|
Plagegeister aller Art und deren Bekämpfung: Pop-Ups ploppen auf wenn ich Webseiten gehe!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
20.11.2014, 09:46 | #1 |
| Pop-Ups ploppen auf wenn ich Webseiten gehe! Also ich ahbe seit kurzem ein Probelm,das nervig sit.es gehen auf webseiten(z.B amazon,willhaben,...) auf der serite Pop-ups auf wie Best Deals,Best Coupons;.... Wie kann ich die entfernen?? Wäre echt toll wenn mir wer helfen kann. Mfg Andreas |
20.11.2014, 09:48 | #2 |
/// the machine /// TB-Ausbilder | Pop-Ups ploppen auf wenn ich Webseiten gehe! hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
20.11.2014, 09:57 | #3 |
| Pop-Ups ploppen auf wenn ich Webseiten gehe! anbei sende ich die dateien
__________________Anhang 70923 FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-11-2014 Ran by Fertl (administrator) on FERTL-PC on 20-11-2014 09:51:18 Running from C:\Users\Fertl\Downloads Loaded Profile: Fertl (Available profiles: Fertl) Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Spotify Ltd) C:\Users\Fertl\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\main.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (LogMeIn, Inc.) C:\Config.Msi\24b1d3e7.rbf (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\ImApp.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe (Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE (Microsoft Corporation) C:\Windows\splwow64.exe (IncrediMail, Ltd.) C:\Program Files (x86)\IncrediMail\Bin\IncMail.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\audiodg.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3873704 2014-08-13] (AVAST Software) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-09-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [RazerGameBooster] => C:\Program Files (x86)\Razer\Razer Game Booster\RazerGameBooster.exe [61152 2014-02-25] (Razer Inc.) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3835728 2014-11-03] (LogMeIn Inc.) HKU\S-1-5-21-1597344951-833908811-148078042-1000\...\Run: [Spotify Web Helper] => C:\Users\Fertl\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1178168 2014-08-16] (Spotify Ltd) HKU\S-1-5-21-1597344951-833908811-148078042-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1597344951-833908811-148078042-1000\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_189_Plugin.exe -update plugin Startup: C:\Users\Fertl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - .lnk ShortcutTarget: Tintenwarnungen überwachen - .lnk -> C:\Program Files\HP\HP Deskjet 2510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) Startup: C:\Users\Fertl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 2510 series.lnk ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 2510 series.lnk -> C:\Program Files\HP\HP Deskjet 2510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-1597344951-833908811-148078042-1000\Software\Microsoft\Internet Explorer\Main,Search Page = https://at.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} HKU\S-1-5-21-1597344951-833908811-148078042-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://astromenda.com/?f=1&a=ast_ir_14_42_ch&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0Azzzy0DtC0AyCtCyB0AtN0D0Tzu0StCtDtCyCtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyC0F0Ezy0ByCyCtCtG0EzyyDyDtGtByCtDtDtGzz0B0FyEtGyDtBtCyCtCtCzz0FtD0F0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtAyBzyzyyBtAyDtG0CyEyE0FtGyE0BzzzztGzz0CyEzytG0F0DtB0CtAyE0CtCyB0Dzz0E2Q&cr=1595698265&ir= HKU\S-1-5-21-1597344951-833908811-148078042-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKU\S-1-5-21-1597344951-833908811-148078042-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE HKU\S-1-5-21-1597344951-833908811-148078042-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = https://at.search.yahoo.com?fr=hp-avast&type=avastbcl HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://at.search.yahoo.com?fr=hp-avast&type=avastbcl StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://at.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://at.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> DefaultScope {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_42_ch&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0Azzzy0DtC0AyCtCyB0AtN0D0Tzu0StCtDtCyCtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyC0F0Ezy0ByCyCtCtG0EzyyDyDtGtByCtDtDtGzz0B0FyEtGyDtBtCyCtCtCzz0FtD0F0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtAyBzyzyyBtAyDtG0CyEyE0FtGyE0BzzzztGzz0CyEzytG0F0DtB0CtAyE0CtCyB0Dzz0E2Q&cr=1595698265&ir= SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=0C21902B34A89D1A&affID=119357&tt=280813_dtts&tsp=4990 SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> {2E00D31D-D171-423D-836D-1A4D7EA7F1A9} URL = hxxp://mystart.incredimail.com//?search={searchTerms}&loc=search_box&a=1ex6PMVBE51 SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = https://at.search.yahoo.com/yhs/search?type=avastbcl&hspart=avast&hsimp=yhs-001&p={searchTerms} SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> {BF6F2343-27F4-4EEB-8F94-DBA5E0C17A52} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091 SearchScopes: HKU\S-1-5-21-1597344951-833908811-148078042-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_42_ch&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0Azzzy0DtC0AyCtCyB0AtN0D0Tzu0StCtDtCyCtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyC0F0Ezy0ByCyCtCtG0EzyyDyDtGtByCtDtDtGzz0B0FyEtGyDtBtCyCtCtCzz0FtD0F0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtAyBzyzyyBtAyDtG0CyEyE0FtGyE0BzzzztGzz0CyEzytG0F0DtB0CtAyE0CtCyB0Dzz0E2Q&cr=1595698265&ir= BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Fertl\AppData\Roaming\Mozilla\Firefox\Profiles\q4h6msrb.default FF DefaultSearchUrl: https://at.search.yahoo.com/yhs/search FF SearchEngineOrder.1: Yahoo! (Avast) FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1597344951-833908811-148078042-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Fertl\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF Plugin HKU\S-1-5-21-1597344951-833908811-148078042-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Fertl\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF user.js: detected! => C:\Users\Fertl\AppData\Roaming\Mozilla\Firefox\Profiles\q4h6msrb.default\user.js FF Extension: FlashResizer - C:\Users\Fertl\AppData\Roaming\Mozilla\Firefox\Profiles\q4h6msrb.default\Extensions\{C6F77964-B0B5-4953-A144-93051184EC0C}.xpi [2013-06-06] FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-10-24] FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox Chrome: ======= CHR HomePage: Default -> hxxp://astromenda.com/?f=1&a=ast_ir_14_42_ch&cd=2XzuyEtN2Y1L1QzuzytDtB0BtAyE0Azzzy0DtC0AyCtCyB0AtN0D0Tzu0StCtDtCyCtN1L2XzutAtFtBtFtCtFyDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyC0F0Ezy0ByCyCtCtG0EzyyDyDtGtByCtDtDtGzz0B0FyEtGyDtBtCyCtCtCzz0FtD0F0Fzy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AtAyBzyzyyBtAyDtG0CyEyE0FtGyE0BzzzztGzz0CyEzytG0F0DtB0CtAyE0CtCyB0Dzz0E2Q&cr=1595698265&ir= CHR StartupUrls: Default -> "hxxp://www.facebook.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-12-06] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-07] CHR Extension: (YouTube) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-12-06] CHR Extension: (Google-Suche) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-12-06] CHR Extension: (Framed Display) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\gagcbogmgkaogoadfcoicjdojbmkegao [2014-10-19] CHR Extension: (AdBlock) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-03-23] CHR Extension: (Avast Online Security) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-05-21] CHR Extension: (FlashControl) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfidmkgnfgnkihnjeklbekckimkipmoe [2013-05-10] CHR Extension: (Google Wallet) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23] CHR Extension: (Google Mail) - C:\Users\Fertl\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-12-06] CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [] CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [] CHR HKLM-x32\...\Chrome\Extension: [ojpijjmpahflnipadmlpgbjmagmjchkk] - C:\Users\Fertl\AppData\Local\CRE\ojpijjmpahflnipadmlpgbjmagmjchkk.crx [2012-09-20] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-14] (AVAST Software) S3 becldr3Service; C:\Program Files (x86)\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [176128 2011-04-19] () [File not signed] R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-17] (NVIDIA Corporation) R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-10-21] (LogMeIn, Inc.) S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4687672 2012-05-15] (INCA Internet Co., Ltd.) [File not signed] R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-17] (NVIDIA Corporation) R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2014-02-25] (Razer Inc.) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-14] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-14] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-14] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-14] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-14] () S3 LGDDCDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys [14336 2009-04-24] () [File not signed] S3 LGII2CDevice; C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys [18432 2009-04-24] () [File not signed] R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation) S3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation ) R1 {7012eec1-4f37-42d4-a2cd-26727494d248}Gw64; C:\Windows\System32\drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys [48792 2014-10-12] (StdLib) R1 {a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64; C:\Windows\System32\drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys [48792 2014-10-22] (StdLib) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X] S3 tsusbhub; system32\drivers\tsusbhub.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] S3 X6va008; \??\C:\Users\Fertl\AppData\Local\Temp\0082A26.tmp [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-20 09:51 - 2014-11-20 09:51 - 00022203 _____ () C:\Users\Fertl\Downloads\FRST.txt 2014-11-20 09:50 - 2014-11-20 09:51 - 00000000 ____D () C:\FRST 2014-11-20 09:50 - 2014-11-20 09:50 - 02117120 _____ (Farbar) C:\Users\Fertl\Downloads\FRST64.exe 2014-11-14 15:29 - 2014-11-14 15:28 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll 2014-11-14 15:28 - 2014-11-14 15:28 - 00000000 ____D () C:\Program Files\Java 2014-11-14 15:27 - 2014-11-14 15:27 - 92658088 _____ (Oracle Corporation) C:\Users\Fertl\Downloads\jre-8u25-windows-x64.exe 2014-11-14 15:22 - 2014-11-14 15:22 - 00000000 ____D () C:\ProgramData\APN 2014-11-14 15:17 - 2014-11-14 15:17 - 00638888 _____ (Oracle Corporation) C:\Users\Fertl\Downloads\chromeinstall-8u25.exe 2014-11-14 15:12 - 2014-11-14 15:13 - 29727656 _____ (Oracle Corporation) C:\Users\Fertl\Downloads\jre-8u25-windows-i586.exe 2014-11-14 07:01 - 2014-11-14 07:01 - 00001950 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk 2014-11-14 06:41 - 2014-11-14 07:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite 2014-11-14 06:41 - 2014-11-14 06:41 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite 2014-11-12 04:52 - 2014-11-14 16:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-11-10 03:21 - 2014-11-10 03:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-11-10 03:21 - 2014-11-10 03:21 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi 2014-11-09 21:56 - 2014-11-11 21:37 - 00007608 _____ () C:\Users\Fertl\AppData\Local\Resmon.ResmonCfg 2014-11-08 17:32 - 2014-11-08 17:32 - 25239492 _____ () C:\Users\Fertl\Downloads\Sphax PureBDcraft 128x MC18.zip 2014-11-08 17:25 - 2014-11-08 17:26 - 105139071 _____ () C:\Users\Fertl\Downloads\Sphax PureBDcraft 512x MC18.zip 2014-11-08 16:53 - 2014-11-08 20:43 - 00000000 ____D () C:\Users\Fertl\Desktop\Mc-server 2014-11-08 16:52 - 2014-11-08 16:52 - 00000184 _____ () C:\Users\Fertl\Downloads\eula.txt 2014-11-08 16:52 - 2014-11-08 16:52 - 00000061 _____ () C:\Users\Fertl\Downloads\server.properties 2014-11-08 16:51 - 2014-11-08 16:52 - 00000000 ____D () C:\Users\Fertl\Downloads\Documents\world 2014-11-07 22:33 - 2014-11-07 22:33 - 03675075 _____ () C:\Users\Fertl\Downloads\SkaiaCraft_Launcher.zip 2014-11-07 22:33 - 2014-11-07 22:33 - 03675075 _____ () C:\Users\Fertl\Downloads\SkaiaCraft_Launcher (1).zip 2014-10-30 17:27 - 2014-11-14 15:19 - 00272296 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-10-30 17:27 - 2014-11-14 15:19 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-10-30 17:27 - 2014-11-14 15:19 - 00176552 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-10-30 17:27 - 2014-11-14 15:19 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-10-30 17:27 - 2014-11-14 15:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-10-26 11:34 - 2014-10-26 11:34 - 08478720 _____ () C:\Users\Fertl\Downloads\hamachi_2.2.0.236.msi 2014-10-23 04:44 - 2014-10-22 14:32 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-20 09:50 - 2009-07-14 05:45 - 00020592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-20 09:50 - 2009-07-14 05:45 - 00020592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-20 09:29 - 2013-07-18 08:57 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-20 09:21 - 2013-05-30 08:50 - 00000000 ____D () C:\Windows\system32\appmgmt 2014-11-20 09:21 - 2012-12-06 16:28 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-11-20 09:20 - 2012-10-31 09:20 - 00000410 _____ () C:\Windows\Tasks\Final Media Player Update Checker.job 2014-11-20 08:34 - 2013-08-16 13:29 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000UA.job 2014-11-20 07:30 - 2012-11-16 19:16 - 00000000 ____D () C:\Users\Fertl\AppData\Roaming\Skype 2014-11-20 03:54 - 2014-04-18 01:55 - 00000563 _____ () C:\Windows\Tasks\RegCure Pro_sch_17253985-C694-11E3-B8EC-902B34A89D1A.job 2014-11-19 21:21 - 2012-12-06 16:28 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-11-19 20:40 - 2014-06-01 12:21 - 00017731 _____ () C:\Windows\setupact.log 2014-11-19 18:00 - 2013-05-12 09:44 - 00000468 _____ () C:\Windows\Tasks\ParetoLogic Registration3.job 2014-11-19 16:41 - 2012-10-13 07:08 - 01950969 _____ () C:\Windows\WindowsUpdate.log 2014-11-19 14:34 - 2013-08-16 13:29 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000Core.job 2014-11-18 18:45 - 2012-10-24 15:59 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-11-18 12:53 - 2013-06-07 16:26 - 00000000 ____D () C:\Users\Fertl\AppData\Local\LogMeIn Hamachi 2014-11-17 22:56 - 2014-06-15 21:01 - 00000000 ____D () C:\Users\Fertl\AppData\Roaming\TS3Client 2014-11-17 20:25 - 2013-06-07 16:50 - 00000000 ____D () C:\Users\Fertl\AppData\Roaming\.minecraft 2014-11-16 07:55 - 2012-10-14 06:48 - 00000000 ____D () C:\Users\Fertl\AppData\Roaming\vlc 2014-11-14 15:19 - 2012-10-13 16:09 - 00000000 ____D () C:\Program Files (x86)\Java 2014-11-14 15:14 - 2013-09-23 15:52 - 00000000 ____D () C:\ProgramData\Oracle 2014-11-14 05:01 - 2012-11-27 08:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-11-14 02:55 - 2013-05-12 09:44 - 00000442 _____ () C:\Windows\Tasks\ParetoLogic Update Version3.job 2014-11-12 21:29 - 2013-07-18 08:57 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-11-12 21:29 - 2013-06-06 10:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-11-12 21:29 - 2013-06-06 10:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-11-12 21:16 - 2012-12-06 16:28 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-11-12 21:16 - 2012-12-06 16:28 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-11-11 07:34 - 2009-07-14 18:58 - 00699432 _____ () C:\Windows\system32\perfh007.dat 2014-11-11 07:34 - 2009-07-14 18:58 - 00149572 _____ () C:\Windows\system32\perfc007.dat 2014-11-11 07:34 - 2009-07-14 06:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-03 00:21 - 2014-06-06 07:47 - 00378406 _____ () C:\Windows\PFRO.log 2014-11-03 00:21 - 2013-05-12 09:44 - 00000494 _____ () C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job 2014-11-03 00:21 - 2012-10-13 09:51 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-11-03 00:21 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-30 17:37 - 2014-10-13 09:08 - 00000000 ____D () C:\Program Files (x86)\Framed Display 2014-10-28 16:19 - 2014-07-18 06:46 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-10-28 06:34 - 2012-10-13 08:37 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-10-25 04:56 - 2009-07-14 03:34 - 00000580 _____ () C:\Windows\win.ini Some content of TEMP: ==================== C:\Users\Fertl\AppData\Local\Temp\APNSetup.exe C:\Users\Fertl\AppData\Local\Temp\DTLite4491-0356.exe C:\Users\Fertl\AppData\Local\Temp\i4jdel0.exe C:\Users\Fertl\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe C:\Users\Fertl\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Fertl\AppData\Local\Temp\nvStInst.exe C:\Users\Fertl\AppData\Local\Temp\SkypeSetup.exe C:\Users\Fertl\AppData\Local\Temp\swt-win32-3349.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite10908.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite11242.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite12493.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite12730.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite12959.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite13073.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite13190.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite14089.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite14797.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite14977.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite15762.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite16203.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite16276.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite16848.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite17868.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite17979.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite20814.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite21215.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite22469.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite22850.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite23477.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite24922.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite26949.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite27113.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite27353.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite27513.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite29463.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite29473.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite32071.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite32416.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite33344.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite33594.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite33862.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite34671.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite36010.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite36596.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite36638.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite36897.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite38075.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite38232.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite38873.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite38937.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite39964.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite40016.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite42857.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite43545.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite43715.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite45134.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite45385.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite45608.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite45609.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite50159.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite50301.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite52778.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite53704.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite54004.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite56095.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite56216.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite56287.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite56411.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite56687.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite59224.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite60241.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite60335.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite60674.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite62128.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite64704.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite64767.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite65248.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite65993.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite66314.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite68547.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite69098.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite70033.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite70292.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite70668.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite71092.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite71205.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite73634.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite73667.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite74143.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite74799.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite75778.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite77008.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite77145.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite77557.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite77869.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite78011.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite78254.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite79280.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite79442.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite79934.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite81749.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite84043.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite86211.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite87102.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite89759.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite90295.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite91309.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite92870.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite93268.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite93531.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite96718.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite98017.dll C:\Users\Fertl\AppData\Local\Temp\System.Data.SQLite99695.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe [2014-05-15 10:01] - [2011-01-16 01:01] - 0389632 ____A (Microsoft Corporation) 81257415084B84F3C0D95C381A8D4C8F C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll [2012-10-13 15:36] - [2011-01-16 01:01] - 1008640 ____A (Microsoft Corporation) 0B864E15A0BADFF0E7BB8B59009FDDCF C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-05 00:50 ==================== End Of Log ============================ --- --- --- Anhang 70924FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-11-2014 Ran by Fertl at 2014-11-20 09:51:51 Running from C:\Users\Fertl\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated) Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.) Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}) (Version: 6.0.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software) BCL easyConverter 3.0 Licensing Module (BCL License) (x32 Version: 3.0.18 - BCL Technologies) Hidden BCL easyConverter 3.0 Loader SDK Module (x32 Version: 3.0.18 - BCL Technologies) Hidden BCL easyConverter 3.0 Module (Loader, BCL License) (x32 Version: 3.0.18 - BCL Technologies) Hidden BCL easyConverter 3.0 Module (RTF, BCL License) (x32 Version: 3.0.18 - BCL Technologies) Hidden BCL easyConverter 3.0 RTF SDK Module (x32 Version: 3.0.18 - BCL Technologies) Hidden BCL easyConverter 3.0 SDK Module (x32 Version: 3.0.18 - BCL Technologies) Hidden Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.) CPUID HWMonitor 1.18 (HKLM\...\CPUID HWMonitor_is1) (Version: - ) DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd) DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.9 - DivX, LLC) ESO Survey Live version 1.3.0 (HKLM-x32\...\17CBAF83-B4D1-41CC-B7DC-BFF1D4B9DDAC-live_is1) (Version: 1.3.0 - Immersyve, Inc.) Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.118 - Etron Technology) Etron USB3.0 Host Controller (x32 Version: 0.118 - Etron Technology) Hidden EVEREST Home Edition v2.20 (HKLM-x32\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc) EVEREST Ultimate Edition v5.50 (HKLM-x32\...\EVEREST Ultimate Edition_is1) (Version: 5.50 - Lavalys, Inc.) Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited) Final Media Player 2012 (HKLM-x32\...\FinalMediaPlayer_is1) (Version: 2012.10.9.0 - Bitberry Software) <==== ATTENTION forteManager (HKLM-x32\...\{DA6FAB8D-E87A-4E8E-A3D3-B7B9F479C725}) (Version: 3.18 - LG Soft India) Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden HP Deskjet 2510 series - Grundlegende Software für das Gerät (HKLM\...\{288614B1-F070-4B47-A1F5-4790BD8A3176}) (Version: 28.0.1313.0 - Hewlett-Packard Co.) HP Deskjet 2510 series Hilfe (HKLM-x32\...\{07B48D2C-E60D-41E6-B546-11D128F633EC}) (Version: 27.0.0 - Hewlett Packard) HP Deskjet 2510 series Setup Guide (HKLM-x32\...\{216C7F38-4BBC-4E9A-8392-C9FA21B54386}) (Version: 27.0.0 - Hewlett Packard) HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP) HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard) HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden iCloud (HKLM\...\{D0CB24F4-084F-40DE-B6B9-A03626E682F0}) (Version: 2.1.1.3 - Apple Inc.) IncrediMail (x32 Version: 6.3.9.5233 - IncrediMail) Hidden IncrediMail 2.0 (HKLM-x32\...\IncrediMail) (Version: 6.3.9.5233 - IncrediMail Ltd.) inSSIDer 3 (HKLM-x32\...\{A80CEA4E-74C1-4F9F-806B-E1D9AFC01768}) (Version: 3.0.7.48 - MetaGeek, LLC) inSSIDer Home (HKLM-x32\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC) iTunes (HKLM\...\{0E5D76AD-A3FB-48D5-8400-8903B10317D3}) (Version: 11.0.1.12 - Apple Inc.) Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation) Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation) League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games ) League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.266 - LogMeIn, Inc.) LogMeIn Hamachi (x32 Version: 2.2.0.266 - LogMeIn, Inc.) Hidden Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Mozilla Firefox 34.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0 (x86 de)) (Version: 34.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla) MPC-HC 1.6.5.6366 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.6.5.6366 - MPC-HC Team) NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation) NVIDIA GeForce Experience 2.1.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.2 - NVIDIA Corporation) NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation) NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation) Opera 12.15 (HKLM\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA) Opticon USB Drivers Installer (HKLM-x32\...\Opticon USB Installer) (Version: - ) Origin (HKLM-x32\...\Origin) (Version: 9.3.10.4710 - Electronic Arts, Inc.) osu! (HKLM-x32\...\{C3592426-531E-4110-911D-BFECE2CE284C}) (Version: 0.0.0.0 - peppy) PDF2Word Converter Version 1.1.0 (Build 164, 7-PDF) (HKLM-x32\...\PDF2Word Converter (7-PDF)_is1) (Version: PDF2Word Converter - Version 1.1.0 (Build 164) - 7-PDF, Germany - Thorsten Hodes) PowerISO (HKLM-x32\...\PowerISO) (Version: - ) QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.) Razer Game Booster (HKLM-x32\...\Razer Game Booster_is1) (Version: 4.2.42.0 - Razer Inc.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6482 - Realtek Semiconductor Corp.) RegCure Pro (HKLM-x32\...\{C547F361-5750-4CD1-9FB6-BC93827CB6C1}) (Version: 3.2.8.0 - ParetoLogic, Inc.) Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.) ScanIT-Client 3.3 (HKLM-x32\...\ScanIT-Client_is1) (Version: - GfK SE) SHIELD Streaming (Version: 3.1.200 - NVIDIA Corporation) Hidden SHIELD Wireless Controller Driver (Version: 16.13.42 - NVIDIA Corporation) Hidden Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.) Spotify (HKU\S-1-5-21-1597344951-833908811-148078042-1000\...\Spotify) (Version: 0.9.11.27.g2b1a638c - Spotify AB) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH) Unity Web Player (HKU\S-1-5-21-1597344951-833908811-148078042-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft) Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft) Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft) VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN) Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.4.0.0 - Azureus Software, Inc.) WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH) World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 14-11-2014 14:17:32 Removed Java 8 Update 25 20-11-2014 08:19:45 Removed Java 7 Update 71 ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {2B7E4AD7-D28D-41C1-8D2A-4B7C9D3A09B9} - System32\Tasks\ParetoLogic Registration3 => Rundll32.exe "C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll" RunUns Task: {424C2BC7-4079-4567-A1E9-B0BF3DB11FF3} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\WatTask => C:\Windows Activation Technologies\wat.exe [2006-04-21] () Task: {5B86F538-191A-4F4D-B015-6E3699F18405} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-06] (Google Inc.) Task: {6B0E6E33-C065-4D3E-A235-050A1ADF73D0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {925A3F7E-0DE7-4E06-AAD2-F900399DDA5D} - System32\Tasks\RegCure Pro_sch_17253985-C694-11E3-B8EC-902B34A89D1A => C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe [2014-07-17] (ParetoLogic, Inc.) Task: {9812B954-D5CC-493A-90D9-265FAF7607C9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated) Task: {9E7A6EE5-C52F-4CF7-BF74-A4B4F0058CF4} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000UA => C:\Users\Fertl\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-16] (Facebook Inc.) Task: {ACF4D6E4-0EB7-415A-85B5-F407E7414F8F} - System32\Tasks\ParetoLogic Update Version3 Startup Task => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2013-03-28] () Task: {AFBA4501-88C0-4C41-A3C6-E0C76AF56358} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-12-06] (Google Inc.) Task: {B59E0043-483E-442A-8A71-0A81C842516B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000Core => C:\Users\Fertl\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-16] (Facebook Inc.) Task: {C2710C4A-4BF1-4F24-AC68-EEDF5811C394} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-14] (AVAST Software) Task: {DF688DCA-7FE5-4D9A-8A7E-B3CD621E007A} - System32\Tasks\Final Media Player Update Checker => C:\Program Files (x86)\FinalMediaPlayer\FMPCheckForUpdates.exe [2012-09-02] (Bitberry Software) Task: {FDCEF293-083A-457E-A02F-6FA8811CE906} - System32\Tasks\ParetoLogic Update Version3 => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2013-03-28] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000Core.job => C:\Users\Fertl\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1597344951-833908811-148078042-1000UA.job => C:\Users\Fertl\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\Windows\Tasks\Final Media Player Update Checker.job => C:\Program Files (x86)\FinalMediaPlayer\FMPCheckForUpdates.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\ParetoLogic Registration3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\UUS3.dll Task: C:\Windows\Tasks\ParetoLogic Update Version3 Startup Task.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe Task: C:\Windows\Tasks\ParetoLogic Update Version3.job => C:\Program Files (x86)\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe Task: C:\Windows\Tasks\RegCure Pro_sch_17253985-C694-11E3-B8EC-902B34A89D1A.job => C:\Program Files (x86)\ParetoLogic\RegCure Pro\RegCurePro.exe ==================== Loaded Modules (whitelisted) ============= 2012-10-13 09:51 - 2014-09-13 22:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2012-12-17 17:14 - 2012-12-17 17:14 - 00954848 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll 2014-11-01 21:40 - 2014-11-01 21:40 - 02898944 _____ () C:\Program Files\AVAST Software\Avast\defs\14110101\algo.dll 2014-11-19 22:01 - 2014-11-19 22:01 - 02902528 _____ () C:\Program Files\AVAST Software\Avast\defs\14111901\algo.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2012-11-28 14:13 - 2012-11-28 14:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-10-09 11:30 - 2012-11-20 15:13 - 00264192 _____ () C:\Program Files (x86)\Razer\Razer Game Booster\D3DX8Wrapper.dll 2014-10-09 11:30 - 2013-11-12 08:57 - 00098304 _____ () C:\Program Files (x86)\Razer\Razer Game Booster\EasyHook32.dll 2013-12-13 11:00 - 2013-12-13 11:00 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2012-10-14 17:17 - 2012-10-14 17:17 - 00032680 _____ () C:\Program Files (x86)\IncrediMail\Bin\IMHttpComm.dll 2012-10-14 17:17 - 2012-10-14 17:17 - 00071664 _____ () C:\Program Files (x86)\IncrediMail\Bin\wlessfp1.dll 2012-10-14 17:17 - 2012-10-14 17:17 - 00268272 _____ () C:\Program Files (x86)\IncrediMail\Bin\ImLookExU.dll 2012-10-14 17:17 - 2012-10-14 17:17 - 00079856 _____ () C:\Program Files (x86)\IncrediMail\bin\ImAppRU.dll 2012-10-14 17:17 - 2012-10-14 17:17 - 00133104 _____ () C:\Program Files (x86)\IncrediMail\Bin\ImComUtlU.dll 2013-07-10 17:07 - 2013-07-10 17:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL 2012-07-30 19:54 - 2010-12-29 03:40 - 00107896 _____ () C:\Program Files (x86)\IncrediMail\Bin\pmc.dll 2014-10-28 16:19 - 2014-10-22 05:04 - 01042760 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libglesv2.dll 2014-10-28 16:19 - 2014-10-22 05:04 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\libegl.dll 2014-10-28 16:19 - 2014-10-22 05:04 - 08910664 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\pdf.dll 2014-10-28 16:19 - 2014-10-22 05:04 - 01681224 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\ffmpegsumo.dll 2014-10-28 16:19 - 2014-10-22 05:05 - 14902600 _____ () C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.111\PepperFlash\pepflashplayer.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\Services: McComponentHostService => 3 MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ESO Survey Live.lnk => C:\Windows\pss\ESO Survey Live.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^forteManager.lnk => C:\Windows\pss\forteManager.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW MSCONFIG\startupreg: EADM => "E:\Program Files (x86)\Origin\Origin.exe" -AutoStart MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe MSCONFIG\startupreg: ISUSPM Startup => C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup MSCONFIG\startupreg: ISUSScheduler => "C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe" -start MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe" MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start MSCONFIG\startupreg: PWRISOVM.EXE => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun MSCONFIG\startupreg: Smart File Advisor => "C:\Program Files (x86)\Smart File Advisor\sfa.exe" /checkassoc MSCONFIG\startupreg: Spotify => "C:\Users\Fertl\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Fertl\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" ========================= Accounts: ========================== Administrator (S-1-5-21-1597344951-833908811-148078042-500 - Administrator - Disabled) Fertl (S-1-5-21-1597344951-833908811-148078042-1000 - Administrator - Enabled) => C:\Users\Fertl Gast (S-1-5-21-1597344951-833908811-148078042-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1597344951-833908811-148078042-1049 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: Microsoft-Teredo-Tunneling-Adapter Description: Microsoft-Teredo-Tunneling-Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (11/20/2014 09:21:44 AM) (Source: MsiInstaller) (EventID: 10005) (User: Fertl-PC) Description: Produkt: Search App by Ask -- Fehler 25001. Die folgenden Anwendungen sollten geschlossen werden, bevor Sie mit der Deinstallation fortfahren: Google Chrome Error: (11/20/2014 07:29:55 AM) (Source: Chrome) (EventID: 1) (User: NT-AUTORITÄT) Description: Chrome has encountered a fatal error. ver=38.0.2125.111;lang=;guid=1C3231219F5F4060B10585F6419DC66F;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\9f30c9b9-8f67-4cda-9c28-d664826fa795.dmp Error: (11/19/2014 08:20:52 PM) (Source: Chrome) (EventID: 1) (User: NT-AUTORITÄT) Description: Chrome has encountered a fatal error. ver=38.0.2125.111;lang=;guid=1C3231219F5F4060B10585F6419DC66F;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\fc477c69-6c56-429b-be28-5cecf95b4434.dmp Error: (11/14/2014 06:01:37 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: TBNotifier.exe, Version: 31.10.3.0, Zeitstempel: 0x542f0232 Name des fehlerhaften Moduls: TBNotifier.exe, Version: 31.10.3.0, Zeitstempel: 0x542f0232 Ausnahmecode: 0x40000015 Fehleroffset: 0x0011486c ID des fehlerhaften Prozesses: 0x5984 Startzeit der fehlerhaften Anwendung: 0xTBNotifier.exe0 Pfad der fehlerhaften Anwendung: TBNotifier.exe1 Pfad des fehlerhaften Moduls: TBNotifier.exe2 Berichtskennung: TBNotifier.exe3 Error: (11/14/2014 03:31:49 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm javaw.exe, Version 8.0.25.18 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 454c Startzeit: 01d00017a5ec6077 Endzeit: 12 Anwendungspfad: C:\Program Files\Java\jre1.8.0_25\bin\javaw.exe Berichts-ID: f6023b74-6c0a-11e4-baa1-902b34a89d1a Error: (11/14/2014 02:58:33 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Programm WinRAR.exe, Version 5.10.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 84fc Startzeit: 01d000130e363220 Endzeit: 8 Anwendungspfad: C:\Program Files\WinRAR\WinRAR.exe Berichts-ID: 4ffbbfa6-6c06-11e4-baa1-902b34a89d1a Error: (11/12/2014 03:31:00 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac Name des fehlerhaften Moduls: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b8554 ID des fehlerhaften Prozesses: 0x4b4 Startzeit der fehlerhaften Anwendung: 0xrads_user_kernel.exe0 Pfad der fehlerhaften Anwendung: rads_user_kernel.exe1 Pfad des fehlerhaften Moduls: rads_user_kernel.exe2 Berichtskennung: rads_user_kernel.exe3 Error: (11/12/2014 03:30:51 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac Name des fehlerhaften Moduls: rads_user_kernel.exe, Version: 0.0.0.0, Zeitstempel: 0x4e65c1ac Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b8554 ID des fehlerhaften Prozesses: 0x45d4 Startzeit der fehlerhaften Anwendung: 0xrads_user_kernel.exe0 Pfad der fehlerhaften Anwendung: rads_user_kernel.exe1 Pfad des fehlerhaften Moduls: rads_user_kernel.exe2 Berichtskennung: rads_user_kernel.exe3 Error: (11/09/2014 07:22:17 AM) (Source: SideBySide) (EventID: 80) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (11/05/2014 10:44:21 PM) (Source: Chrome) (EventID: 1) (User: NT-AUTORITÄT) Description: Chrome has encountered a fatal error. ver=38.0.2125.111;lang=;guid=1C3231219F5F4060B10585F6419DC66F;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\7eda2fea-d6ac-4aa1-9daf-c49b764c1a36.dmp System errors: ============= Error: (11/17/2014 07:53:44 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JASI", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/16/2014 10:50:48 AM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EMILDYRCZ", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/15/2014 03:32:38 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EMILDYRCZ", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/13/2014 05:26:20 PM) (Source: BROWSER) (EventID: 8032) (User: ) Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}" zu oft fehl. Der Sicherungssuchdienst wird beendet. Error: (11/13/2014 04:53:50 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JASI", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/11/2014 08:28:48 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "EMILDYRCZ", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/11/2014 07:04:59 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JASI", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Error: (11/10/2014 03:21:51 AM) (Source: Service Control Manager) (EventID: 7030) (User: ) Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error: (11/08/2014 03:01:14 PM) (Source: BROWSER) (EventID: 8032) (User: ) Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}" zu oft fehl. Der Sicherungssuchdienst wird beendet. Error: (11/08/2014 02:30:05 PM) (Source: bowser) (EventID: 8003) (User: ) Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "JASI", der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{CD851394-4315-457E-AE6C-A038F5C6E53D}-Transport zu sein scheint. Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen. Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2014-11-20 09:50:39.874 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 09:33:56.538 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 09:01:44.607 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 08:49:27.288 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 08:00:33.934 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 07:41:28.599 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 07:30:19.624 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 06:28:02.590 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 06:13:13.718 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2014-11-20 01:05:32.238 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume5\Windows\System32\user32.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Processor: AMD Phenom(tm) II X6 1045T Processor Percentage of memory in use: 34% Total physical RAM: 16381.55 MB Available physical RAM: 10706.31 MB Total Pagefile: 32761.29 MB Available Pagefile: 26136.91 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive b: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive c: () (Fixed) (Total:119.14 GB) (Free:25.52 GB) NTFS Drive d: () (Fixed) (Total:97.56 GB) (Free:4.87 GB) NTFS ==>[System with boot components (obtained from reading drive)] Drive e: (Andre) (Fixed) (Total:443.23 GB) (Free:61.26 GB) NTFS Drive f: (Bianca) (Fixed) (Total:390.62 GB) (Free:94.16 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: A3B4DC53) Partition 1: (Active) - (Size=97.6 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=390.6 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: D51A7618) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Geändert von andreas041 (20.11.2014 um 10:17 Uhr) |
20.11.2014, 13:59 | #4 |
| Pop-Ups ploppen auf wenn ich Webseiten gehe! Keiner da der mir helfen könnte!! Mfg Andreas |
20.11.2014, 19:21 | #5 | |
/// the machine /// TB-Ausbilder | Pop-Ups ploppen auf wenn ich Webseiten gehe!Zitat:
Lade Dir bitte von hier Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
Themen zu Pop-Ups ploppen auf wenn ich Webseiten gehe! |
amazon, coupons, entferne, entfernen, fehlercode 0x40000015, fehlercode 0xc0000005, fehlercode windows, final media player 2012 entfernen, kurzem, nervig, pop-ups, probelm, this device cannot start. (code10), webseite, webseiten |