| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinktWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.12.2014, 14:02
| #1 |
 |  Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hallo zusammen, Ich habe seit zwei Tagen ein Problem mit meinem Laptop. Ich habe ihn 2007 gekauft und keine nennenswerten Veränderungen vorgenommen seitdem eine Bekannte ihn mir eingerichtet hat. Am Wochenanfang kam das erste Mal die Meldung, dass der Windows- Befehlsprozessor für einen Vorgang meine Zustimmung braucht. Die Fenster erscheinen nicht auf dem Bildschirm, sondern in der unteren Bildschirmleiste. Wenn man die Fenster wegklickt, was auch im minimierten Zustand funktioniert, dann kommen sie kurze Zeit später wieder und blinken weiter. Bisher habe ich nur drei auf einmal gehabt, habe aber nie länger gewartet, ob noch ein viertes auftaucht. (Edit: Es kommt ein viertes, und sicher auch ein fünftes; die Tabs flackern ab und an, wenn ein neues Fenster in der unteren Bildschirmleiste auftaucht). Die Meldungen des Windows- Befehlsprozessors treten unabhängig von der Nutzung des Browsers auf. Wenn ich aber aktiv im Internet bin, scheinen sie sich schneller "zu vermehren" Zusätzlich öffnen sich auch Firefox- Fenster im Hintergrund mit irgendwelcher Werbung. Es öffnen sich aber keine neuen Tabs mit Werbung. Ich hoffe, ich kann hier Hilfe bekommen, obwohl mein Laptop nicht mehr der Neueste ist. Das Betriebssystem ist Windows Vista. Liebe Grüße Pebbels |
|
18.12.2014, 16:50
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
19.12.2014, 14:46
| #3 |
| | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hallo cosinus,
__________________Vielen Dank für die schnelle Antwort! Ich bin leider gar nicht versiert was die Internetsicherheit betrifft, ich habe nicht mal groß Ahnung, wie mein Virenprogramm heißt, ich weiß nur, dass ich eins hab. Ich habe jetzt nur das von Dir gewünschte Programm (ist doch ein Programm?) runtergeladen, es nach Anleitung "laufen" lassen und jetzt folgende Ergebnisse: FRST Editor FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014
Ran by Christina (administrator) on UNI-PC on 19-12-2014 14:37:37
Running from c:\Users\Christina\Downloads
Loaded Profile: Christina (Available profiles: Christina)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
() C:\Program Files\ICQ6Toolbar\ICQ Service.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Smartbar) C:\Users\Christina\AppData\Local\Smartbar\Application\Linkury.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\wercon.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)
HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Browser Infrastructure Helper] => C:\Users\Christina\AppData\Local\Smartbar\Application\Linkury.exe [20248 2013-03-04] (Smartbar)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30524520 2014-11-27] (Skype Technologies S.A.)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [cmd] => C:\Users\Christina\AppData\Local\Temp\Shuka\PackerV2.exe [5165056 2014-12-14] (Packer Framework) <===== ATTENTION
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Prev Search Bar = hxxp://google.icq.com/search/search_frame.php
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=hp&babsrc=lnkry_nt
URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}
SearchScopes: HKLM -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> DefaultScope {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {9EFE9CA0-6ABE-44DD-9C91-4B5EBB8FA2A1} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
BHO: No Name -> {0124123D-61B4-456f-AF86-78C53A0790C5} -> No File
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: XTTBPos00 Class -> {055FD26D-3A88-4e15-963D-DC8493744B1D} -> C:\Program Files\ICQToolbar\toolbaru.dll (IE Toolbar)
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Linkury SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} - No File
Toolbar: HKLM - Linkury Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
Toolbar: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default
FF NewTab: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=nt&babsrc=lnkry_nt
FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: ICQ Search
FF Homepage: hxxp://start.icq.com/
FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\bingp.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.gif
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.src
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Search_Results.xml
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Web Search.xml
FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\helperbar@helperbar.com [2013-03-04]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]
FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]
FF Extension: ICQ Toolbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2014-11-18]
FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext
FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]
FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]
R2 ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)
S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-19 14:37 - 2014-12-19 14:38 - 00019200 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-12-19 14:37 - 2014-12-19 14:37 - 00000000 ____D () C:\FRST
2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe
2014-12-16 20:59 - 2014-12-19 14:24 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService
2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-03 05:42 - 2014-12-03 05:42 - 00002489 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ___RD () C:\Program Files\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe
2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe
2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java
2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk
2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels
2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe
2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe
2014-11-21 22:27 - 2014-11-22 10:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-21 22:24 - 2014-11-21 22:24 - 00638888 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jxpiinstall.exe
2014-11-20 19:26 - 2014-12-06 14:40 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-19 14:34 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-19 14:29 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job
2014-12-19 14:28 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job
2014-12-19 14:24 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-19 14:19 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-19 14:17 - 2007-09-16 05:00 - 01473615 _____ () C:\Windows\WindowsUpdate.log
2014-12-19 14:13 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-19 14:13 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-19 14:13 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-19 07:22 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-19 07:22 - 2006-11-02 14:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-19 07:13 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat
2014-12-18 13:49 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-16 20:42 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-03 05:42 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype
2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log
2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches
2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-11-19 20:14 - 2014-11-18 20:29 - 00000000 ____D () C:\Program Files\ICQ7.5
Files to move or delete:
====================
C:\Users\Christina\AppData\Local\Temp\Shuka\PackerV2.exe
C:\ProgramData\ezsid.dat
Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\Christina\AppData\Local\Temp\AskSLib.dll
C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE
C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL
C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe
C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe
C:\Users\Christina\AppData\Local\Temp\installhelper.dll
C:\Users\Christina\AppData\Local\Temp\JavaRa.exe
C:\Users\Christina\AppData\Local\Temp\jli.dll
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe
C:\Users\Christina\AppData\Local\Temp\keytool.exe
C:\Users\Christina\AppData\Local\Temp\Kraus.exe
C:\Users\Christina\AppData\Local\Temp\msvcr100.dll
C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Christina\AppData\Local\Temp\node.exe
C:\Users\Christina\AppData\Local\Temp\propsys.dll
C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Christina\AppData\Local\Temp\sqlite3.exe
C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe
C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-19 14:28
==================== End Of Log ============================
FRST Addition Editor Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014
Ran by Christina at 2014-12-19 14:39:17
Running from c:\Users\Christina\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office system (HKLM\...\PROHYBRIDR) (Version: 12.0.6425.1000 - Microsoft Corporation)
7-Zip 4.65 (HKLM\...\7-Zip) (Version: - )
AC3Filter 1.63b (HKLM\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader 9 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
Atheros WLAN Client (HKLM\...\{04983D37-2202-4295-94A2-8B547C66133F}) (Version: 1.00.000 - )
ATI Catalyst Install Manager (HKLM\...\{1ABD9408-C1DC-EF1F-40E8-2D9A6531CDA3}) (Version: 3.0.624.0 - ATI Technologies, Inc.)
AVStation Now (HKLM\...\InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}) (Version: 4.0.10.6 - Ihr Firmenname)
AVStation Now (Version: 4.0.10.6 - Ihr Firmenname) Hidden
Bass Audio Decoder (remove only) (HKLM\...\Bass Audio Decoder) (Version: - )
BufferChm (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Business Contact Manager für Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden
ccc-core-static (Version: 2007.0730.2152.37233 - Ihr Firmenname) Hidden
Content Transfer (HKLM\...\{CFADE4AF-C0CF-4A04-A776-741318F1658F}) (Version: 1.3.0.23190 - Sony Corporation)
CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
D4200 (Version: 90.0.235.000 - Hewlett-Packard) Hidden
D4200_Help (Version: 90.0.235.000 - Hewlett-Packard) Hidden
DC-Bass Source 1.1.1 (HKLM\...\DC-Bass Source) (Version: - )
DCoder Image Source (remove only) (HKLM\...\DCoder Image Source) (Version: - )
DeviceDiscovery (Version: 110.0.180.000 - Hewlett-Packard) Hidden
DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
DirectVobSub (remove only) (HKLM\...\DirectVobSub) (Version: - )
dj_sf_ProductContext (Version: 90.0.235.000 - Hewlett-Packard) Hidden
dj_sf_software (Version: 90.0.235.000 - Hewlett-Packard) Hidden
dj_sf_software_req (Version: 90.0.235.000 - Hewlett-Packard) Hidden
DScaler 5 Mpeg Decoders (HKLM\...\DScaler 5 Mpeg Decoders_is1) (Version: - )
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.0.1603 - CyberLink Corporation)
Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.1 - )
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.0.0.0 - Samsung)
Easy Network Manager 3.0 (HKLM\...\InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}) (Version: 3.0.0.0 - Ihr Firmenname)
Easy Network Manager 3.0 (Version: 3.0.0.0 - Ihr Firmenname) Hidden
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.0.11 - )
eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
ffdshow [rev 3124] [2009-11-03] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
FFMPEG Core Files (remove only) (HKLM\...\FFMPEG Core Files) (Version: - )
Gabest MPEG Splitter (remove only) (HKLM\...\Gabest MPEG Splitter) (Version: - )
GameSpy Comrade (HKLM\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)
GEAR 32bit Driver Installer (HKLM\...\{E89B484C-B913-49A0-959B-89E836001658}) (Version: 2.005.1 - GEAR Software, Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Haali Media Splitter (HKLM\...\HaaliMkx) (Version: - )
HP Customer Participation Program 9.0 (HKLM\...\HPExtendedCapabilities) (Version: 9.0 - HP)
HP Deskjet Printer Driver Software 9.0 (HKLM\...\{03E66394-42F0-4745-85F7-0A2F8F35C09F}) (Version: 9.0 - HP)
HP Imaging Device Functions 9.0 (HKLM\...\HP Imaging Device Functions) (Version: 9.0 - HP)
HP Photosmart Essential 2.01 (HKLM\...\HP Photosmart Essential) (Version: 2.01 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 9.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 9.0 - HP)
HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPProductAssistant (Version: 90.0.146.000 - Hewlett-Packard) Hidden
HPSSupply (HKLM\...\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}) (Version: 2.2.0.0000 - Ihr Firmenname)
ICQ Toolbar (HKLM\...\ICQToolbar) (Version: 3.0.0 - ICQ)
ICQ7.5 (HKLM\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)
imagine digital freedom - Samsung (HKLM\...\{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}) (Version: 1.0.2.0 - Samsung Electronics Co., LTD)
Install McAfee (HKLM\...\{6B32EF07-8A23-4824-91BD-B0F24E50E974}) (Version: 1.00.0000 - Samsung Electronics Co., LTD,)
Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
jZip (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\jZip) (Version: 2.0.0.131211 - Bandoo Media Inc) <==== ATTENTION
Linkury Smartbar (HKLM\...\{01CE337E-F88F-437B-A71A-AF527986BE48}) (Version: 1.6.1.909 - Linkury Inc.) <==== ATTENTION
MarketResearch (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2572067) (HKLM\...\M2572067) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft SOAP Toolkit 2.0 SP2 (HKLM\...\{36BEAD11-8577-49AD-9250-E06A50AE87B0}) (Version: 623.1 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MONOGRAM AMR Splitter/Decoder (remove only) (HKLM\...\MONOGRAM AMR Splitter/Decoder) (Version: - )
Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Move Networks Player - IE) (Version: - )
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
NWZ-E450 WALKMAN Guide (HKLM\...\{0A6C2811-AD29-473F-8086-F0B401276DEC}) (Version: 2.1.0.17210 - Sony Corporation)
PanoStandAlone (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Play AVStation (HKLM\...\InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}) (Version: 4.1.20.46 - Ihr Firmenname)
Play AVStation (Version: 4.1.20.46 - Ihr Firmenname) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2802.0 - CyberLink Corporation)
PSSWCORE (Version: 2.01.0000 - Hewlett-Packard) Hidden
RealMedia (remove only) (HKLM\...\RealMedia) (Version: - )
RealPlayer (HKLM\...\RealPlayer 12.0) (Version: - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )
Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.00 - )
Samsung Recovery Solution II (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 2.0 - Samsung)
Samsung Update Plus (HKLM\...\InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}) (Version: 2.0 - Samsung Electronics Co., LTD)
Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD) Hidden
SHOUTcast Source (remove only) (HKLM\...\SHOUTcast Source) (Version: - )
Skins (Version: 2007.0730.2152.37233 - ATI) Hidden
Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)
SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Status (Version: 110.0.180.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.1.22.0 - Synaptics)
Toolbox (Version: 90.0.146.000 - Hewlett-Packard) Hidden
TrayApp (Version: 110.0.180.000 - Hewlett-Packard) Hidden
UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Outlook 2007 Junk Email Filter (KB2596560) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{2964DDE1-4925-4DF1-AF2C-0A36B3442228}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VideoToolkit01 (Version: 90.0.146.000 - Hewlett-Packard) Hidden
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WebReg (Version: 90.0.146.000 - Hewlett-Packard) Hidden
WIDCOMM Bluetooth Software 6.0.1.5000 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5000 - WIDCOMM, Inc.)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Zoom Player (remove only) (HKLM\...\ZoomPlayer) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
==================== Restore Points =========================
13-12-2014 12:38:07 Geplanter Prüfpunkt
14-12-2014 19:00:03 Windows-Sicherung
18-12-2014 13:21:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2010-09-17 17:07 - 00419366 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {00407FA0-B26A-4D78-BAE4-DCED18CE0BBD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)
Task: {2E73D919-5704-48F5-BD45-2DA050634DD6} - System32\Tasks\advSRSII => C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe [2007-04-04] ()
Task: {36CC60E7-F073-45B7-92D3-2D0FCA4284BD} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2007-04-26] (Samsung Electronics Co., Ltd.)
Task: {4A0BA790-7E2E-41C2-9630-365ED6C19CE8} - System32\Tasks\{F8403358-9DFC-48DD-9814-C3C5B64B5224} => C:\Program Files\Skype\Phone\Skype.exe [2014-11-27] (Skype Technologies S.A.)
Task: {75A56371-2508-45D0-B522-4FFA66030227} - System32\Tasks\SupBackGroundTask => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe [2010-04-20] ()
Task: {80AF346F-AA8E-4BBC-8A2E-87C003976B06} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2007-06-01] (SAMSUNG Electronics)
Task: {9DBC4E1A-1A47-4365-985F-7EE43499F7AB} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2007-06-29] (SAMSUNG Electronics co., LTD.)
Task: {A2905CD7-15D6-4F90-9726-C98606071C61} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)
Task: {AB3D9F35-AFB4-48F0-83D2-09826838A45F} - System32\Tasks\{D36EF826-E004-4D3A-8C17-E5566C882B0D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124.259/en/abandoninstall?page=tsPlugin&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {B57FF0ED-4252-4D91-9B7C-6BDEB436AC3C} - System32\Tasks\{2EBAA3D6-013C-4628-BBCC-CA3BCB57800C} => pcalua.exe -a "C:\Users\Christina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0MADX4B0\miranda-im-v0.7.10-unicode[1].exe" -d "C:\Users\Christina\AppData\Roaming\ICQ Toolbar"
Task: {B8A0DA75-CD83-48CB-9EBA-7F9AE7FC2FAB} - System32\Tasks\{EA6DECD8-58E9-4AE1-A135-2AE6697E86F7} => C:\Program Files\Skype\Phone\Skype.exe [2014-11-27] (Skype Technologies S.A.)
Task: {C954C976-60FD-4FB5-95E6-628BF7CDBE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)
Task: {E1EDABFD-F216-4F52-9A90-0759D4836240} - System32\Tasks\{2E3842F9-8974-4CD3-8E95-B5376AF0C567} => pcalua.exe -a "C:\Program Files\OpenSource Flash Video Splitter\uninstall.exe"
Task: {E90E0C26-3D38-4B64-893D-954ADAFB7503} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2007-04-24] (Samsung Electronics Co., Ltd.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SupBackGroundTask.job => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2008-11-02 22:38 - 2010-11-21 11:49 - 00247608 _____ () C:\Program Files\ICQ6Toolbar\ICQ Service.exe
2014-10-27 16:04 - 2014-10-27 16:04 - 00028160 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe
2007-08-07 23:39 - 2007-01-08 14:39 - 00171040 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 00974848 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 01686016 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMHost.dll
2014-12-01 17:01 - 2014-12-01 17:01 - 02745856 _____ () C:\Users\Christina\AppData\Local\RGMService\MonetizationToolsManager.dll
2014-12-01 17:02 - 2014-12-01 17:02 - 01592832 _____ () C:\Users\Christina\AppData\Local\RGMService\ProtectorsManager.dll
2007-08-08 00:17 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2007-08-07 06:06 - 2007-08-07 01:31 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2007-08-07 23:51 - 2007-04-04 06:10 - 01379328 _____ () C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
2007-08-07 23:50 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2007-08-07 23:50 - 2006-09-19 01:52 - 00028672 _____ () C:\Program Files\Samsung\Easy Display Manager\WinMove.dll
2007-08-07 23:54 - 2007-02-23 10:32 - 00065536 _____ () C:\Program Files\Samsung\EBM\ChkSec.dll
2007-08-07 23:55 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00029464 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00044312 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00018712 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00069400 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 01629976 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00078104 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessLogic.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00012568 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.EventManager.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00659224 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00081176 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00013592 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00016152 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00019736 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00019736 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00057112 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00014104 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Multimedia.Loader.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00050968 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00013592 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll
2013-03-04 09:33 - 2013-03-04 09:33 - 00047384 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\MACTrackBarLib.dll
2013-03-04 09:32 - 2013-03-04 09:32 - 00025368 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll
2013-03-04 09:34 - 2013-03-04 09:34 - 00025368 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll
2007-04-24 10:32 - 2007-04-24 10:32 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2014-12-09 20:02 - 2014-12-09 20:03 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-12-09 20:34 - 2014-12-09 20:34 - 16841392 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\View Baldur's Gate: Tales of The Sword Coast Readme.lnk
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^G DATA Firewall Tray.lnk => C:\Windows\pss\G DATA Firewall Tray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe => C:\Windows\pss\PowerReg Scheduler V3.exe.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AVKTray => "C:\Program Files\G DATA TotalCare\AVKTray\AVKTray.exe"
MSCONFIG\startupreg: GDFirewallTray => C:\Program Files\G DATA TotalCare\Firewall\GDFirewallTray.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: RemoteControl => "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: TkBellExe => "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-3116156678-3848323971-3931140469-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3116156678-3848323971-3931140469-1005 - Limited - Enabled)
Christina (S-1-5-21-3116156678-3848323971-3931140469-1003 - Administrator - Enabled) => C:\Users\Christina
Gast (S-1-5-21-3116156678-3848323971-3931140469-501 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/18/2014 01:05:42 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:42 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:24 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:24 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:17 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:17 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:10 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/18/2014 01:05:10 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/17/2014 08:53:32 PM) (Source: EventSystem) (EventID: 4621) (User: )
Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
Error: (12/16/2014 06:06:40 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (12/19/2014 02:15:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/19/2014 02:15:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/19/2014 02:13:24 PM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version
Error: (12/19/2014 07:22:36 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (12/19/2014 07:12:45 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/19/2014 07:12:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/19/2014 07:11:01 AM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version
Error: (12/18/2014 02:14:49 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (12/18/2014 00:39:53 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/18/2014 00:39:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Microsoft Office Sessions:
=========================
Error: (08/03/2009 11:53:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 353 seconds with 60 seconds of active time. This session ended with a crash.
Error: (09/21/2008 00:37:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2402 seconds with 300 seconds of active time. This session ended with a crash.
Error: (09/18/2008 10:22:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 114 seconds with 60 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2011-10-23 21:12:16.785
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-10-23 21:12:16.558
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-04 19:42:55.860
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-04 19:42:55.537
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 19:42:30.523
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 19:42:30.302
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 18:22:01.281
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 18:22:00.829
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-04-28 23:05:49.918
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-04-28 23:05:49.705
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz
Percentage of memory in use: 60%
Total physical RAM: 2045.45 MB
Available physical RAM: 812.09 MB
Total Pagefile: 4340.18 MB
Available Pagefile: 2883.11 MB
Total Virtual: 2047.88 MB
Available Virtual: 1886.96 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:69.05 GB) (Free:10.54 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:70 GB) (Free:5.95 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: 69F484A5)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=69 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Pebbels |
|
19.12.2014, 21:41
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
20.12.2014, 10:27
| #5 |
| | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hallo Adw Cleaner Code:
ATTFilter # AdwCleaner v4.105 - Bericht erstellt am 20/12/2014 um 10:08:16
# Aktualisiert 08/12/2014 von Xplode
# Database : 2014-12-16.1 [Live]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzername : Christina - UNI-PC
# Gestartet von : c:\Users\Christina\Downloads\AdwCleaner_4.105.exe
# Option : Löschen
***** [ Dienste ] *****
Dienst Gelöscht : ICQ Service
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\Program Files\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files\icqtoolbar
Ordner Gelöscht : C:\Program Files\jZip
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\jZip
Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Christina\AppData\Local\jZip
Ordner Gelöscht : C:\Users\Christina\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Christina\AppData\LocalLow\HPAppData
Ordner Gelöscht : C:\Users\Christina\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\HPAppData
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}
Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\helperbar@helperbar.com
Datei Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Searchqu.ini
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\jZip.lnk
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk
Datei Gelöscht : C:\Users\Christina\Desktop\jZip.lnk
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\bingp.xml
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.gif
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.src
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.xml
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Search_Results.xml
Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Web Search.xml
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Christina\Desktop\Search.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\jZip.file
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPath\jZip.exe
Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [cmd]
Schlüssel Gelöscht : HKCU\Software\XTTB00001
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.XTTBPos00
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.XTTBPos00.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.IEToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.IEToolbar.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.XTTB00001
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.XTTB00001.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4BD2D6C3-31DC-B947-23D0-DC52EC4F0C4C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9EFE9CA0-6ABE-44DD-9C91-4B5EBB8FA2A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}
Schlüssel Gelöscht : HKCU\Software\Ask.com.tmp
Schlüssel Gelöscht : HKCU\Software\DataMngr
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\jZip
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\jZip
Schlüssel Gelöscht : HKLM\SOFTWARE\SearchquSRTB
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\jZip
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\jZip
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
***** [ Browser ] *****
-\\ Internet Explorer v8.0.6001.19154
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Prev Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
-\\ Mozilla Firefox v34.0.5 (x86 de)
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=nt&babsrc=lnkry_nt");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://start.icq.com/");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledAddons", "helperbar%40helperbar.com:1.1,%7B65e0b4f7-fd95-48b0-b862-6b6f933b5484%7D:1.1,%7B800b5000-a755-47e1-992b-48a1c1357f07%7D:1.1.9,%7B972ce4c6-7e08-4474-a285-3208198c[...]
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledItems", "{65e0b4f7-fd95-48b0-b862-6b6f933b5484}:1.0,helperbar@helperbar.com:1.0,{800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.4,{ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0,{[...]
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.Country", "Germany");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.LastHiddenTime", 23118993);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.UserID", "65e0b4f7-fd95-48b0-b862-6b6f933b5484");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1418764248);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.history", "bronchitisfjodreknuddelsdeutsche%20schauspielerBollenhutleotoby%20stephensmylanguageexchangetrojanerboardfledermaus%20etymologiegmxyoutubewindo[...]
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installTime", "1416424602");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.itbsitescount", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "34.0.5");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.removedsitescount", 469);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "119806246411980624541223585139729");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1419059698);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.9");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");
[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=");
*************************
AdwCleaner[R0].txt - [16507 octets] - [20/12/2014 10:04:56]
AdwCleaner[S0].txt - [15608 octets] - [20/12/2014 10:08:16]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15669 octets] ##########
JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.0 (11.29.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Christina on 20.12.2014 at 10:16:01,32
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0124123D-61B4-456f-AF86-78C53A0790C5}
Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{0124123D-61B4-456f-AF86-78C53A0790C5}
~~~ Files
Successfully deleted: [File] C:\Windows\prefetch\APNSTUB.EXE-D8A941F0.pf
Successfully deleted: [File] "C:\Windows\wininit.ini"
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Christina\AppData\Roaming\mozilla\firefox\profiles\wtnu05y1.default\minidumps [19 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.12.2014 at 10:19:37,66
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014
Ran by Christina (administrator) on UNI-PC on 20-12-2014 10:23:06
Running from c:\Users\Christina\Downloads
Loaded Profile: Christina (Available profiles: Christina)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)
HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [258512 2011-10-11] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default
FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: ICQ Search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]
FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]
FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext
FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]
FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2011-10-11] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2011-10-11] (Avira Operations GmbH & Co. KG)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [74640 2011-10-11] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134344 2011-10-11] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-10-11] (Avira GmbH)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)
S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-20 10:19 - 2014-12-20 10:19 - 00001196 _____ () C:\Users\Christina\Desktop\JRT.txt
2014-12-20 10:15 - 2014-12-20 10:15 - 00000000 ____D () C:\Windows\ERUNT
2014-12-20 10:04 - 2014-12-20 10:08 - 00000000 ____D () C:\AdwCleaner
2014-12-20 10:02 - 2014-12-20 10:02 - 00001847 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-20 10:02 - 2014-12-20 10:02 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Avira
2014-12-20 10:02 - 2014-12-20 10:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-20 10:02 - 2011-10-11 15:00 - 00134344 _____ (Avira GmbH) C:\Windows\system32\Drivers\avipbb.sys
2014-12-20 10:02 - 2011-10-11 15:00 - 00074640 _____ (Avira GmbH) C:\Windows\system32\Drivers\avgntflt.sys
2014-12-20 10:02 - 2011-10-11 15:00 - 00036000 _____ (Avira GmbH) C:\Windows\system32\Drivers\avkmgr.sys
2014-12-20 10:02 - 2010-06-17 15:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-12-20 10:01 - 2014-12-20 10:01 - 00000000 ____D () C:\ProgramData\Avira
2014-12-20 10:01 - 2014-12-20 10:01 - 00000000 ____D () C:\Program Files\Avira
2014-12-20 09:59 - 2014-12-20 09:59 - 01707646 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe
2014-12-20 09:58 - 2014-12-20 09:58 - 02166272 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.105.exe
2014-12-19 14:39 - 2014-12-19 14:40 - 00038808 _____ () C:\Users\Christina\Downloads\Addition.txt
2014-12-19 14:37 - 2014-12-20 10:23 - 00014353 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-12-19 14:37 - 2014-12-20 10:23 - 00000000 ____D () C:\FRST
2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe
2014-12-16 20:59 - 2014-12-20 10:10 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService
2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-03 05:42 - 2014-12-20 10:13 - 00000000 ___RD () C:\Program Files\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00002489 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe
2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe
2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java
2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk
2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels
2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe
2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe
2014-11-21 22:27 - 2014-11-22 10:46 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-21 22:24 - 2014-11-21 22:24 - 00638888 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jxpiinstall.exe
2014-11-20 19:26 - 2014-12-06 14:40 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-20 10:15 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job
2014-12-20 10:15 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-20 10:13 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-12-20 10:13 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype
2014-12-20 10:12 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job
2014-12-20 10:10 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-20 10:10 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-20 10:09 - 2007-09-16 05:00 - 01529957 _____ () C:\Windows\WindowsUpdate.log
2014-12-20 10:09 - 2007-08-08 00:59 - 00139694 _____ () C:\Windows\PFRO.log
2014-12-20 10:09 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-20 10:09 - 2006-11-02 14:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-20 10:09 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-20 10:09 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-20 10:08 - 2013-03-04 10:20 - 00000846 _____ () C:\Users\Christina\Desktop\Search.lnk
2014-12-20 10:08 - 2008-11-02 22:38 - 00000000 ____D () C:\ProgramData\ICQ
2014-12-20 09:53 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-20 09:53 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-19 17:35 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat
2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log
2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches
2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
Files to move or delete:
====================
C:\ProgramData\ezsid.dat
Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\Christina\AppData\Local\Temp\AskSLib.dll
C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE
C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL
C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe
C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe
C:\Users\Christina\AppData\Local\Temp\installhelper.dll
C:\Users\Christina\AppData\Local\Temp\JavaRa.exe
C:\Users\Christina\AppData\Local\Temp\jli.dll
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe
C:\Users\Christina\AppData\Local\Temp\keytool.exe
C:\Users\Christina\AppData\Local\Temp\Kraus.exe
C:\Users\Christina\AppData\Local\Temp\msvcr100.dll
C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Christina\AppData\Local\Temp\node.exe
C:\Users\Christina\AppData\Local\Temp\propsys.dll
C:\Users\Christina\AppData\Local\Temp\Quarantine.exe
C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Christina\AppData\Local\Temp\sqlite3.dll
C:\Users\Christina\AppData\Local\Temp\sqlite3.exe
C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe
C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-20 10:17
==================== End Of Log ============================
LG Pebbels |
|
22.12.2014, 00:21
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ --> Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt |
|
22.12.2014, 10:49
| #7 |
| | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hier nochmal zwei neue FRST Logs FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014
Ran by Christina (administrator) on UNI-PC on 22-12-2014 10:43:32
Running from c:\Users\Christina\Downloads
Loaded Profile: Christina (Available profiles: Christina)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)
HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-21] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.
URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} - No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default
FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: ICQ Search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml
FF Extension: Avira Browser Safety - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\abs@avira.com [2014-12-21]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]
FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]
FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext
FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]
FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-21] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-12-21] (Avira Operations GmbH & Co. KG)
R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)
S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-12-21] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-21 10:55 - 2014-12-21 10:55 - 00001002 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-12-21 10:48 - 2014-12-21 10:55 - 00000000 ____D () C:\ProgramData\Package Cache
2014-12-21 10:47 - 2014-12-21 10:47 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Avira
2014-12-21 10:46 - 2014-12-21 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-12-21 10:46 - 2014-12-21 10:46 - 00001847 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-12-21 10:45 - 2014-12-21 10:55 - 00000000 ____D () C:\Program Files\Avira
2014-12-21 10:45 - 2014-12-21 10:48 - 00000000 ____D () C:\ProgramData\Avira
2014-12-21 10:45 - 2014-12-21 10:31 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-12-21 10:45 - 2014-12-21 10:31 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-12-21 10:45 - 2014-12-21 10:31 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-12-21 10:45 - 2014-12-21 10:31 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-12-20 10:19 - 2014-12-20 10:19 - 00001196 _____ () C:\Users\Christina\Desktop\JRT.txt
2014-12-20 10:15 - 2014-12-20 10:15 - 00000000 ____D () C:\Windows\ERUNT
2014-12-20 10:04 - 2014-12-20 10:08 - 00000000 ____D () C:\AdwCleaner
2014-12-20 09:59 - 2014-12-20 09:59 - 01707646 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe
2014-12-20 09:58 - 2014-12-20 09:58 - 02166272 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.105.exe
2014-12-19 14:39 - 2014-12-19 14:40 - 00038808 _____ () C:\Users\Christina\Downloads\Addition.txt
2014-12-19 14:37 - 2014-12-22 10:45 - 00015180 _____ () C:\Users\Christina\Downloads\FRST.txt
2014-12-19 14:37 - 2014-12-22 10:43 - 00000000 ____D () C:\FRST
2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe
2014-12-16 20:59 - 2014-12-22 10:35 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService
2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-12-03 05:42 - 2014-12-20 10:28 - 00002379 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-12-03 05:42 - 2014-12-20 10:13 - 00000000 ___RD () C:\Program Files\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe
2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe
2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java
2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk
2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels
2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe
2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-12-22 10:44 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype
2014-12-22 10:40 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job
2014-12-22 10:39 - 2007-09-16 05:00 - 01685578 _____ () C:\Windows\WindowsUpdate.log
2014-12-22 10:35 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-22 10:34 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-22 10:34 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-22 10:34 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-22 09:06 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-12-22 09:05 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-12-22 08:53 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-22 08:49 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-22 06:03 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-21 19:52 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job
2014-12-21 19:46 - 2007-08-08 00:59 - 00142786 _____ () C:\Windows\PFRO.log
2014-12-20 10:13 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype
2014-12-20 10:08 - 2013-03-04 10:20 - 00000846 _____ () C:\Users\Christina\Desktop\Search.lnk
2014-12-20 10:08 - 2008-11-02 22:38 - 00000000 ____D () C:\ProgramData\ICQ
2014-12-19 17:35 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat
2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-06 14:40 - 2014-11-20 19:26 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung
2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log
2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches
2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-11-22 10:46 - 2014-11-21 22:27 - 00000000 ____D () C:\ProgramData\Oracle
Files to move or delete:
====================
C:\ProgramData\ezsid.dat
Some content of TEMP:
====================
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\Users\Christina\AppData\Local\Temp\AskSLib.dll
C:\Users\Christina\AppData\Local\Temp\avgnt.exe
C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe
C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE
C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL
C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe
C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe
C:\Users\Christina\AppData\Local\Temp\installhelper.dll
C:\Users\Christina\AppData\Local\Temp\JavaRa.exe
C:\Users\Christina\AppData\Local\Temp\jli.dll
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe
C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe
C:\Users\Christina\AppData\Local\Temp\keytool.exe
C:\Users\Christina\AppData\Local\Temp\Kraus.exe
C:\Users\Christina\AppData\Local\Temp\msvcr100.dll
C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe
C:\Users\Christina\AppData\Local\Temp\node.exe
C:\Users\Christina\AppData\Local\Temp\propsys.dll
C:\Users\Christina\AppData\Local\Temp\Quarantine.exe
C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Christina\AppData\Local\Temp\sqlite3.dll
C:\Users\Christina\AppData\Local\Temp\sqlite3.exe
C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe
C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-22 10:47
==================== End Of Log ============================
und Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014
Ran by Christina at 2014-12-22 10:46:17
Running from c:\Users\Christina\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office system (HKLM\...\PROHYBRIDR) (Version: 12.0.6425.1000 - Microsoft Corporation)
7-Zip 4.65 (HKLM\...\7-Zip) (Version: - )
AC3Filter 1.63b (HKLM\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)
Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version: - Microsoft Corporation)
Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden
Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)
Adobe Reader 9 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version: - Agere Systems)
Atheros WLAN Client (HKLM\...\{04983D37-2202-4295-94A2-8B547C66133F}) (Version: 1.00.000 - )
ATI Catalyst Install Manager (HKLM\...\{1ABD9408-C1DC-EF1F-40E8-2D9A6531CDA3}) (Version: 3.0.624.0 - ATI Technologies, Inc.)
Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
AVStation Now (HKLM\...\InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}) (Version: 4.0.10.6 - Ihr Firmenname)
AVStation Now (Version: 4.0.10.6 - Ihr Firmenname) Hidden
Bass Audio Decoder (remove only) (HKLM\...\Bass Audio Decoder) (Version: - )
BufferChm (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Business Contact Manager für Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)
Business Contact Manager für Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden
ccc-core-static (Version: 2007.0730.2152.37233 - Ihr Firmenname) Hidden
Content Transfer (HKLM\...\{CFADE4AF-C0CF-4A04-A776-741318F1658F}) (Version: 1.3.0.23190 - Sony Corporation)
CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
D4200 (Version: 90.0.235.000 - Hewlett-Packard) Hidden
D4200_Help (Version: 90.0.235.000 - Hewlett-Packard) Hidden
DC-Bass Source 1.1.1 (HKLM\...\DC-Bass Source) (Version: - )
DCoder Image Source (remove only) (HKLM\...\DCoder Image Source) (Version: - )
DeviceDiscovery (Version: 110.0.180.000 - Hewlett-Packard) Hidden
DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
DirectVobSub (remove only) (HKLM\...\DirectVobSub) (Version: - )
dj_sf_ProductContext (Version: 90.0.235.000 - Hewlett-Packard) Hidden
dj_sf_software (Version: 90.0.235.000 - Hewlett-Packard) Hidden
dj_sf_software_req (Version: 90.0.235.000 - Hewlett-Packard) Hidden
DScaler 5 Mpeg Decoders (HKLM\...\DScaler 5 Mpeg Decoders_is1) (Version: - )
DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.0.1603 - CyberLink Corporation)
Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.1 - )
Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.0.0.0 - Samsung)
Easy Network Manager 3.0 (HKLM\...\InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}) (Version: 3.0.0.0 - Ihr Firmenname)
Easy Network Manager 3.0 (Version: 3.0.0.0 - Ihr Firmenname) Hidden
Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.0.11 - )
eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden
EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)
ffdshow [rev 3124] [2009-11-03] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
FFMPEG Core Files (remove only) (HKLM\...\FFMPEG Core Files) (Version: - )
Gabest MPEG Splitter (remove only) (HKLM\...\Gabest MPEG Splitter) (Version: - )
GameSpy Comrade (HKLM\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)
GEAR 32bit Driver Installer (HKLM\...\{E89B484C-B913-49A0-959B-89E836001658}) (Version: 2.005.1 - GEAR Software, Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Haali Media Splitter (HKLM\...\HaaliMkx) (Version: - )
HP Customer Participation Program 9.0 (HKLM\...\HPExtendedCapabilities) (Version: 9.0 - HP)
HP Deskjet Printer Driver Software 9.0 (HKLM\...\{03E66394-42F0-4745-85F7-0A2F8F35C09F}) (Version: 9.0 - HP)
HP Imaging Device Functions 9.0 (HKLM\...\HP Imaging Device Functions) (Version: 9.0 - HP)
HP Photosmart Essential 2.01 (HKLM\...\HP Photosmart Essential) (Version: 2.01 - HP)
HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)
HP Solution Center 9.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 9.0 - HP)
HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
HPProductAssistant (Version: 90.0.146.000 - Hewlett-Packard) Hidden
HPSSupply (HKLM\...\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}) (Version: 2.2.0.0000 - Ihr Firmenname)
ICQ7.5 (HKLM\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)
imagine digital freedom - Samsung (HKLM\...\{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}) (Version: 1.0.2.0 - Samsung Electronics Co., LTD)
Install McAfee (HKLM\...\{6B32EF07-8A23-4824-91BD-B0F24E50E974}) (Version: 1.00.0000 - Samsung Electronics Co., LTD,)
Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Linkury Smartbar (HKLM\...\{01CE337E-F88F-437B-A71A-AF527986BE48}) (Version: 1.6.1.909 - Linkury Inc.) <==== ATTENTION
MarketResearch (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB2572067) (HKLM\...\M2572067) (Version: - )
Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version: - )
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)
Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version: - Microsoft)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)
Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)
Microsoft SOAP Toolkit 2.0 SP2 (HKLM\...\{36BEAD11-8577-49AD-9250-E06A50AE87B0}) (Version: 623.1 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MONOGRAM AMR Splitter/Decoder (remove only) (HKLM\...\MONOGRAM AMR Splitter/Decoder) (Version: - )
Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Move Networks Player - IE) (Version: - )
Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
NWZ-E450 WALKMAN Guide (HKLM\...\{0A6C2811-AD29-473F-8086-F0B401276DEC}) (Version: 2.1.0.17210 - Sony Corporation)
PanoStandAlone (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Play AVStation (HKLM\...\InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}) (Version: 4.1.20.46 - Ihr Firmenname)
Play AVStation (Version: 4.1.20.46 - Ihr Firmenname) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2802.0 - CyberLink Corporation)
PSSWCORE (Version: 2.01.0000 - Hewlett-Packard) Hidden
RealMedia (remove only) (HKLM\...\RealMedia) (Version: - )
RealPlayer (HKLM\...\RealPlayer 12.0) (Version: - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: - )
Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.00 - )
Samsung Recovery Solution II (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 2.0 - Samsung)
Samsung Update Plus (HKLM\...\InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}) (Version: 2.0 - Samsung Electronics Co., LTD)
Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD) Hidden
SHOUTcast Source (remove only) (HKLM\...\SHOUTcast Source) (Version: - )
Skins (Version: 2007.0730.2152.37233 - ATI) Hidden
Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 90.0.146.000 - Hewlett-Packard) Hidden
Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Status (Version: 110.0.180.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.1.22.0 - Synaptics)
Toolbox (Version: 90.0.146.000 - Hewlett-Packard) Hidden
TrayApp (Version: 110.0.180.000 - Hewlett-Packard) Hidden
UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Outlook 2007 Junk Email Filter (KB2596560) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{2964DDE1-4925-4DF1-AF2C-0A36B3442228}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )
VideoToolkit01 (Version: 90.0.146.000 - Hewlett-Packard) Hidden
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
WebReg (Version: 90.0.146.000 - Hewlett-Packard) Hidden
WIDCOMM Bluetooth Software 6.0.1.5000 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5000 - WIDCOMM, Inc.)
Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Zoom Player (remove only) (HKLM\...\ZoomPlayer) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
==================== Restore Points =========================
21-12-2014 11:38:55 Geplanter Prüfpunkt
21-12-2014 19:56:55 Windows-Sicherung
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2010-09-17 17:07 - 00419366 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {00407FA0-B26A-4D78-BAE4-DCED18CE0BBD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)
Task: {2E73D919-5704-48F5-BD45-2DA050634DD6} - System32\Tasks\advSRSII => C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe [2007-04-04] ()
Task: {36CC60E7-F073-45B7-92D3-2D0FCA4284BD} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2007-04-26] (Samsung Electronics Co., Ltd.)
Task: {4A0BA790-7E2E-41C2-9630-365ED6C19CE8} - System32\Tasks\{F8403358-9DFC-48DD-9814-C3C5B64B5224} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {75A56371-2508-45D0-B522-4FFA66030227} - System32\Tasks\SupBackGroundTask => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe [2010-04-20] ()
Task: {80AF346F-AA8E-4BBC-8A2E-87C003976B06} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2007-06-01] (SAMSUNG Electronics)
Task: {9DBC4E1A-1A47-4365-985F-7EE43499F7AB} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2007-06-29] (SAMSUNG Electronics co., LTD.)
Task: {A2905CD7-15D6-4F90-9726-C98606071C61} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)
Task: {AB3D9F35-AFB4-48F0-83D2-09826838A45F} - System32\Tasks\{D36EF826-E004-4D3A-8C17-E5566C882B0D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124.259/en/abandoninstall?page=tsPlugin&installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {B57FF0ED-4252-4D91-9B7C-6BDEB436AC3C} - System32\Tasks\{2EBAA3D6-013C-4628-BBCC-CA3BCB57800C} => pcalua.exe -a "C:\Users\Christina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0MADX4B0\miranda-im-v0.7.10-unicode[1].exe" -d "C:\Users\Christina\AppData\Roaming\ICQ Toolbar"
Task: {B8A0DA75-CD83-48CB-9EBA-7F9AE7FC2FAB} - System32\Tasks\{EA6DECD8-58E9-4AE1-A135-2AE6697E86F7} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)
Task: {C954C976-60FD-4FB5-95E6-628BF7CDBE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)
Task: {E1EDABFD-F216-4F52-9A90-0759D4836240} - System32\Tasks\{2E3842F9-8974-4CD3-8E95-B5376AF0C567} => pcalua.exe -a "C:\Program Files\OpenSource Flash Video Splitter\uninstall.exe"
Task: {E90E0C26-3D38-4B64-893D-954ADAFB7503} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2007-04-24] (Samsung Electronics Co., Ltd.)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SupBackGroundTask.job => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) =============
2014-10-27 16:04 - 2014-10-27 16:04 - 00028160 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe
2007-08-07 23:39 - 2007-01-08 14:39 - 00171040 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 00974848 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe
2014-12-01 17:01 - 2014-12-01 17:01 - 01686016 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMHost.dll
2014-12-01 17:01 - 2014-12-01 17:01 - 02745856 _____ () C:\Users\Christina\AppData\Local\RGMService\MonetizationToolsManager.dll
2014-12-01 17:02 - 2014-12-01 17:02 - 01592832 _____ () C:\Users\Christina\AppData\Local\RGMService\ProtectorsManager.dll
2014-11-20 14:09 - 2014-11-20 14:09 - 00245760 _____ () C:\Program Files\Avira\My Avira\System.ComponentModel.Composition.dll
2007-08-07 06:06 - 2007-08-07 01:31 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2007-08-08 00:17 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll
2007-08-07 23:51 - 2007-04-04 06:10 - 01379328 _____ () C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe
2007-08-07 23:55 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll
2007-08-07 23:54 - 2007-02-23 10:32 - 00065536 _____ () C:\Program Files\Samsung\EBM\ChkSec.dll
2007-08-07 23:50 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
2007-08-07 23:50 - 2006-09-19 01:52 - 00028672 _____ () C:\Program Files\Samsung\Easy Display Manager\WinMove.dll
2014-12-09 20:02 - 2014-12-09 20:03 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2007-04-24 10:32 - 2007-04-24 10:32 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2014-12-09 20:34 - 2014-12-09 20:34 - 16841392 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\View Baldur's Gate: Tales of The Sword Coast Readme.lnk
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^G DATA Firewall Tray.lnk => C:\Windows\pss\G DATA Firewall Tray.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe => C:\Windows\pss\PowerReg Scheduler V3.exe.Startup
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AVKTray => "C:\Program Files\G DATA TotalCare\AVKTray\AVKTray.exe"
MSCONFIG\startupreg: GDFirewallTray => C:\Program Files\G DATA TotalCare\Firewall\GDFirewallTray.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: RemoteControl => "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
MSCONFIG\startupreg: TkBellExe => "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide
MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
========================= Accounts: ==========================
Administrator (S-1-5-21-3116156678-3848323971-3931140469-500 - Administrator - Disabled)
ASPNET (S-1-5-21-3116156678-3848323971-3931140469-1005 - Limited - Enabled)
Christina (S-1-5-21-3116156678-3848323971-3931140469-1003 - Administrator - Enabled) => C:\Users\Christina
Gast (S-1-5-21-3116156678-3848323971-3931140469-501 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\WHITE-ON-BLACK> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\WHITE-ON-BLACK> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:12 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\RETINA> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (12/22/2014 10:38:12 AM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\RETINA> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (12/22/2014 10:36:34 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/22/2014 10:36:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/22/2014 10:34:21 AM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version
Error: (12/22/2014 09:05:55 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (12/22/2014 08:48:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/22/2014 08:48:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (12/22/2014 08:46:24 AM) (Source: atikmdag) (EventID: 10266) (User: )
Description: Unknown EDID version
Error: (12/22/2014 06:20:03 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (12/21/2014 07:48:44 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: HP CUE DeviceDiscovery Service
Error: (12/21/2014 07:48:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Microsoft Office Sessions:
=========================
Error: (08/03/2009 11:53:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 353 seconds with 60 seconds of active time. This session ended with a crash.
Error: (09/21/2008 00:37:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2402 seconds with 300 seconds of active time. This session ended with a crash.
Error: (09/18/2008 10:22:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 114 seconds with 60 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2011-10-23 21:12:16.785
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-10-23 21:12:16.558
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-04 19:42:55.860
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-04 19:42:55.537
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 19:42:30.523
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 19:42:30.302
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 18:22:01.281
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-03 18:22:00.829
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-04-28 23:05:49.918
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-04-28 23:05:49.705
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz
Percentage of memory in use: 54%
Total physical RAM: 2045.45 MB
Available physical RAM: 936.24 MB
Total Pagefile: 4336.18 MB
Available Pagefile: 2882.04 MB
Total Virtual: 2047.88 MB
Available Virtual: 1906.07 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:69.05 GB) (Free:10.65 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Fixed) (Total:70 GB) (Free:5.35 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 149.1 GB) (Disk ID: 69F484A5)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=69 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
22.12.2014, 15:59
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\ProgramData\ezsid.dat
EmptyTemp:
Hosts:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
23.12.2014, 19:33
| #9 |
| | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Hier das Fixlog Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2014
Ran by Christina at 2014-12-23 19:17:32 Run:1
Running from C:\Users\Christina\Downloads
Loaded Profile: Christina (Available profiles: Christina)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\ProgramData\ezsid.dat
EmptyTemp:
Hosts:
*****************
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google" => Key deleted successfully.
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe => Moved successfully.
C:\ProgramData\ezsid.dat => Moved successfully.
"C:\Windows\System32\Drivers\etc\hosts" => Could not move.
Could not reset Hosts.
EmptyTemp: => Removed 1.3 GB temporary data.
The system needed a reboot.
==== End of Fixlog 19:21:55 ====
|
|
23.12.2014, 23:39
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Virenscanner deaktivieren, Fix wiederholen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
24.12.2014, 18:52
| #11 |
| | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Virenscanner ausgeschaltet, Fix wiederholt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2014
Ran by Christina at 2014-12-24 18:45:09 Run:2
Running from C:\Users\Christina\Downloads\FRST-OlderVersion
Loaded Profile: Christina (Available profiles: Christina)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe
C:\ProgramData\ezsid.dat
EmptyTemp:
Hosts:
*****************
HKLM\SOFTWARE\Policies\Google => Key not found.
HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google => Key not found.
"C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe" => File/Directory not found.
"C:\ProgramData\ezsid.dat" => File/Directory not found.
C:\Windows\System32\Drivers\etc\hosts => Moved successfully.
Hosts was reset successfully.
EmptyTemp: => Removed 38.3 MB temporary data.
The system needed a reboot.
==== End of Fixlog 18:45:19 ====
|
|
24.12.2014, 23:33
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt |
| aktiv, betriebssystem, bildschirm, bli, blinkt, brauch, fenster, funktioniert, gekauft, hallo zusammen, hintergrund, internet, kurze, länger, meldung, meldungen, nenne, neuen, neues, nicht mehr, problem, woche, zusammen, öffnen, öffnet |
Linear-Darstellung
