 12.16 (HKLM-x32\...\Opera 12.16.1860) (Version: 12.16.1860 - Opera Software ASA)
Opera Stable 20.0.1387.91 (HKLM-x32\...\Opera 20.0.1387.91) (Version: 20.0.1387.91 - Opera Software ASA)
Optimizer Pro v3.2 (HKLM-x32\...\Optimizer Pro_is1) (Version:  - ) <==== ATTENTION
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.17.304.2010 - Realtek)
Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
SmartSound Quicktracks for Premiere Elements 8.0 (HKLM-x32\...\InstallShield_{4685A344-6718-4923-AA9D-158A0A2E1CFB}) (Version: 3.11.3090 - SmartSound Software Inc)
SmartSound Quicktracks for Premiere Elements 8.0 (x32 Version: 3.11.3090 - SmartSound Software Inc) Hidden
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.12.8.23 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.094 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.094 - Sony)
Status (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Studie zur Verbesserung von HP Officejet 4620 series Produkten (HKLM\...\{ABBC6F00-E9C9-4B1E-B046-8FFD7BA3A456}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.4 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.24951 - TeamViewer)
The Amazing Spider-Man (HKLM-x32\...\Steam App 212580) (Version:  - )
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
VirtualDJ Home FREE (HKLM-x32\...\{5E1375CB-6792-4464-8715-CC3EC83D48FA}) (Version: 7.0.5 - Atomix Productions)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.0.1 (HKLM-x32\...\VLC media player) (Version: 2.0.1 - VideoLAN)
VO Package (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - )
VoiceOver Kit (HKLM-x32\...\{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}) (Version: 1.42.128.0 - Apple Inc.)
Webfuii (HKLM\...\Webfuii) (Version: 2014.02.26.045520 - Webfuii)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
Winamp (HKLM-x32\...\Winamp) (Version: 5.623  - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKCU\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.11 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.11.0 - win.rar GmbH)
WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.29 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
Youda Legend (HKLM-x32\...\Youda Legend) (Version:  - )

==================== Restore Points  =========================

14-03-2014 07:37:23 Windows Update
16-03-2014 18:15:15 Windows-Sicherung
20-03-2014 11:30:18 Windows Update
23-03-2014 18:05:32 Windows-Sicherung
30-03-2014 17:05:04 Windows-Sicherung
06-04-2014 17:00:08 Windows-Sicherung
10-04-2014 12:04:14 Windows Update
10-04-2014 16:54:02 Installed SpyHunter
13-04-2014 17:46:22 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {03A5FF70-1D13-4E58-B7FF-886056B57EAB} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2011-05-10] (Hewlett-Packard)
Task: {06EAF230-40B1-4E38-A72A-14EED8D00BF3} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-03-18] (Facebook Inc.)
Task: {085EE18A-1C6E-467F-8B13-2B355650308D} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {0BF106BC-696F-4F5F-99FB-F9D0BE9A6749} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {10D36328-EE2A-417C-89D6-341F0808CB63} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-04-04] (Adobe Systems Incorporated)
Task: {280203CD-0D85-4B93-B067-D25F1F7326F3} - \DealPlyUpdate ATTENTION ====> No Task File
Task: {2AE1A30B-EA22-48B9-80BE-03EBBAF8E650} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)
Task: {3CF40B0C-CF71-46CE-8B8E-2E3CC06BA9AA} - \MySearchDial ATTENTION ====> No Task File
Task: {3EB77827-2B91-4FC6-B0D3-7F68ED5A7A74} - System32\Tasks\{F9825960-7E1A-4E86-9820-ADE7D55057D2} => c:\program files (x86)\opera\opera.exe [2013-07-28] (Opera Software)
Task: {4B13A1CE-93E0-438C-BF38-0D3A9A5DAEA9} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {5C12CB2F-EE49-4D20-BFC4-466CB42C4141} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe [2010-06-24] (CyberLink)
Task: {6AEB52EA-88B2-4EA6-9334-62EE62BE0B26} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {7B447DE7-5A18-4C47-98A9-7B44A507B330} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {7E336CB1-AF17-4AE2-A104-9C6591CE5B9A} - System32\Tasks\HPCustParticipation HP Officejet 4620 series => C:\Program Files\HP\HP Officejet 4620 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {96070DBE-2AA4-496E-962A-760047B407DC} - System32\Tasks\HPCeeScheduleForHP => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {A355126A-7C62-42BF-B995-356019215A89} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {B6699E17-7081-487C-9819-E56C58D39023} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-03-18] (Facebook Inc.)
Task: {C41B1D87-62AE-4AF5-97DA-0784DDDE1164} - System32\Tasks\RecoveryCDWin7 => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2010-05-25] ()
Task: {D4886CA2-510C-4DD1-B6E8-B69BC86D6505} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\AVG\AVG PC TuneUp\OneClick.exe [2013-12-18] (AVG)
Task: {D56DF76E-CCF2-4703-AABF-A6CB906E01BF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {DF9C227E-3F90-429E-A45E-EF57F86849A0} - System32\Tasks\{1E410D83-58A1-4A0B-BA29-75648B453A3A} => c:\program files (x86)\opera\opera.exe [2013-07-28] (Opera Software)
Task: {EDF4F9AE-02B5-470D-81EC-0ED717724C51} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {F66D981C-42E4-4DA3-8454-5FD58DEAAA68} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core.job => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA.job => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForHP.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2010-10-04 19:54 - 2010-10-04 19:54 - 00776704 _____ () C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.dll
2014-02-22 17:30 - 2014-02-23 18:41 - 00063168 _____ () C:\Program Files (x86)\Mobogenie\MgAssist.exe
2014-02-22 17:30 - 2014-01-09 10:01 - 00766656 _____ () C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
2013-12-18 10:38 - 2013-12-18 10:38 - 00742200 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2012-11-14 22:04 - 2009-10-10 12:57 - 00246272 _____ () C:\Program Files (x86)\Join Air\AssistantServices.exe
2014-02-21 23:45 - 2014-02-21 23:45 - 00061464 _____ () C:\Users\HP\AppData\Roaming\VOPackage\VOsrv.exe
2010-01-20 17:20 - 2010-01-20 17:20 - 00611896 _____ () C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
2012-11-14 22:04 - 2009-10-10 12:56 - 00132096 _____ () C:\Program Files (x86)\Join Air\UIExec.exe
2010-09-09 15:50 - 2010-09-09 15:50 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-09-09 14:11 - 2010-09-09 14:11 - 00270336 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2014-02-26 14:07 - 2014-02-26 14:07 - 00612496 _____ () C:\Program Files (x86)\WinZipper\sqlite3.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-02-22 17:30 - 2014-01-09 09:50 - 00061440 _____ () C:\Program Files (x86)\Mobogenie\Device.dll
2014-02-22 17:30 - 2014-01-09 09:51 - 00471040 _____ () C:\Program Files (x86)\Mobogenie\DCR.dll
2010-10-04 19:54 - 2010-10-04 19:54 - 00675840 _____ () C:\Program Files (x86)\Stardock\ObjectDockFree\DockShellHook.dll
2009-07-13 23:03 - 2009-07-14 03:15 - 00364544 _____ () C:\Windows\SysWOW64\msjetoledb40.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\HP\AppData\Roaming\Dropbox\bin\libcef.dll
2010-10-04 19:54 - 2010-10-04 19:54 - 00807936 _____ () C:\Program Files (x86)\Stardock\ObjectDockFree\CrashRpt.dll
2010-10-04 19:54 - 2010-10-04 19:54 - 00053760 _____ () C:\Program Files (x86)\Stardock\ObjectDockFree\zlib.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00835584 _____ () C:\Program Files (x86)\Opera\gstreamer\gstreamer.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00093696 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioconvert.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00094208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstaudioresample.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00057344 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstautodetect.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00096256 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstcoreplugins.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00062976 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdecodebin2.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00067072 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstdirectsound.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00158208 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00312832 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstoggdec.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00038912 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwaveform.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00073728 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwavparse.dll
2012-06-16 18:46 - 2013-07-28 12:19 - 00101888 _____ () C:\Program Files (x86)\Opera\gstreamer\plugins\gstwebmdec.dll
2014-03-13 17:57 - 2014-03-13 17:57 - 16276872 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
2014-02-14 13:07 - 2014-02-14 13:07 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\532b451bd8bb8c4e6228ff5f84fe1786\IsdiInterop.ni.dll
2010-11-22 02:05 - 2010-03-24 15:11 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:0EC7A545
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:AECF4772

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MSIServer => ""="Service"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Stardock MyColors.lnk => C:\Windows\pss\Stardock MyColors.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^HP^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^HP^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Stardock ObjectDock.lnk => C:\Windows\pss\Stardock ObjectDock.lnk.Startup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Bing Bar => "C:\Program Files (x86)\MSN Toolbar\Platform\5.0.1438.0\mswinext.exe"
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: mobilegeni daemon => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\Steam.exe" -silent
MSCONFIG\startupreg: Sweetpacks Communicator => C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
MSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"

==================== Faulty Device Manager Devices =============

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/19/2014 10:40:27 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 828724

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 828724

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1029

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1029

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 240444

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 240444

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (04/18/2014 02:50:15 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst HPWMISVC erreicht.

Error: (04/18/2014 02:45:26 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:25 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:24 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:23 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:22 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:21 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:11 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.

Error: (04/18/2014 02:45:09 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "AVGIDSAgent" wurde mit folgendem dienstspezifischem Fehler beendet: %%-536753635.


Microsoft Office Sessions:
=========================
Error: (04/19/2014 10:40:27 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\$Recycle.Bin\S-1-5-21-2908145472-1249041861-3166297183-1000\$R481D0Y.exe

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 828724

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 828724

Error: (04/19/2014 00:35:59 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1029

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1029

Error: (04/19/2014 00:22:12 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 240444

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 240444

Error: (04/19/2014 00:12:18 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second


==================== Memory info =========================== 

Percentage of memory in use: 55%
Total physical RAM: 3893.61 MB
Available physical RAM: 1746.23 MB
Total Pagefile: 7785.4 MB
Available Pagefile: 5082.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:439.41 GB) (Free:203.21 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:26.05 GB) (Free:3.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: EAB25A0B)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=439 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=26 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================

sunjojo · 20.04.2014, 11:15

Hi,

Zitat:

Vielen Dank und frohes Osterfest!

Danke, dass wünsche ich dir auch

.

Schritt 1
Bitte deinstalliere folgende Programme:

MediaPlayerEnhance
Mobogenie
Optimizer Pro v3.2
VO Package
Webfuii
WinZipper

Gehe dafür auf:

Windows XP: Start -> Systemsteuerung -> Kategorieansicht auswählen (falls nicht voreingestellt) -> Software
Windows Vista/7: Start -> Systemsteuerung -> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) -> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

und wähle die angegeben Programme aus. Drücke Entfernen (Windows XP) oder Deinstallieren (Windows Vista/7/8).

Schritt 2
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

AdwCleaner[Sx].txt
JRT.txt
FRST.txt

Albertron24 · 20.04.2014, 16:27

Soweit alles Verstanden allerdings gibts bei Schritt1 schon die ersten Probleme, MediaPlayerEnahnce lässt sich nicht deeinstallieren, da passiert einfach rein garnichts wenn ich auf deeinstallieren drücke (benutze Win7) bei OptimizerPro und Webfuii kommen Nachrichten (siehe die 2 Anhänge) ich habe bei jetzt mal nichts gedrückt bei den aufkommenden Nachrichten da ich nichts falsch machen wollte, deshalb habe ich auch jetzt erstmal nicht mit Schritt 2 weiter gemacht, hoffe das war nicht verkehrt.

Grüße

sunjojo · 20.04.2014, 17:31

Zitat:

Soweit alles Verstanden allerdings gibts bei Schritt1 schon die ersten Probleme, MediaPlayerEnahnce lässt sich nicht deeinstallieren, da passiert einfach rein garnichts wenn ich auf deeinstallieren drücke (benutze Win7) bei OptimizerPro und Webfuii kommen Nachrichten (siehe die 2 Anhänge) ich habe bei jetzt mal nichts gedrückt bei den aufkommenden Nachrichten da ich nichts falsch machen wollte, deshalb habe ich auch jetzt erstmal nicht mit Schritt 2 weiter gemacht, hoffe das war nicht verkehrt.

Kein Problem, einfach die nächsten Schritte abarbeiten

.

Albertron24 · 20.04.2014, 21:05

Alles klar vielen dank

so hier kommen die Logs der Reihe nach beginnend mit AdwCleaner - JRT - FRST

Code:

ATTFilter

# AdwCleaner v3.100 - Bericht erstellt am 20/04/2014 um 21:27:24
# Aktualisiert 20/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : HP - HP-HP
# Gestartet von : C:\Users\HP\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : 70e6ca8c

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro v3.2
Ordner Gelöscht : C:\Program Files (x86)\AskPartnerNetwork
Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoft
Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro
Ordner Gelöscht : C:\Program Files (x86)\WinZipper
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft
Ordner Gelöscht : C:\Windows\SysWOW64\SearchProtect
Ordner Gelöscht : C:\Program Files\Uninstaller
Ordner Gelöscht : C:\Users\HP\.android
Ordner Gelöscht : C:\Users\HP\AppData\Local\genienext
Ordner Gelöscht : C:\Users\HP\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\HP\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\HP\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\HP\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\HP\AppData\Local\Temp\DVDVideoSoft
Ordner Gelöscht : C:\Users\HP\AppData\Roaming\awesomehp
Ordner Gelöscht : C:\Users\HP\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\Users\HP\AppData\Roaming\DVDVideoSoft
Ordner Gelöscht : C:\Users\HP\AppData\Roaming\Optimizer Pro
Ordner Gelöscht : C:\Users\HP\AppData\Roaming\SupTab
Ordner Gelöscht : C:\Users\HP\Documents\DVDVideoSoft
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\HP\daemonprocess.txt
Datei Gelöscht : C:\Users\HP\Desktop\Continue VuuPC Installation.lnk

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Optimizer Pro]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{41564952-412D-5637-00A7-7A786E7484D7}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0400EBCA-042C-4000-AA89-9713FBEDB671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BD19251-4B4B-4B94-AB16-617106245BB7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3281114F-BCAB-45E3-80D9-A6CD64D4E636}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44533FCB-F9FB-436A-8B6B-CF637B2D465A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{44B29DDD-CF7A-454A-A275-A322A398D93F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{917CAAE9-DD47-4025-936E-1414F07DF5B8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A4DE94DB-DF03-45A3-8A5D-D1B7464B242D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AA0F50A8-2618-4AE4-A779-9F7378555A8F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B2DB115C-8278-4947-9A07-57B53D1C4215}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B97FC455-DB33-431D-84DB-6F1514110BD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C67281E0-78F5-4E49-9FAE-4B1B2ADAF17B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E72E9312-0367-4216-BFC7-21485FA8390B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F6CCB6C9-127E-44AE-8552-B94356F39FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FFD25630-2734-4AE9-88E6-21BF6525F3FE}
Schlüssel Gelöscht : HKCU\Software\AnyProtect
Schlüssel Gelöscht : HKCU\Software\AVG Secure Search
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : HKLM\Software\supTab
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\V9
Schlüssel Gelöscht : HKLM\Software\winzipersvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Optimizer Pro_is1

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

*************************

AdwCleaner[R0].txt - [14397 octets] - [21/01/2014 15:07:03]
AdwCleaner[R1].txt - [8135 octets] - [20/04/2014 21:25:36]
AdwCleaner[R2].txt - [8195 octets] - [20/04/2014 21:26:39]
AdwCleaner[S0].txt - [13193 octets] - [21/01/2014 15:08:53]
AdwCleaner[S1].txt - [7046 octets] - [20/04/2014 21:27:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [7106 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by HP on 20.04.2014 at 21:36:46,43
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\shoF43E.tmp



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.04.2014 at 21:44:02,70
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by HP (administrator) on HP-HP on 20-04-2014 22:02:19
Running from C:\Users\HP\Desktop\Downloaded Music\FRST-OlderVersion
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Dropbox, Inc.) C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe
() C:\Program Files (x86)\Join Air\UIExec.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
() C:\Program Files (x86)\Join Air\AssistantServices.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2096424 2010-05-28] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-06-26] (Alcor Micro Corp.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-07-03] (IDT, Inc.)
HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [611896 2010-01-20] ()
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [TotalMediaTVMonitor] => C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe [307200 2010-04-13] (ArcSoft, Inc.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-24] (Intel Corporation)
HKLM-x32\...\Run: [HP Envy Guides AutoPlay] => C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe [76584 2010-03-24] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [UIExec] => C:\Program Files (x86)\Join Air\UIExec.exe [132096 2009-10-10] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [574008 2011-07-11] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5180432 2014-04-06] (AVG Technologies CZ, s.r.o.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-04-08] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\WB: C:\Program Files (x86)\Stardock\MyColors\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-24] (Microsoft Corporation)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements Organizer 8.0\CAHeadless\ElementsAutoAnalyzer.exe [615808 2009-09-18] (Adobe Systems Incorporated)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Users\HP\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=3593ca628f6847d2a90446de1e0397ef-4d613c8a6f5ea5be571be9f71d862bf0db7aae92 /CMPID=0214c
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [Facebook Update] => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-03-18] (Facebook Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {1690130a-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {16901315-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {31270651-c8f1-11e1-b728-1cc1debd7609} - F:\Startme.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {8ffb419d-892c-11e1-a437-e02a82294275} - F:\autorun.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {91878652-f5fb-11e1-8440-806e6f6e6963} - G:\windows\Install.exe
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {C8E24698-A530-4FAA-ABED-EDD2284D3409} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319741&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1B4D0C9A-4465-4EAF-95AB-218F1AC1AE5D&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3655184 2014-04-01] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [291912 2014-03-27] (AVG Technologies CZ, s.r.o.)
S3 hpdoccardsvc; C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\doccardsvc.exe [83240 2010-03-24] (Hewlett-Packard Developement Company, L.P.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2102072 2013-12-18] (AVG)
R2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [246272 2009-10-10] ()

==================== Drivers (Whitelisted) ====================

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [236824 2014-04-01] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [192792 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [236824 2014-03-27] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [324376 2014-03-27] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [130840 2014-03-31] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [32536 2014-03-27] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-03-31] (AVG Technologies CZ, s.r.o.)
S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-04-18] (Mobile Connector)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
S3 smsbda; C:\Windows\System32\drivers\smsbda.sys [63648 2012-04-18] (Siano)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2013-12-16] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-20 21:44 - 2014-04-20 21:44 - 00000686 _____ () C:\Users\HP\Desktop\JRT.txt
2014-04-20 21:35 - 2014-04-20 21:35 - 01016261 _____ (Thisisu) C:\Users\HP\Desktop\JRT.exe
2014-04-20 21:25 - 2014-04-20 21:25 - 01308369 _____ () C:\Users\HP\Desktop\adwcleaner.exe
2014-04-20 17:13 - 2014-04-20 17:13 - 00003142 _____ () C:\Windows\System32\Tasks\{43786210-50D4-4BF9-B688-256C28B51DC7}
2014-04-18 20:53 - 2014-04-18 20:53 - 00000000 ____D () C:\ProgramData\Avg_Update_0414b
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:53 - 2014-04-11 14:59 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-04-10 14:12 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 14:12 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 14:12 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 14:12 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 14:12 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 14:12 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 14:12 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 14:12 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 14:12 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 14:12 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 14:12 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 14:12 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 14:12 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 14:12 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 16:47 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 16:47 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 16:47 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 16:47 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 16:47 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 16:47 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 16:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 16:47 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-04-01 21:03 - 2014-04-01 21:03 - 00236824 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-03-31 16:20 - 2014-03-31 16:20 - 00274200 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-03-31 16:06 - 2014-03-31 16:06 - 00130840 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-03-27 22:14 - 2014-03-27 22:14 - 00192792 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-03-27 22:14 - 2014-03-27 22:14 - 00153368 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-03-27 22:07 - 2014-03-27 22:07 - 00236824 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-03-27 22:05 - 2014-03-27 22:05 - 00324376 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-03-27 22:03 - 2014-03-27 22:03 - 00032536 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys

==================== One Month Modified Files and Folders =======

2014-04-20 22:02 - 2014-01-16 23:27 - 00000000 ____D () C:\FRST
2014-04-20 21:57 - 2012-06-16 18:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-20 21:44 - 2014-04-20 21:44 - 00000686 _____ () C:\Users\HP\Desktop\JRT.txt
2014-04-20 21:41 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-20 21:41 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-20 21:35 - 2014-04-20 21:35 - 01016261 _____ (Thisisu) C:\Users\HP\Desktop\JRT.exe
2014-04-20 21:33 - 2013-09-25 16:09 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Dropbox
2014-04-20 21:32 - 2013-09-25 16:11 - 00000000 ___RD () C:\Users\HP\Dropbox
2014-04-20 21:31 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-20 21:31 - 2009-07-14 06:51 - 00184242 _____ () C:\Windows\setupact.log
2014-04-20 21:30 - 2010-11-22 01:58 - 01090638 _____ () C:\Windows\WindowsUpdate.log
2014-04-20 21:29 - 2014-01-21 15:06 - 00000000 ____D () C:\AdwCleaner
2014-04-20 21:29 - 2012-03-26 16:27 - 00000000 ____D () C:\Users\HP
2014-04-20 21:25 - 2014-04-20 21:25 - 01308369 _____ () C:\Users\HP\Desktop\adwcleaner.exe
2014-04-20 21:19 - 2014-02-19 13:35 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-20 21:15 - 2010-11-22 02:08 - 00426926 _____ () C:\Windows\PFRO.log
2014-04-20 17:13 - 2014-04-20 17:13 - 00003142 _____ () C:\Windows\System32\Tasks\{43786210-50D4-4BF9-B688-256C28B51DC7}
2014-04-20 16:54 - 2014-03-09 20:31 - 00000916 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA.job
2014-04-20 00:32 - 2012-12-26 23:54 - 00000320 _____ () C:\Windows\Tasks\HPCeeScheduleForHP.job
2014-04-18 22:15 - 2010-09-25 19:53 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-04-18 22:15 - 2010-09-25 19:53 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-04-18 22:15 - 2009-07-14 07:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-18 20:53 - 2014-04-18 20:53 - 00000000 ____D () C:\ProgramData\Avg_Update_0414b
2014-04-18 00:16 - 2012-09-14 19:45 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Skype
2014-04-17 16:18 - 2014-03-09 20:31 - 00000894 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core.job
2014-04-15 11:36 - 2012-12-26 23:54 - 00003168 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForHP
2014-04-15 11:35 - 2012-07-28 15:23 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-04-15 11:35 - 2012-06-27 16:52 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-04-13 00:06 - 2014-03-17 18:35 - 00000000 ____D () C:\Users\HP\Desktop\Neuer Ordner
2014-04-12 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-11 14:59 - 2014-04-10 18:53 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-04-11 14:59 - 2012-09-22 18:34 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-11 13:07 - 2013-04-27 11:56 - 00001165 _____ () C:\Windows\SysWOW64\InstallUtil.InstallLog
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 14:12 - 2013-07-13 01:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 14:07 - 2012-07-28 15:20 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 13:17 - 2012-06-16 18:46 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-06 15:50 - 2012-03-26 16:30 - 00066648 _____ () C:\Users\HP\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-06 03:19 - 2013-04-11 17:28 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SoftGrid Client
2014-04-01 21:03 - 2014-04-01 21:03 - 00236824 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2014-03-31 16:20 - 2014-03-31 16:20 - 00274200 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
2014-03-31 16:06 - 2014-03-31 16:06 - 00130840 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys
2014-03-28 21:29 - 2014-03-17 21:22 - 00000000 ____D () C:\Users\HP\Desktop\Ausbildung Bewerbung
2014-03-28 10:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-27 22:14 - 2014-03-27 22:14 - 00192792 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys
2014-03-27 22:14 - 2014-03-27 22:14 - 00153368 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys
2014-03-27 22:07 - 2014-03-27 22:07 - 00236824 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2014-03-27 22:05 - 2014-03-27 22:05 - 00324376 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys
2014-03-27 22:03 - 2014-03-27 22:03 - 00032536 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys
2014-03-25 01:45 - 2014-03-02 10:06 - 00000000 ____D () C:\ProgramData\AVG

Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\36808-93901-counter-strike.exe
C:\Users\HP\AppData\Local\Temp\7za.exe
C:\Users\HP\AppData\Local\Temp\AskSLib.dll
C:\Users\HP\AppData\Local\Temp\autorun.dll
C:\Users\HP\AppData\Local\Temp\AutoRun.exe
C:\Users\HP\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\BackupSetup.exe
C:\Users\HP\AppData\Local\Temp\Browser_Helper_Companion_DE.exe
C:\Users\HP\AppData\Local\Temp\drm_dialogs.dll
C:\Users\HP\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\HP\AppData\Local\Temp\Extract.exe
C:\Users\HP\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\HP\AppData\Local\Temp\HPQSi.exe
C:\Users\HP\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe
C:\Users\HP\AppData\Local\Temp\Install_ipswDownloader_v15.exe
C:\Users\HP\AppData\Local\Temp\instloffer.exe
C:\Users\HP\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdrv7.dll
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdui7.dll
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
C:\Users\HP\AppData\Local\Temp\Resource.exe
C:\Users\HP\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\HP\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\HP\AppData\Local\Temp\SHSetup.exe
C:\Users\HP\AppData\Local\Temp\SIMEEI2Installer.exe
C:\Users\HP\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe
C:\Users\HP\AppData\Local\Temp\SP50656.exe
C:\Users\HP\AppData\Local\Temp\SP52264.exe
C:\Users\HP\AppData\Local\Temp\SP52407.exe
C:\Users\HP\AppData\Local\Temp\SP53462.exe
C:\Users\HP\AppData\Local\Temp\SP53546.exe
C:\Users\HP\AppData\Local\Temp\sp54620.exe
C:\Users\HP\AppData\Local\Temp\SP54714.exe
C:\Users\HP\AppData\Local\Temp\SP55150.exe
C:\Users\HP\AppData\Local\Temp\SP55151.exe
C:\Users\HP\AppData\Local\Temp\SP55493.exe
C:\Users\HP\AppData\Local\Temp\sp58915.exe
C:\Users\HP\AppData\Local\Temp\sp64126.exe
C:\Users\HP\AppData\Local\Temp\SpOrder.dll
C:\Users\HP\AppData\Local\Temp\sqlite3.exe
C:\Users\HP\AppData\Local\Temp\Uninstaller.exe
C:\Users\HP\AppData\Local\Temp\UninstallerGer.dll
C:\Users\HP\AppData\Local\Temp\UninstallerIta.dll
C:\Users\HP\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\HP\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\HP\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\HP\AppData\Local\Temp\VP6Install.exe
C:\Users\HP\AppData\Local\Temp\VP6VFW.dll
C:\Users\HP\AppData\Local\Temp\VuuPCSetup_full.exe
C:\Users\HP\AppData\Local\Temp\WtgDriverInstallX.dll
C:\Users\HP\AppData\Local\Temp\YontooIEClient.dll
C:\Users\HP\AppData\Local\Temp\_kvvuz17.dll
C:\Users\HP\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 00:36

==================== End Of Log ============================

--- --- ---

Großes Dankeschön für die bisher geleistete Hilfe und die schnelle Antwort.

sunjojo · 21.04.2014, 20:30

So gehts weiter:

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319741&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1B4D0C9A-4465-4EAF-95AB-218F1AC1AE5D&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:53 - 2014-04-11 14:59 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
AlternateDataStreams: C:\ProgramData\Temp:0EC7A545
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:AECF4772
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Sweetpacks Communicator" /f

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Starte noch einmal FRST.

Ändere keine der Voreinstellungen und drücke auf Scan.
Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Poste folgende Logfiles in deiner nächsten Antwort:

Fixlog.txt
Log.txt
FRST.txt

Albertron24 · 23.04.2014, 22:30

Hier kommt die Fixlog

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-04-2014
Ran by HP at 2014-04-22 15:57:54 Run:1
Running from C:\Users\HP\Desktop\Downloaded Music
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - URL hxxp://search.conduit.com/Results.aspx?ctid=CT3319741&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SP1B4D0C9A-4465-4EAF-95AB-218F1AC1AE5D&q={searchTerms}&SSPV=
SearchScopes: HKCU - SuggestionsURL_JSON hxxp://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {24E61EBC-A307-4A9A-8F68-F485E6C5212F} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
2014-04-10 19:04 - 2014-04-10 19:04 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-04-10 18:53 - 2014-04-11 14:59 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
AlternateDataStreams: C:\ProgramData\Temp:0EC7A545
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:AECF4772
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon" /f
Reg: reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Sweetpacks Communicator" /f
         
*****************

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
HKCR\CLSID\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\SuggestionsURL_JSON => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
HKCR\CLSID\{24E61EBC-A307-4A9A-8F68-F485E6C5212F} => Key deleted successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP => Moved successfully.
C:\ProgramData\Temp => ":0EC7A545" ADS removed successfully.
C:\ProgramData\Temp => ":373E1720" ADS removed successfully.
C:\ProgramData\Temp => ":AECF4772" ADS removed successfully.

========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


========= reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Sweetpacks Communicator" /f =========

Der Vorgang wurde erfolgreich beendet.



========= End of Reg: =========


==== End of Fixlog ====

hier die Log von Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b965da1732025b4fb96cbf6338df82c7
# engine=16919
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-03 01:20:30
# local_time=2014-02-03 02:20:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 18371 10082167 11148 0
# compatibility_mode=5893 16776574 100 94 10125293 143063480 0 0
# scanned=101071
# found=3
# cleaned=0
# scan_time=4417
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooIEClient.dll.vir"
sh=AEC860E4CDE64D747F215B83C8DE70EE0EBCB3A0 ft=1 fh=cde73a4bb58c0fe9 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=FDF652F803592E6840E076A89A19BF655686B8A8 ft=1 fh=de76e936397b25d2 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll.vir"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b965da1732025b4fb96cbf6338df82c7
# engine=16919
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-03 06:07:34
# local_time=2014-02-03 07:07:34 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 35595 10099391 28372 0
# compatibility_mode=5893 16776574 100 94 10142517 143080704 0 0
# scanned=315629
# found=7
# cleaned=0
# scan_time=17188
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooIEClient.dll.vir"
sh=AEC860E4CDE64D747F215B83C8DE70EE0EBCB3A0 ft=1 fh=cde73a4bb58c0fe9 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=FDF652F803592E6840E076A89A19BF655686B8A8 ft=1 fh=de76e936397b25d2 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll.vir"
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooIEClient.dll"
sh=E1E179B21BA4036F1F7BDD29AAC0EACFECFEFE61 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers.crx"
sh=F074C932D8081C74F6A220D885567DA41DA23196 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.B application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers\background.html"
sh=37A7D8AAD5C174108E8AE0E27097B55D34A27044 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.A application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers\yl.js"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b965da1732025b4fb96cbf6338df82c7
# engine=17132
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-19 11:41:50
# local_time=2014-02-19 12:41:50 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 5881 11458647 0 0
# compatibility_mode=5893 16776574 100 94 11501773 144439960 0 0
# scanned=94711
# found=4
# cleaned=0
# scan_time=1818
sh=37FF9AF0A4A175AFF14252C3FFA6CCC03A24ACBD ft=1 fh=ff3435be19cccc9e vn="a variant of Win32/SpeedingUpMyPC.F application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir"
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooIEClient.dll.vir"
sh=AEC860E4CDE64D747F215B83C8DE70EE0EBCB3A0 ft=1 fh=cde73a4bb58c0fe9 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=FDF652F803592E6840E076A89A19BF655686B8A8 ft=1 fh=de76e936397b25d2 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll.vir"
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b965da1732025b4fb96cbf6338df82c7
# engine=18003
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-23 09:12:59
# local_time=2014-04-23 11:12:59 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 4848220 149917429 0 0
# scanned=329223
# found=73
# cleaned=0
# scan_time=7473
sh=9ABE489AF3684ABB96AB39F112768F69C83D0F8E ft=1 fh=f7fcd12f54d4e5cc vn="a variant of Win32/SpeedingUpMyPC application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptimizerPro.exe.vir"
sh=2F367F244D08950211E4C05FB8EF8E0959BB773A ft=1 fh=20d3e0bbdedcd685 vn="a variant of Win32/AdWare.SpeedingUpMyPC.D application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Optimizer Pro\OptProLauncher.exe.vir"
sh=37FF9AF0A4A175AFF14252C3FFA6CCC03A24ACBD ft=1 fh=ff3435be19cccc9e vn="a variant of Win32/SpeedingUpMyPC.F application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\PC Speed Maximizer\PCSpeedMaximizer.exe.vir"
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Yontoo\YontooIEClient.dll.vir"
sh=AEC860E4CDE64D747F215B83C8DE70EE0EBCB3A0 ft=1 fh=cde73a4bb58c0fe9 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll.vir"
sh=FDF652F803592E6840E076A89A19BF655686B8A8 ft=1 fh=de76e936397b25d2 vn="a variant of Win32/Adware.Yontoo.B application" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{ED7702F7-093C-4968-8B84-3CF5D1A3F23D}\_Setupx.dll.vir"
sh=D0812CEDEDABC091C7662FC3E3C1C32DF22824B1 ft=1 fh=0dec24e805278ded vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsb31EB.tmp"
sh=ED58DC294AAB0590AF0F1086AACA10569F8E1A74 ft=1 fh=ee0da5fc9ba95119 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsc84EA.tmp"
sh=DC5D48F48E831ABF625CF495C9E4EDAF425A15ED ft=1 fh=3109ddff85df7a8e vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsg12A.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsh52D3.tmp"
sh=F63A48B4E928588B00F0902D4AD35302D7392B5E ft=1 fh=900e40c5f6fa510f vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsh7531.tmp"
sh=D6495D5D80DB765BEEEDF1AADE996479AEE3B061 ft=1 fh=3ff55aad83982c60 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsh80A9.tmp"
sh=96040E287C1C1AF865607BDED460A7B77C729AAE ft=1 fh=56fac887884d4f08 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nshC4C7.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nshE17B.tmp"
sh=FBA795639D9910659064B304352AE9F1E5E4CE94 ft=1 fh=b8b3db4bc1a91951 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nshFF47.tmp"
sh=8CAD89B4D2CB052224E2835EF19EFD66F01DC48E ft=1 fh=8986efaab05dc563 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsl4433.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nslB379.tmp"
sh=5BDD9DF512D3EA57FEAA7A248FF396FCC75FD11F ft=1 fh=7733ae2ba43b4edd vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsm120C.tmp"
sh=DC5D48F48E831ABF625CF495C9E4EDAF425A15ED ft=1 fh=3109ddff85df7a8e vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsm6E1F.tmp"
sh=E30FB253A3E0987574AFAC1720981E1B2B7ABBAD ft=1 fh=e38f70d06c4da00d vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsmAEF6.tmp"
sh=7B948566C77E42B0A1891CB4B1757F82F23E75D1 ft=1 fh=1b4b2cf3e7ca8e66 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsmC044.tmp"
sh=23E50C95BF2C102BB3D514D8C4B642C332099F2C ft=1 fh=519210132dbb0d49 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsmF3D2.tmp"
sh=8F54063E050C2EB67EBC4D8AA35110150A31E218 ft=1 fh=b3cb83c334e64f37 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsrE1A9.tmp"
sh=E30FB253A3E0987574AFAC1720981E1B2B7ABBAD ft=1 fh=e38f70d06c4da00d vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nssE5DE.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nssE976.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsvC017.tmp"
sh=12A068404C9B3B00A6826AA35DDEB0A854E1CC7A ft=1 fh=e1f0507820de55fa vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsw6B90.tmp"
sh=ED58DC294AAB0590AF0F1086AACA10569F8E1A74 ft=1 fh=ee0da5fc9ba95119 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsx1AF1.tmp"
sh=5CCCC0D603844665B826B7A1304106B32F1B4427 ft=1 fh=f64635ad9f9765d7 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsx3101.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsx40C9.tmp"
sh=96040E287C1C1AF865607BDED460A7B77C729AAE ft=1 fh=56fac887884d4f08 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_nsxDF49.tmp"
sh=FB07C7FB34587068E06E60670E45E72F270071D5 ft=1 fh=c71c0011a69fb8e7 vn="a variant of Win32/Kryptik.BWAM trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe"
sh=D0812CEDEDABC091C7662FC3E3C1C32DF22824B1 ft=1 fh=0dec24e805278ded vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsb31EB.tmp"
sh=F0B599ED15B25FB096316721B9B3D9FE0EAA7673 ft=1 fh=4b3139afe0ebfd80 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsc6846.tmp"
sh=ED58DC294AAB0590AF0F1086AACA10569F8E1A74 ft=1 fh=ee0da5fc9ba95119 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsc84EA.tmp"
sh=8F7E0843D60A589F0D9D1602D9E68D3B5F3287E7 ft=1 fh=80ec4a12438095f7 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nscF9FA.tmp"
sh=DC5D48F48E831ABF625CF495C9E4EDAF425A15ED ft=1 fh=3109ddff85df7a8e vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsg12A.tmp"
sh=C0EB50A3E667B7239F26A7216131B6310A7682A6 ft=1 fh=c8c1b4d27418cf70 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh25F9.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh52D3.tmp"
sh=F63A48B4E928588B00F0902D4AD35302D7392B5E ft=1 fh=900e40c5f6fa510f vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh7531.tmp"
sh=63BE341FD4F0946B3C56668C392E85A0BE5DD233 ft=1 fh=eb0b8174c18edbbe vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh7C91.tmp"
sh=D6495D5D80DB765BEEEDF1AADE996479AEE3B061 ft=1 fh=3ff55aad83982c60 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh80A9.tmp"
sh=FF573CDC87A8FF4C8B2C35C82F690FB273F72377 ft=1 fh=22bab1ea629e2590 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsh9AAB.tmp"
sh=96040E287C1C1AF865607BDED460A7B77C729AAE ft=1 fh=56fac887884d4f08 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nshC4C7.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nshE17B.tmp"
sh=FBA795639D9910659064B304352AE9F1E5E4CE94 ft=1 fh=b8b3db4bc1a91951 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nshFF47.tmp"
sh=8CAD89B4D2CB052224E2835EF19EFD66F01DC48E ft=1 fh=8986efaab05dc563 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsl4433.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nslB379.tmp"
sh=5BDD9DF512D3EA57FEAA7A248FF396FCC75FD11F ft=1 fh=7733ae2ba43b4edd vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsm120C.tmp"
sh=FF573CDC87A8FF4C8B2C35C82F690FB273F72377 ft=1 fh=22bab1ea629e2590 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsm4BB2.tmp"
sh=DC5D48F48E831ABF625CF495C9E4EDAF425A15ED ft=1 fh=3109ddff85df7a8e vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsm6E1F.tmp"
sh=E30FB253A3E0987574AFAC1720981E1B2B7ABBAD ft=1 fh=e38f70d06c4da00d vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsmAEF6.tmp"
sh=7B948566C77E42B0A1891CB4B1757F82F23E75D1 ft=1 fh=1b4b2cf3e7ca8e66 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsmC044.tmp"
sh=23E50C95BF2C102BB3D514D8C4B642C332099F2C ft=1 fh=519210132dbb0d49 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsmF3D2.tmp"
sh=0F1273A40CB31C9F7BB0EF2168058DD6E36AE68D ft=1 fh=e41ebaa8f41be417 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsr7659.tmp"
sh=8F54063E050C2EB67EBC4D8AA35110150A31E218 ft=1 fh=b3cb83c334e64f37 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsrE1A9.tmp"
sh=FAB1E49396DB081FE49C5C29D0733350662AF687 ft=1 fh=ce9967f459aad683 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nssBF7A.tmp"
sh=E30FB253A3E0987574AFAC1720981E1B2B7ABBAD ft=1 fh=e38f70d06c4da00d vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nssE5DE.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nssE976.tmp"
sh=148F2514B71179764339176742812FD8C93458E1 ft=1 fh=d0e6ab543bd9321a vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsvC017.tmp"
sh=12A068404C9B3B00A6826AA35DDEB0A854E1CC7A ft=1 fh=e1f0507820de55fa vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsw6B90.tmp"
sh=ED58DC294AAB0590AF0F1086AACA10569F8E1A74 ft=1 fh=ee0da5fc9ba95119 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsx1AF1.tmp"
sh=7CBEE8D115B68B5BE04C9B0125C34807793B4D63 ft=1 fh=c2a4c3266bb01f67 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsx234B.tmp"
sh=5CCCC0D603844665B826B7A1304106B32F1B4427 ft=1 fh=f64635ad9f9765d7 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsx3101.tmp"
sh=870FA9546F4BCC0568BD3AAD438921BFC7519920 ft=1 fh=ef02ca116b19cda8 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsx40C9.tmp"
sh=96040E287C1C1AF865607BDED460A7B77C729AAE ft=1 fh=56fac887884d4f08 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsxDF49.tmp"
sh=23E50C95BF2C102BB3D514D8C4B642C332099F2C ft=1 fh=519210132dbb0d49 vn="a variant of Win32/Injected.F trojan" ac=I fn="C:\Users\HP\AppData\Local\Temp\nsy73EA.tmp"
sh=813F99C162730B22A391A287FA9BA6A954C2977C ft=1 fh=545f8627a3352333 vn="a variant of Win32/Adware.Yontoo.A application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooIEClient.dll"
sh=E1E179B21BA4036F1F7BDD29AAC0EACFECFEFE61 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers.crx"
sh=57BA28B40515E484FF894807A226FBA8D741C194 ft=1 fh=b34e093f204ff3b2 vn="Win32/SpeedingUpMyPC.I application" ac=I fn="C:\Users\HP\AppData\Local\Temp\8185d30b-a07e-4f15-b9f6-c3912dae34cd\software\OptimizerPro.exe"
sh=175A8A0C7650EF29B0E1AE7137F5F48FDFCD6588 ft=1 fh=deea2a09617af006 vn="a variant of Win32/AdWare.SpeedingUpMyPC.G application" ac=I fn="C:\Users\HP\AppData\Local\Temp\is357113909\340832_stp\PCSpeedMaximizer_AQDE_AFD_PPI.exe"
sh=F074C932D8081C74F6A220D885567DA41DA23196 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.B application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers\background.html"
sh=37A7D8AAD5C174108E8AE0E27097B55D34A27044 ft=0 fh=0000000000000000 vn="JS/Adware.Yontoo.A application" ac=I fn="C:\Users\HP\AppData\Local\Temp\YontooLayers\yl.js"

und hier nochmal die von FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-04-2014
Ran by HP (administrator) on HP-HP on 23-04-2014 23:24:37
Running from C:\Users\HP\Desktop\Downloaded Music\FRST-OlderVersion\FRST-OlderVersion
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
() C:\Program Files (x86)\Join Air\AssistantServices.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
() C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Dropbox, Inc.) C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe
() C:\Program Files (x86)\Join Air\UIExec.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2096424 2010-05-28] (Synaptics Incorporated)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-06-26] (Alcor Micro Corp.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-07-03] (IDT, Inc.)
HKLM\...\Run: [SmartMenu] => C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [611896 2010-01-20] ()
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [TotalMediaTVMonitor] => C:\Program Files (x86)\ArcSoft\TotalMedia TV 1.0\TotalMediaTVMonitor.exe [307200 2010-04-13] (ArcSoft, Inc.)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-24] (Intel Corporation)
HKLM-x32\...\Run: [HP Envy Guides AutoPlay] => C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\hpdocstart.exe [76584 2010-03-24] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [UIExec] => C:\Program Files (x86)\Join Air\UIExec.exe [132096 2009-10-10] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [574008 2011-07-11] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-04-08] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\WB: C:\Program Files (x86)\Stardock\MyColors\fast64.dll [X]
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-08-24] (Microsoft Corporation)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements Organizer 8.0\CAHeadless\ElementsAutoAnalyzer.exe [615808 2009-09-18] (Adobe Systems Incorporated)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [HP Officejet 4620 series (NET)] => C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Users\HP\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=3593ca628f6847d2a90446de1e0397ef-4d613c8a6f5ea5be571be9f71d862bf0db7aae92 /CMPID=0214c
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\Run: [Facebook Update] => C:\Users\HP\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-03-18] (Facebook Inc.)
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {1690130a-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {16901315-4d3e-11e2-9452-ac81121285da} - H:\setup_vmc_lite.exe /checkApplicationPresence
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {31270651-c8f1-11e1-b728-1cc1debd7609} - F:\Startme.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {8ffb419d-892c-11e1-a437-e02a82294275} - F:\autorun.exe
HKU\S-1-5-21-2908145472-1249041861-3166297183-1000\...\MountPoints2: {91878652-f5fb-11e1-8440-806e6f6e6963} - G:\windows\Install.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\HP\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {C8E24698-A530-4FAA-ABED-EDD2284D3409} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\HP\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-10-06]

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 hpdoccardsvc; C:\Program Files (x86)\Hewlett-Packard\HP ENVY Document Card Utilities\doccardsvc.exe [83240 2010-03-24] (Hewlett-Packard Developement Company, L.P.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2102072 2013-12-18] (AVG)
R2 UI Assistant Service; C:\Program Files (x86)\Join Air\AssistantServices.exe [246272 2009-10-10] ()

==================== Drivers (Whitelisted) ====================

S3 cmnsusbser; C:\Windows\System32\DRIVERS\cmnsusbser.sys [117888 2012-04-18] (Mobile Connector)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-29] (Huawei Technologies Co., Ltd.)
S3 smsbda; C:\Windows\System32\drivers\smsbda.sys [63648 2012-04-18] (Siano)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2013-12-16] (TuneUp Software)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-22 19:53 - 2014-04-22 19:53 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-04-22 15:58 - 2014-04-22 15:58 - 02347384 _____ (ESET) C:\Users\HP\Desktop\#.exe
2014-04-20 21:44 - 2014-04-20 21:44 - 00000686 _____ () C:\Users\HP\Desktop\JRT.txt
2014-04-20 21:35 - 2014-04-20 21:35 - 01016261 _____ (Thisisu) C:\Users\HP\Desktop\JRT.exe
2014-04-20 21:25 - 2014-04-20 21:25 - 01308369 _____ () C:\Users\HP\Desktop\adwcleaner.exe
2014-04-20 17:13 - 2014-04-20 17:13 - 00003142 _____ () C:\Windows\System32\Tasks\{43786210-50D4-4BF9-B688-256C28B51DC7}
2014-04-18 20:53 - 2014-04-18 20:53 - 00000000 ____D () C:\ProgramData\Avg_Update_0414b
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-10 14:12 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-10 14:12 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-04-10 14:12 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-10 14:12 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-10 14:12 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-04-10 14:12 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-10 14:12 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-10 14:12 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-04-10 14:12 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-04-10 14:12 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-04-10 14:12 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-04-10 14:12 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-04-10 14:12 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-04-10 14:12 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-04-10 14:12 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-04-10 14:12 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-10 14:12 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-04-10 14:12 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-10 14:12 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-04-10 14:12 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-04-10 14:12 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-04-10 14:12 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-10 14:12 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-04-10 14:12 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-04-10 14:12 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-10 14:12 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-04-10 14:12 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-10 14:12 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-10 14:12 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-04-10 14:12 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-10 14:12 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 16:47 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 16:47 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 16:47 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 16:47 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 16:47 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 16:47 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 16:47 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 16:47 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 16:47 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 16:47 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2014-04-23 23:24 - 2014-01-16 23:27 - 00000000 ____D () C:\FRST
2014-04-23 22:57 - 2012-06-16 18:54 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-23 22:54 - 2014-03-09 20:31 - 00000916 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000UA.job
2014-04-23 22:26 - 2010-11-22 01:58 - 01181440 _____ () C:\Windows\WindowsUpdate.log
2014-04-23 21:14 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-23 21:14 - 2009-07-14 06:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-23 21:06 - 2013-09-25 16:11 - 00000000 ___RD () C:\Users\HP\Dropbox
2014-04-23 21:06 - 2013-09-25 16:09 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Dropbox
2014-04-23 21:03 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-23 21:03 - 2009-07-14 06:51 - 00184690 _____ () C:\Windows\setupact.log
2014-04-23 21:02 - 2014-02-19 13:40 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-04-23 21:02 - 2014-02-19 13:35 - 00000000 ____D () C:\ProgramData\MFAData
2014-04-23 21:02 - 2010-11-22 02:08 - 00444156 _____ () C:\Windows\PFRO.log
2014-04-23 20:57 - 2010-09-25 19:53 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-04-23 20:57 - 2010-09-25 19:53 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-04-23 20:57 - 2009-07-14 07:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-23 13:54 - 2014-03-09 20:31 - 00000894 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2908145472-1249041861-3166297183-1000Core.job
2014-04-23 12:38 - 2012-12-26 23:54 - 00000320 _____ () C:\Windows\Tasks\HPCeeScheduleForHP.job
2014-04-22 19:53 - 2014-04-22 19:53 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-04-22 15:58 - 2014-04-22 15:58 - 02347384 _____ (ESET) C:\Users\HP\Desktop\#.exe
2014-04-22 11:07 - 2012-12-26 23:54 - 00003168 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForHP
2014-04-22 11:06 - 2012-07-28 15:23 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-04-22 11:06 - 2012-06-27 16:52 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-04-20 21:44 - 2014-04-20 21:44 - 00000686 _____ () C:\Users\HP\Desktop\JRT.txt
2014-04-20 21:35 - 2014-04-20 21:35 - 01016261 _____ (Thisisu) C:\Users\HP\Desktop\JRT.exe
2014-04-20 21:29 - 2014-01-21 15:06 - 00000000 ____D () C:\AdwCleaner
2014-04-20 21:29 - 2012-03-26 16:27 - 00000000 ____D () C:\Users\HP
2014-04-20 21:25 - 2014-04-20 21:25 - 01308369 _____ () C:\Users\HP\Desktop\adwcleaner.exe
2014-04-20 17:13 - 2014-04-20 17:13 - 00003142 _____ () C:\Windows\System32\Tasks\{43786210-50D4-4BF9-B688-256C28B51DC7}
2014-04-18 20:53 - 2014-04-18 20:53 - 00000000 ____D () C:\ProgramData\Avg_Update_0414b
2014-04-18 00:16 - 2012-09-14 19:45 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Skype
2014-04-13 00:06 - 2014-03-17 18:35 - 00000000 ____D () C:\Users\HP\Desktop\Neuer Ordner
2014-04-12 17:08 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieUserList
2014-04-11 14:59 - 2014-04-11 14:59 - 00000000 __SHD () C:\Users\HP\AppData\Local\EmieSiteList
2014-04-11 14:59 - 2012-09-22 18:34 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-04-11 13:07 - 2013-04-27 11:56 - 00001165 _____ () C:\Windows\SysWOW64\InstallUtil.InstallLog
2014-04-10 18:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-04-10 14:12 - 2013-07-13 01:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-10 14:07 - 2012-07-28 15:20 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-07 13:17 - 2012-06-16 18:46 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-04-06 15:50 - 2012-03-26 16:30 - 00066648 _____ () C:\Users\HP\AppData\Local\GDIPFONTCACHEV1.DAT
2014-04-06 03:19 - 2013-04-11 17:28 - 00000000 ____D () C:\Users\HP\AppData\Roaming\SoftGrid Client
2014-03-28 21:29 - 2014-03-17 21:22 - 00000000 ____D () C:\Users\HP\Desktop\Ausbildung Bewerbung
2014-03-28 10:56 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-25 01:45 - 2014-03-02 10:06 - 00000000 ____D () C:\ProgramData\AVG

Some content of TEMP:
====================
C:\Users\HP\AppData\Local\Temp\36808-93901-counter-strike.exe
C:\Users\HP\AppData\Local\Temp\7za.exe
C:\Users\HP\AppData\Local\Temp\AskSLib.dll
C:\Users\HP\AppData\Local\Temp\autorun.dll
C:\Users\HP\AppData\Local\Temp\AutoRun.exe
C:\Users\HP\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\HP\AppData\Local\Temp\avgnt.exe
C:\Users\HP\AppData\Local\Temp\BackupSetup.exe
C:\Users\HP\AppData\Local\Temp\Browser_Helper_Companion_DE.exe
C:\Users\HP\AppData\Local\Temp\drm_dialogs.dll
C:\Users\HP\AppData\Local\Temp\drm_dyndata_7400006.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\HP\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\HP\AppData\Local\Temp\Extract.exe
C:\Users\HP\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\HP\AppData\Local\Temp\HPQSi.exe
C:\Users\HP\AppData\Local\Temp\ICReinstall_ZipOpenerSetup.exe
C:\Users\HP\AppData\Local\Temp\Install_ipswDownloader_v15.exe
C:\Users\HP\AppData\Local\Temp\instloffer.exe
C:\Users\HP\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdrv7.dll
C:\Users\HP\AppData\Local\Temp\PixelPlanetpdui7.dll
C:\Users\HP\AppData\Local\Temp\Quarantine.exe
C:\Users\HP\AppData\Local\Temp\Resource.exe
C:\Users\HP\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\HP\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\HP\AppData\Local\Temp\SHSetup.exe
C:\Users\HP\AppData\Local\Temp\SIMEEI2Installer.exe
C:\Users\HP\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\HP\AppData\Local\Temp\SkypeSetup.exe
C:\Users\HP\AppData\Local\Temp\SP50656.exe
C:\Users\HP\AppData\Local\Temp\SP52264.exe
C:\Users\HP\AppData\Local\Temp\SP52407.exe
C:\Users\HP\AppData\Local\Temp\SP53462.exe
C:\Users\HP\AppData\Local\Temp\SP53546.exe
C:\Users\HP\AppData\Local\Temp\sp54620.exe
C:\Users\HP\AppData\Local\Temp\SP54714.exe
C:\Users\HP\AppData\Local\Temp\SP55150.exe
C:\Users\HP\AppData\Local\Temp\SP55151.exe
C:\Users\HP\AppData\Local\Temp\SP55493.exe
C:\Users\HP\AppData\Local\Temp\sp58915.exe
C:\Users\HP\AppData\Local\Temp\sp64126.exe
C:\Users\HP\AppData\Local\Temp\SpOrder.dll
C:\Users\HP\AppData\Local\Temp\sqlite3.exe
C:\Users\HP\AppData\Local\Temp\TUUUninstallHelper.exe
C:\Users\HP\AppData\Local\Temp\Uninstaller.exe
C:\Users\HP\AppData\Local\Temp\UninstallerGer.dll
C:\Users\HP\AppData\Local\Temp\UninstallerIta.dll
C:\Users\HP\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\HP\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\HP\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\HP\AppData\Local\Temp\VP6Install.exe
C:\Users\HP\AppData\Local\Temp\VP6VFW.dll
C:\Users\HP\AppData\Local\Temp\VuuPCSetup_full.exe
C:\Users\HP\AppData\Local\Temp\WtgDriverInstallX.dll
C:\Users\HP\AppData\Local\Temp\YontooIEClient.dll
C:\Users\HP\AppData\Local\Temp\_kvvuz17.dll
C:\Users\HP\AppData\Local\Temp\_unps.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 00:36

==================== End Of Log ============================

--- --- ---

--- --- ---

Vielen dank und sry für die verspätete Antwort hatte die letzten Tage viel um die Ohren, Grüße
Manu

sunjojo · 24.04.2014, 16:44

Kein Problem. Wenn du keine Probleme mehr hast, sind wir jetzt fertig

.

Schritt 1
Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Updates
Java Version 7 Update 55
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 55 ) herunter laden.
Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
Klicke erneut OK.

Adobe Reader Version XI (11.0.06)

Deinstalliere bitte deine aktuelle(n) Version(en) des Adobe Readers.
Lade dir die neuste Version hier herunter: Adobe - Adobe Reader herunterladen - Alle Versionen
Entferne den Hacken für das optionale Programm "McAfee Security Scan Plus".

Cleanup
Falls du Malwarebytes Anti-Malware und den ESET Online Scanner nicht mehr behalten möchtest, kannst du diese über die Systemsteuerung deinstallieren. Ich empfehle dir, mindestens ein Programm zu behalten (näheres in den Tipps).

Windows XP: Start --> Systemsteuerung --> Kategorieansicht auswählen (falls nicht voreingestellt) --> Software
Windows Vista/7: Start --> Systemsteuerung --> Anzeige (oben-rechts) auf Kategorie stellen (falls nicht voreingestellt) --> Programme deinstallieren (Unterpunkt von Programme)
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> Programme deinstallieren (Unterpunkt von Programme)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

In deinen Logfiles sehe ich im Moment keine schädlichen Einträge mehr, du bist in meinen Augen Clean. Für die Zukunft habe ich dir Tipps aufgeschrieben, damit du uns in nächster Zeit nicht mehr brauchst

.

Tipps - Frequently Asked Questions (FAQ)/Häufig gestellte Fragen

Welcher Antivirenscanner ist der beste?

Die Antwort auf die Frage ist im Grunde einfach: keiner. Es gibt keinen Antivirenscanner, der immer alle Schädlinge sofort erkennt und dich 100%ig schützt. Alles vom Menschen geschaffene ist fehlerhaft und es ist ratsam, sich nur begrenzt darauf zu verlassen. Das heißt nicht, dass die Verwendung eines Antivirenprogramms keinen Sinn macht, aber es sollte als zusätzliche Hilfe angesehen werden. Die Hauptverantwortung liegt bei dir und deinem Verhalten im Internet selbst.

Benutze nur einen Antivirenscanner/Hintergrundwächter, niemals zwei oder mehrere. Diese könnten sich gegenseitig blockieren und dir mehr schaden, als helfen. Achte darauf, dass immer die neuesten Updates heruntergeladen werden. Ein veralteter Antivirenscanner ist nutzlos!
- Ein gutes Antivirenprogramm ist Emsisoft Anti-Malware.

Außerdem kannst du dein Betriebssystem mit On-Demand Sannern überprüfen. Solche Scanner laufen nicht permanent im Hintergrund, sondern scannen nur "auf Knopfdruck" dein System. Damit holst du dir eine zweite Meinung ein. Gute On-Demand Scanner, die auch wir zur Kontrolle benutzen, sind Malwarebytes Anti Malware und der ESET Online Scanner.
- Malwarebytes Anti-Malware (Anleitung zur Verwendung) ist eines der besten und zuverlässigsten Programme in der Malwareentfernung. Scanne dein System einmal pro Woche oder einmal in zwei Wochen.
- Der ESET Online Scanner (Anleitnung zur Verwendung) ist kostenlos und scannt dein System und deine Dateien sehr gründlich. Deswegen kann der Scan bei vielen Dateien mehrere Stunden dauern. Scanne dein System nach deinem eigenem Ermessen. Falls schädliche Dateien gefunden werden, handle nicht eigenmächtig!

Aber Updates muss ich immer installieren, oder?

Die Aktualität von Software ist sehr wichtig und unbedingt notwendig. Veraltete Programme stellen Schwachstellen dar, die sich Angreifer gerne zur Nutze machen. Daher ist es wichtig, immer die neueste Version der jeweiligen Software installiert zu haben. Dies fängt beim Betriebssystem an. Du solltest das neueste Service Pack installiert und automatische Updates eingeschaltet haben.
Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Windows 8: Suchen --> "Systemsteuerung" in das Suchfeld eingeben --> Systemsteuerung auswählen --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren

Häufig werden Sicherheitslücken von älteren Java Versionen, dem Flash-Player und PDF-Reader ausgenutzt. Du kannst hier überprüfen, ob diese häufig missbrauchte Software aktuell ist: PluginCheck

Außerdem empfehle ich dir den http://www.trojaner-board.de/83959-s...tml#post510373. Dieser überprüft, ob du veraltete Software auf deinem Rechner verwendest und kann sie in manchen Fällen automatisch updaten.

Ok, muss ich auf etwas achten, wenn ich im Internet surfe?

Mit dem richtigen Verhalten im Internet fängt der Schutz vor Infektionen an. Es gibt inzwischen viele virtuelle Betrugsversuche oder Tricks zum Täuschen, sowie im echten Leben. Um sich dort zu schützen, hast du bestimmte Angewohnheiten. Diese können auf das Surfverhalten übertragen werden. Zur Verdeutlichung stelle ich dir einen kleinen Vergleich zum Leben her:

Verhalten im Leben	Verhalten im Internet
Du überprüfst vorher die Läden, in denen du einkaufst.	Klicke nicht auf alle Seiten/Werbungen/PopUps, weil diese bunt sind oder tolle Preise versprechen.
Du achtest auf die Qualität, wenn du Produkte kaufst.	Lade dir Programme nur von original Herstellerseiten herunter und nicht von Softonic oder ähnlichem. Diese birgen häufig die Gefahr, sich zusätzlich Adware herunterzuladen.
Du öffnest keine Briefe oder Pakete ohne zu gucken, von wem diese sind.	Öffne nur Anhänge von Emails, wenn der Absender bekannt ist. Überprüfe, ob zum Beispiel eine Rechnung im Anhang wirklich von der Firma versendet wurde. Häufig werden gefälschte Emails mit schädlichem Anhang verschickt!

Handle mit Bedacht und überlege zuerst, bevor du etwas anklickst, herunterlädst oder öffnest!

Vermeide das Besuchen von pornographischen, Pokerspiel oder weiteren dubiosen Webseiten. Diese birgen ein besonders großes Infektionsrisiko.

Welche Programme sollte ich nicht verwenden?

Wenn du neue Software installierst, besteht häufig die Auswahl, eine weitere Toolbar (oder ähnliches) zu installieren. Entferne generell den Haken bei optionalen Zusatzprogrammen. Diese verlangsamen in der Regel deinen Browser und können ein erhöhtes Infektionsrisiko bedeuten.

Registry Cleaner versprechen meist einen großen Performancegewinn, wenn verwaiste Einträge in der Regsitry entfernt werden. Dieser angebliche Gewinn ist kaum bis gar nicht bemerkbar. Außerdem wird häufig verschwiegen, dass falsche Änderungen der Registry zu schwerwiegenden Folgen führen können. Deswegen sollte so wenig wie möglich an der Registry verändert werden. Zerstörst du die Registry, zerstörst du Windows!

Filesharing oder Peer-to-Peer Programme ermöglichen es, Dateien mit anderen Nutzern auszutauschen. Es ist möglich, dass du dir eine infizierte Datei herunterlädst (auch versteckt in angeblich legalen Versionen von bekannten Programmen). Du kannst niemals wissen, woher diese stammen. Daher sollte diese Art von Software mit äußerster Vorsicht oder gar nicht benutzt werden.
- Lade dir vor allem keine Cracks (illegale Version einer Software) herunter. Das ist rechtlich nicht erlaubt und du kannst dafür bestraft werden. Außerdem ist bei solcher Software das Infektionsrisiko am höchsten, da Cracks sehr häufig versteckte Malware enthalten.

Gibt es noch weitere Tipps, um mich zu schützen?

Achte auf die Endung von Dateien, die dir zugesendet wurden. Häufig versuchen Malwareschreiber mit Tricks wie Rechnung.pdf.exe dich zu täuschen. Wenn die Dateiendung ausgeblendet wird, bleibt Rechnung.pdf übrig, was den Anschein einer normalen PDF-Datei macht. Lass dir daher bekannte Dateiendung anzeigen (Anleitung: http://www.trojaner-board.de/59624-a...-sichtbar.html)

Surfe mit einem Konto mit eingeschränkten Rechten. Durch Administratorrechte kann Malware ohne Probleme zahlreiche Änderungen am System vornehmen, zum Beispiel Sicherheitseinstellungen verändern oder auf Systemdateien zugreifen.
Verwende nicht immer das gleiche Passwort. Falls dein Passwort durch entsprechende Malware herausgefunden wird, könnte auf alle Konten von dir zugegriffen werden.

Lege in regelmäßigen Abständen Backups (Was sind Backups?) von deinem System an. Dadurch ist ein Datenverlust durch Malware oder Hardwareschäden verkraftbar und es ist vergleichsweise einfach, den Rechner auf den Stand des letzten Backups zu bringen. Damit du deine Daten nicht manuell sichern musst, gibt es Backup-Programme wie Paragon Backup & Recovery.

Deaktiviere das Autorun-Feature von Windows. Dies ermöglicht, dass zum Beispiel CDs, DVDs oder Programme auf USB-Sticks alleine starten. Häufig nutzen Malwareschreiber genau diese Funktion aus. In solchen Fällen befindet sich Malware auf dem USB-Stick und wird automatisch beim Anschließen an den Computer ausgeführt. Um das zu verhinden, deaktiviere die Autorun-Funktion: http://www.trojaner-board.de/83238-a...sschalten.html.

Wenn dich das Thema Computersicherheit interessiert und du noch mehr Tipps und Tricks zum Schutz deines Rechners haben willst, ist der Emsisoft Blog genau richtig für dich

.

Wenn du die Arbeit des Trojaner-Boards unterstützen möchtest, kannst du gerne spenden

.

Ich wünsche dir eine schöne und malwarefreie Zeit

.

Albertron24 · 26.04.2014, 16:46

Herzlichen Dank Jonas, der lässtige Windows Version Installer ist weg und ich freu mich dass laut den Logs auch alles Clean ist, soweit merk ich wie gesagt auch rein garnichts mehr!

Hab mir deine Sicherheitshinweise zum vorbeugen der Viren durch gelesen und hab die letzten Schritte auch durchgeführt soweit klappt alles bin jetzt bei dem Schritt
"Cleanup" und ich versteh nicht was du mit "Combofix" bzw. "Defogger" meinst.
Hab soweit aber alle Updates etc. durchgeführt und muss sagen das nach dem Neustart nachdem ich Java deeinstalliert habe bzw. die neue Version installiert habe auf dem Desktop 2 "Desktop.ini" aufgetaucht sind, was tu ich damit und was haben diese Dateien zu bedeuten?
Liebe Grüße und ein riesen Dankeschön für deine Zeit und Mühe!

sunjojo · 26.04.2014, 17:19

Hi,

Zitat:

"Cleanup" und ich versteh nicht was du mit "Combofix" bzw. "Defogger" meinst.

Den Teil des Cleanups kannst du überspringen, da du weder Combofix noch Defogger eingesetzt hast, aber trotzdem Delfix herunterladen und ausführen!

Zitat:

Hab soweit aber alle Updates etc. durchgeführt und muss sagen das nach dem Neustart nachdem ich Java deeinstalliert habe bzw. die neue Version installiert habe auf dem Desktop 2 "Desktop.ini" aufgetaucht sind, was tu ich damit und was haben diese Dateien zu bedeuten?

Das ist vollkommen normal, dass diese zwei Dateien dort vorhanden sind. Normalerweise sind diese aber versteckt und daher nicht zu sehen. Nachdem du Delfix ausgeführt hast, sollten die beiden Dateien wieder "unsichtbar" sein

.

Hast du sonst noch Fragen?

Albertron24 · 26.04.2014, 17:31

Ah ja habs jetzt eben gemerkt

Nein vielen Dank, hat sich ja alles erledigt!

Ich möchte dir wirklich ncohmal für deine Mühe und Zeit Danken in diesem Sinne wünsche ich dir noch ein schönes Wochenende!

sunjojo · 26.04.2014, 18:13

Hallo Albertron24,

Zitat:

Ich möchte dir wirklich ncohmal für deine Mühe und Zeit Danken in diesem Sinne wünsche ich dir noch ein schönes Wochenende!

Schön, dass wir dir helfen konnten. Danke, ich wünsche dir auch ein schönes Wochenende

.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht, damit erhalte ich keine Benachrichtungen über neue Antworten in diesem Thread. Solltest Du das Thema erneut brauchen, schicke mir bitte eine private Nachricht.

Jeder Andere bitte hier klicken und einen eigenen Thread erstellen.

Windows Version Installer

Log-Analyse und Auswertung: Windows Version Installer