Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Adware Cleaner kann Malware nicht löschen

Adware Cleaner kann Malware nicht löschen


Plagegeister aller Art und deren Bekämpfung: Adware Cleaner kann Malware nicht löschen

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 21.12.2014, 14:18   #1
SirLogian
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Hallo, ich habe heute einen Suchlauf mit Adware Cleaner gemacht und der zeigt mir folgene Einträge an:
[x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}

[x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}

als ich den Eintrag löschen wollte und der PC neu gestartet ist habe ich noch einen Suchlauf gemacht und es war immer noch da. Dann habe ich es manuell gelöscht und der Scanner hat nichts mehr angezeigt doch als der PC neu gestartet wurde war es wieder da.
Nach jedem neustart ist das wieder das jetzt wollte ich fragen ob das was schlimmes ist und wie ich es beseitigen kann.

Danke im voraus

Alt 21.12.2014, 16:15   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________
Alt 21.12.2014, 16:32   #3
SirLogian
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


FRST.txt :
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-12-2014 01
Ran by User (administrator) on USER-PC on 21-12-2014 16:24:04
Running from C:\Users\User\Desktop
Loaded Profiles: UpdatusUser & User (Available profiles: UpdatusUser & User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe
(Emsi Software GmbH) C:\Program Files (x86)\a-squared Free\a2service.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
() C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
(Akamai Technologies, Inc.) C:\Users\User\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\User\AppData\Local\Akamai\netsession_win.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [613024 2010-09-27] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2010-09-27] (Atheros Commnucations)
HKLM\...\Run: [Monitor] => C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2439072 2010-05-24] (VIA)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-16] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2014-10-14] (Microsoft Corporation)
HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\Run: [Akamai NetSession Interface] => C:\Users\User\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\RunOnce: [FlashPlayerUpdate] => C:\Windows\system32\Macromed\Flash\FlashUtil64_15_0_0_189_ActiveX.exe [540336 2014-10-18] (Adobe Systems Incorporated)
HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\MountPoints2: {570bfa42-74a4-11e3-8f18-08606ee8308c} - G:\SETUP.EXE
HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\MountPoints2: {cb91d5cb-81e8-11e2-a29c-806e6f6e6963} - D:\Bin\ASSETUP.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKLM -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {50742086-32D3-4D7F-A73C-DDB2FBE0C4B3} URL = hxxp://www.bing.com/?cc=de
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2260964575-2753946872-1401531445-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-08-16]

Chrome: 
=======
CHR HomePage: Default -> https://www.google.de/
CHR StartupUrls: Default -> "https://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-13]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27]
CHR Extension: (Google Play Music) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fahmaaghhglfmonjliepjlchgpgfmobi [2014-12-15]
CHR Extension: (Avast Online Security) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-08-16]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-13]
CHR Extension: (Google Mail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-13]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-16]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2free; C:\Program Files (x86)\a-squared Free\a2service.exe [1858144 2009-10-01] (Emsi Software GmbH) [File not signed]
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [52896 2010-09-27] (Atheros Commnucations) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-16] (AVAST Software)
R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [106488 2014-08-16] (AVAST Software)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [496232 2010-01-21] ()
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [209000 2010-01-21] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-08-16] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-08-16] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-08-16] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [448400 2014-08-16] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-08-16] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-08-16] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-22] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-08-16] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-08-16] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-08-16] ()
S3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()
S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [572416 2006-12-05] (PixArt Imaging Inc.)
S3 RTL85n64; C:\Windows\System32\DRIVERS\RTL85n64.sys [378368 2009-06-10] (Realtek)
S3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1476752 2012-11-07] (Realtek Semiconductor Corporation                           )
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [137728 2011-03-08] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [198144 2011-03-08] (VIA Technologies, Inc.)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 X6va013; \??\C:\Windows\SysWOW64\Drivers\X6va013 [X]
S3 X6va014; \??\C:\Windows\SysWOW64\Drivers\X6va014 [X]
S3 X6va015; \??\C:\Windows\SysWOW64\Drivers\X6va015 [X]
S3 X6va016; \??\C:\Windows\SysWOW64\Drivers\X6va016 [X]
S3 X6va017; \??\C:\Windows\SysWOW64\Drivers\X6va017 [X]
S3 X6va021; \??\C:\Windows\SysWOW64\Drivers\X6va021 [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-21 16:24 - 2014-12-21 16:24 - 00016342 _____ () C:\Users\User\Desktop\FRST.txt
2014-12-21 16:17 - 2014-12-21 16:17 - 02122240 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2014-12-21 13:53 - 2014-12-21 13:53 - 00005681 _____ () C:\Users\User\Desktop\AdwCleaner[R202].txt
2014-12-17 23:39 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-17 23:39 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-15 21:08 - 2014-12-15 21:08 - 00000249 _____ () C:\Users\User\Downloads\Ts überwachen.html
2014-12-12 20:20 - 2014-12-12 20:20 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-12 19:48 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-12 19:48 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-12 19:46 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-12 19:46 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-12 19:46 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-12 19:46 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-12 19:46 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-12 19:46 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-12 19:46 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-12 19:46 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-12 19:46 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-12 19:46 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-12 19:46 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-12 19:46 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-12 19:46 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-12 19:46 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-12 19:46 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-12 19:46 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-12 19:46 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-12 19:46 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-12 19:46 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-12 19:46 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-12 19:46 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-12 19:46 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-12 19:46 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-12 19:46 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-12 19:46 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-12 19:46 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-12 19:46 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-12 19:46 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-12 19:46 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-12 19:46 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-12 19:46 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-12 19:46 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-12 19:46 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-12 19:46 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-12 19:46 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-12 19:46 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-12 19:46 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-12 19:46 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-12 19:46 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-12 19:46 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-12 19:46 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-12 19:46 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-12 19:46 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-12 19:46 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-12 19:46 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-12 19:46 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-12 19:46 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-12 19:46 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-12 19:46 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-12 19:46 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-12 19:46 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-12 19:46 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-12 19:46 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-12 19:46 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-12 19:44 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-12 19:44 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-12 19:44 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-12 19:44 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-12 19:44 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-12 19:44 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-12 19:43 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-12 19:43 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-12 19:43 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-12 19:43 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-12 19:43 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-12 19:43 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-12 19:43 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-12 19:43 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-12 19:43 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-12 19:43 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-12 19:43 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-12 19:43 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-12 19:43 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-12 19:43 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-01 18:18 - 2014-12-01 18:18 - 00000000 ____D () C:\Users\User\.tfo4
2014-11-22 22:41 - 2014-11-22 22:41 - 00000000 ____H () C:\Users\User\Documents\Default.rdp
2014-11-21 14:27 - 2014-11-21 14:27 - 00000000 ____D () C:\Users\User\Documents\Egosoft
2014-11-21 14:24 - 2014-11-21 14:24 - 00001187 _____ () C:\Users\User\Desktop\X3 Terran Conflict.lnk
2014-11-21 14:24 - 2014-11-21 14:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Egosoft
2014-11-21 13:58 - 2014-11-21 13:58 - 00000000 ____D () C:\Program Files (x86)\EGOSOFT

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-21 16:24 - 2014-01-10 22:05 - 00000000 ____D () C:\FRST
2014-12-21 16:23 - 2014-10-18 00:04 - 00000000 ____D () C:\AdwCleaner
2014-12-21 16:23 - 2014-08-17 12:55 - 01869363 _____ () C:\Windows\WindowsUpdate.log
2014-12-21 16:20 - 2013-08-04 17:07 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-12-21 16:20 - 2013-02-28 17:56 - 00000035 _____ () C:\Users\Public\Documents\AtherosServiceConfig.ini
2014-12-21 16:19 - 2014-11-02 12:30 - 00003976 _____ () C:\Windows\setupact.log
2014-12-21 16:19 - 2011-05-16 00:38 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-12-21 16:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-21 16:18 - 2009-07-14 05:45 - 00032928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-21 16:18 - 2009-07-14 05:45 - 00032928 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-21 15:59 - 2013-08-04 17:07 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-12-21 15:27 - 2014-06-14 20:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-12-21 13:35 - 2014-11-02 12:30 - 00040740 _____ () C:\Windows\PFRO.log
2014-12-20 21:34 - 2014-10-29 16:13 - 00000000 ____D () C:\Users\User\AppData\Roaming\TS3Client
2014-12-19 18:15 - 2013-07-13 21:29 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-12-19 16:47 - 2013-07-29 18:28 - 00000000 ____D () C:\Users\User\Desktop\Allgemein
2014-12-18 18:33 - 2014-08-16 16:30 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-12-17 21:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-14 18:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-12 20:20 - 2014-05-06 15:25 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-12 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-12 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-12 19:55 - 2013-11-18 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-12 19:54 - 2013-07-26 14:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-12 19:50 - 2013-07-13 20:59 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-01 16:42 - 2009-07-14 06:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-24 14:04 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-23 21:07 - 2013-08-04 20:02 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-11-22 23:18 - 2013-07-13 19:09 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-11-22 22:48 - 2014-07-25 21:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-22 15:02 - 2014-08-16 16:29 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-16 23:38

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Und die Addition.txt:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-12-2014 01
Ran by User at 2014-12-21 16:24:38
Running from C:\Users\User\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

4Story DE 4.2.191 (HKLM-x32\...\4Story_DE_is1) (Version:  - )
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.189 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\Akamai) (Version:  - Akamai Technologies, Inc)
AMD Catalyst Install Manager (HKLM\...\{9AFAAEAF-7256-793D-AE2B-B4B2C5B3A807}) (Version: 3.0.838.0 - Advanced Micro Devices, Inc.)
Any Video Converter 5.5.9 (HKLM-x32\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
a-squared Free 4.5 (HKLM-x32\...\a-squared Free_is1) (Version: 4.5 - Emsi Software GmbH)
avast! Internet Security (HKLM-x32\...\Avast) (Version: 9.0.2021 - AVAST Software)
Bandicam (HKLM-x32\...\Bandicam) (Version: 2.0.3.674 - Bandisoft.com)
Bandisoft MPEG-1 Decoder (HKLM-x32\...\BandiMPEG1) (Version:  - Bandisoft.com)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.34 - Atheros Communications)
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
CrystalDiskInfo 5.6.2 Shizuku Edition (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 5.6.2 - Crystal Dew World)
Cube World version 0.0.1 (HKLM-x32\...\{D692A0E0-1BBB-4E9C-826E-4254EE330830}_is1) (Version: 0.0.1 - Picroma)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
FileZilla Client 3.9.0.3 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.3 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Guild Wars 2 (HKLM-x32\...\Guild Wars 2) (Version:  - NCsoft Corporation, Ltd.)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2266 - Intel Corporation)
ITE Infrared Transceiver (HKLM-x32\...\{40580068-9B10-40B5-9548-536CE88AB23C}) (Version: 1.00.0000 - ITE)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-2260964575-2753946872-1401531445-1001\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mouse Editor (HKLM-x32\...\InstallShield_{3A4218DE-B9DB-4AD5-9DB2-5853D3AA0335}) (Version: 12.08.0006 - Ihr Firmenname)
MOUSE Editor (x32 Version: 12.08.0006 - Ihr Firmenname) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 275.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 275.33 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.57.35 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (HKLM-x32\...\{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: 1.00.7325.0 - NVIDIA Corporation)
NVIDIA Grafiktreiber 275.33 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 275.33 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.22.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Update 1.3.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.3.5 - NVIDIA Corporation)
Plague Inc: Evolved (HKLM-x32\...\Steam App 246620) (Version:  - Ndemic Creations)
Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.34.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.34.0 - Renesas Electronics Corporation) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Walking Dead (HKLM-x32\...\Steam App 207610) (Version:  - )
The Walking Dead: Season Two (HKLM-x32\...\Steam App 261030) (Version:  - Telltale Games)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
WinRAR 5.11 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.11.0 - win.rar GmbH)
WMV9/VC-1 Video Playback (Version: 1.00.0000 - ATI Technologies Inc.) Hidden
X3 Terran Conflict v3.2 (HKLM-x32\...\X3TerranConflict_is1) (Version:  - EGOSOFT)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\User\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

02-12-2014 16:51:54 Windows Update
05-12-2014 18:02:01 Windows Update
09-12-2014 15:23:15 Windows Update
12-12-2014 19:46:51 Windows Update
16-12-2014 18:03:30 Windows Update
17-12-2014 23:39:48 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0B2EE28E-2997-414C-992F-6BB39F820691} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-2260964575-2753946872-1401531445-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {0F1DA42A-7528-42EA-B72A-DEE280C19190} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-2260964575-2753946872-1401531445-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {41F2C605-4570-4640-BB88-F48C4529EC88} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-18] (Adobe Systems Incorporated)
Task: {58C9A4FC-13D9-4974-88AB-2470FCD2F966} - System32\Tasks\{0E1C1EF7-ABF0-4720-9815-8D69CC82894D} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/72850
Task: {64821375-5DAE-46CF-91FA-124CC73C9D45} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2260964575-2753946872-1401531445-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {6F8B1F26-44E2-4B8B-9183-66130864D388} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9267E943-E101-40E6-A896-E44FC20E95DF} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2260964575-2753946872-1401531445-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {B590A89A-6821-411D-89B3-E7989A6788FE} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-08-16] (AVAST Software)
Task: {B8FF704C-1A58-4693-B821-4CB7DAC71DB8} - System32\Tasks\{56262280-6F43-4821-90DF-8153D1A65A63} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{1C42D474-BDBD-4200-829D-28246879365D}\setup.exe" -c -runfromtemp -l0x0009 -removeonly
Task: {D212E633-11CD-40C1-89E8-4E33DD4FC687} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-2260964575-2753946872-1401531445-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe
Task: {D8FC3A0A-0F9B-4A46-8E1F-D494A39A69C8} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-18] (Piriform Ltd)
Task: {DAF4FFA1-DA87-4475-B901-480C26C3292E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-04] (Google Inc.)
Task: {E86608D8-09B0-4BA5-B702-B3253CE4FEB7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-08-04] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-05-07 01:07 - 2010-01-21 00:53 - 00496232 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
2011-05-07 01:07 - 2010-01-21 00:52 - 00076392 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll
2011-05-07 01:07 - 2010-01-21 00:53 - 00731752 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\SpecialCase.dll
2011-05-07 01:07 - 2010-01-21 00:53 - 00209000 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
2013-08-05 07:15 - 2013-08-05 07:15 - 00070712 _____ () C:\Windows\system32\bdmpega64.acm
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-07-15 05:44 - 2010-07-15 05:44 - 00020032 _____ () C:\Program Files\Unlocker\UnlockerCOM.dll
2011-05-07 01:06 - 2010-05-24 10:10 - 00076192 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2011-05-07 01:06 - 2010-05-24 10:10 - 00383904 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2011-05-07 01:06 - 2010-05-24 10:10 - 00103328 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll
2011-05-07 01:06 - 2010-05-24 10:10 - 64641440 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll
2012-08-16 04:11 - 2012-08-16 04:11 - 03333632 _____ () C:\Program Files (x86)\MOUSE Editor\MouseEditor.exe
2014-08-16 16:29 - 2014-08-16 16:29 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-12-21 13:29 - 2014-12-21 13:29 - 02908160 _____ () C:\Program Files\AVAST Software\Avast\defs\14122100\algo.dll
2014-08-16 16:29 - 2014-08-16 16:29 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2010-12-02 10:56 - 2010-12-02 10:56 - 00815104 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\OSD_Text\OSD_Text.dll
2011-01-09 13:45 - 2011-01-09 13:45 - 00088064 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_MouseDeviceManager.dll
2012-06-14 08:59 - 2012-06-14 08:59 - 02414080 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\ScreenCapture\ScreenCapture.dll
2012-05-17 04:17 - 2012-05-17 04:17 - 01000448 _____ () C:\Program Files (x86)\MOUSE Editor\Data\MouseEditor\Forms\TrayIconWebAdvertisement\TrayIconWebAdvertisement.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00085504 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ZoomControl.dll
2010-09-20 07:18 - 2010-09-20 07:18 - 00054272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_ScrollbarControl.dll
2011-04-12 08:14 - 2011-04-12 08:14 - 00063488 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInRight.dll
2010-11-01 13:16 - 2010-11-01 13:16 - 00062976 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_AnalyzeGesturesInOne.dll
2012-04-27 04:40 - 2012-04-27 04:40 - 00118272 _____ () C:\Program Files (x86)\MOUSE Editor\DLL\DLL_Wheel4D.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:39413AC3
AlternateDataStreams: C:\ProgramData\TEMP:661DFA1C
AlternateDataStreams: C:\ProgramData\TEMP:BF3D62E7

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: 4StoryPrePatch => C:\Program Files (x86)\Gameforge4D\4Story_DE\PrePatch.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2260964575-2753946872-1401531445-500 - Administrator - Disabled)
Gast (S-1-5-21-2260964575-2753946872-1401531445-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2260964575-2753946872-1401531445-1003 - Limited - Enabled)
UpdatusUser (S-1-5-21-2260964575-2753946872-1401531445-1000 - Limited - Enabled) => C:\Users\UpdatusUser
User (S-1-5-21-2260964575-2753946872-1401531445-1001 - Administrator - Enabled) => C:\Users\User

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (12/21/2014 04:20:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 04:18:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm FRST64.exe, Version 21.12.2014.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 690

Startzeit: 01d01d3139f959ea

Endzeit: 0

Anwendungspfad: C:\Users\User\Downloads\FRST64.exe

Berichts-ID:

Error: (12/21/2014 01:44:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 01:36:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 01:30:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2014 06:30:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2014 10:42:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/19/2014 07:14:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: SHLWAPI.dll, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c9ab
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000011c7f
ID des fehlerhaften Prozesses: 0xda8
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (12/19/2014 02:01:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/18/2014 06:33:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (12/21/2014 01:35:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%109

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ForceWare IP service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ForceWare Intelligent Application Manager (IAM)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (12/21/2014 01:35:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AtherosSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office Sessions:
=========================
Error: (12/21/2014 04:20:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 04:18:18 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: FRST64.exe21.12.2014.169001d01d3139f959ea0C:\Users\User\Downloads\FRST64.exe

Error: (12/21/2014 01:44:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 01:36:25 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/21/2014 01:30:26 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2014 06:30:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/20/2014 10:42:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/19/2014 07:14:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.1.7601.175674d672ee4SHLWAPI.dll6.1.7601.175144ce7c9abc00000050000000000011c7fda801d01b8be16a2fc2C:\Windows\Explorer.EXEC:\Windows\system32\SHLWAPI.dlle9bf90b8-87aa-11e4-a500-08606ee8308c

Error: (12/19/2014 02:01:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (12/18/2014 06:33:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3470 CPU @ 3.20GHz
Percentage of memory in use: 19%
Total physical RAM: 8142.36 MB
Available physical RAM: 6527.03 MB
Total Pagefile: 24524.54 MB
Available Pagefile: 22866.63 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:931.41 GB) (Free:816.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 477201BA)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End Of Log ============================
__________________
Alt 22.12.2014, 13:32   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop.
SystemLook (64 bit)
  • Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:
    Code:
    ATTFilter
    :regfind
0633EE93-D776-472F-A0FF-E1416B8B2E3A
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Der Suchlauf kann einige Zeit dauern.
  • Wenn der Suchlauf beendet ist, wird sich Dein Editor mit den Ergebnissen öffnen, poste diese in deinen Thread.
  • Die Ergebnisse werden auf dem Desktop als SystemLook.txt gespeichert.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 22.12.2014, 13:43   #5
SirLogian
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


So das ist die SystemLook.txt:

Code:
ATTFilter
SystemLook 30.07.11 by jpshortstuff
Log created at 13:39 on 22/12/2014 by User
Administrator - Elevation successful

========== regfind ==========

Searching for "0633EE93-D776-472F-A0FF-E1416B8B2E3A"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath"="C:\Users\User\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"FaviconPath"="C:\Users\User\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

Searching for "         "
[HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\User\Downloads\X3TCUpdate3.0_to_3.1.exe"="X3TerranConflictUpdate3.0to3.1                              "
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\GameUX\Games\{21C35C68-A6C5-4A75-8FFD-DB503CE6F67B}]
"RatingsInfo"="<Ratings xmlns="urn:schemas-microsoft-com:GameDescription.v1">
            <Rating ratingSystemID="{768BD93D-63BE-46A9-8994-0B53C4B5248F}" ratingID="{18CD34B7-7AA3-42b9-A303-5A729B2FF228}">
                <Descriptor descriptorID="{ABE23B46-7F9F-495b-B4A9-87F41743727F}"/>
                <Descriptor descriptorID="{B54162A2-F67F-46dc-9ED5-F6067520EC94}"/>
                <Descriptor descriptorID="{7E0BC004-F80B-402d-A1FC-5FCDFF04DAB1}"/>
                <Descriptor descriptorID="{BE562A5F-2A80-4c28-9752-74C696E2ABAF}"/>
            </Rating>
        </Ratings>"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell]
"ConfigXML"="             <PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" >                 <InitializationParameters>                     <Param Name="PSVersion" Value="2.0"/>                 </InitializationParameters>                 <Resources>                     <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" SupportsOptions="true" ExactMatch="true">                         <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                         <Capability Type="Shell"/>                     </Resource>                 </Res
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\WSMAN\Plugin\Microsoft.PowerShell32]
"ConfigXML"="<PlugInConfiguration xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Name="microsoft.powershell32" Filename="%windir%\system32\pwrshplugin.dll" SDKVersion="1" XmlRenderingType="text" Architecture="32" >                         <InitializationParameters>                             <Param Name="PSVersion" Value="2.0"/>                         </InitializationParameters>                         <Resources>                             <Resource ResourceUri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" SupportsOptions="true" ExactMatch="true">                                 <Security xmlns="hxxp://schemas.microsoft.com/wbem/wsman/1/config/PluginConfiguration" Uri="hxxp://schemas.microsoft.com/powershell/microsoft.powershell32" ExactMatch="true" Sddl="O:NSG:BAD:P(A;;GA;;;BA)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)"/>                                
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_1]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_2]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_3]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_4]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Mode]
"00000000"="                «Ç¤º"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Mode]
"01000001"="                «Ç¥~"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Mode]
"02000002"="              ¿Ã¥ú¿O"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0404\White_Balance_Mode]
"03010000"="¬õ                                                ÂÅ"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0409\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PAC207\Parameters\0804\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_1]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_2]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_3]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_4]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Mode]
"00000000"="                «Ç¤º"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Mode]
"01000001"="                «Ç¥~"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Mode]
"02000002"="              ¿Ã¥ú¿O"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0404\White_Balance_Mode]
"03010000"="¬õ                                                ÂÅ"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0409\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\PAC207\Parameters\0804\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_1]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_2]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_3]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\ACPI\AuthenticAMD_-_AMD64_Family_21_Model_1_-_AMD_FX(tm)-4100_Quad-Core_Processor____________\_4]
"FriendlyName"="AMD FX(tm)-4100 Quad-Core Processor            "
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Mode]
"00000000"="                «Ç¤º"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Mode]
"01000001"="                «Ç¥~"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Mode]
"02000002"="              ¿Ã¥ú¿O"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0404\White_Balance_Mode]
"03010000"="¬õ                                                ÂÅ"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0409\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Backlight_Compensation]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Backlight_Compensation]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Black_And_White_Mode]
"00000000"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Black_And_White_Mode]
"01000001"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Exposure_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Exposure_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Image_Mirror]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\Image_Mirror]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\White_Balance_Enable]
"00000001"="            On"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\White_Balance_Enable]
"01000000"="            Off"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PAC207\Parameters\0804\White_Balance_Mode]
"03010000"="Red                                              Blue"
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\User\Downloads\X3TCUpdate3.0_to_3.1.exe"="X3TerranConflictUpdate3.0to3.1                              "
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"C:\Users\User\Downloads\X3TCUpdate3.0_to_3.1.exe"="X3TerranConflictUpdate3.0to3.1                              "

-= EOF =-


Alt 23.12.2014, 11:58   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Kopiere den Text in der Codebox in deinen Editor (z.B. Notepad) und speichere es unter dem Namen regfix.reg (bei Dateityp bitte "alle Dateien" wählen)

Code:
ATTFilter
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1000\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
[-HKEY_USERS\S-1-5-21-2260964575-2753946872-1401531445-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"=-
Starte die regfix.reg duch Doppelklick.
__________________
--> Adware Cleaner kann Malware nicht löschen

Alt 23.12.2014, 12:38   #7
SirLogian
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Habe ich gemacht dort stand dann : Der Schlüssel von den Werten C:\Users\Users\Desktop\regefix.reg wurde erfolgreich in die Registrierung eingetragen.

Alt 24.12.2014, 13:33   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Versuch AdwCleaner nochmal, sollte jetzt RUhe sein
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.12.2014, 13:48   #9
SirLogian
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Hat geholfen danke^^

Alt 25.12.2014, 11:39   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Adware Cleaner kann Malware nicht löschen - Standard

Adware Cleaner kann Malware nicht löschen


Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Adware Cleaner kann Malware nicht löschen
adware, adware cleaner, angezeigt, beseitigen, cleaner, einträge, explorer, folge, frage, fragen, gelöscht, gestartet, heute, internet, internet explorer, löschen, malware, microsoft, neu, neustart, nicht löschen, nichts, scan, scanner, schlimmes, searchscopes, software


« WinPatrol meldet unbekannte Software | tr/crypt.xpack.gen3 und AVIRA »


Ähnliche Themen: Adware Cleaner kann Malware nicht löschen


  1. Adw Cleaner zeigt immer noch in Scheduled tasks Daten an die der Cleaner nicht Löscht
    Log-Analyse und Auswertung - 23.08.2015 (5)
  2. Adware Cleaner
    Plagegeister aller Art und deren Bekämpfung - 20.08.2015 (3)
  3. Adw Cleaner - kann ich das alles löschen?
    Log-Analyse und Auswertung - 15.06.2015 (15)
  4. Laut Adw-Cleaner Virus in Chrome und kann ihn nicht entfernen.
    Plagegeister aller Art und deren Bekämpfung - 27.04.2015 (14)
  5. ADW-Cleaner kann Virus nicht löschen
    Plagegeister aller Art und deren Bekämpfung - 25.03.2015 (11)
  6. BitdefenderIS15 kann Adware.AdPeak.V nicht löschen.
    Log-Analyse und Auswertung - 09.01.2015 (17)
  7. Windows 8.1 - Avira PC Cleaner Schadsoftware TR/Trustezeb.145408 nicht zu löschen
    Log-Analyse und Auswertung - 08.01.2015 (11)
  8. adw Cleaner-was muss/kann ich löschen?
    Log-Analyse und Auswertung - 04.05.2014 (19)
  9. Win 7 - Trojanerfund durch Avira PC Cleaner - Kann nicht gelöscht werden?
    Log-Analyse und Auswertung - 31.01.2014 (13)
  10. Was kann ich löschen? > Malwarebytes Anti-Malware Logdatei
    Plagegeister aller Art und deren Bekämpfung - 05.04.2013 (32)
  11. Kann ich Quarantäne-Dateien im Malware ohne weiteres löschen??
    Plagegeister aller Art und deren Bekämpfung - 28.02.2013 (1)
  12. "SuperantiSpyware" erkennt "Adware.tracking cookie" kann aber das nicht löschen
    Plagegeister aller Art und deren Bekämpfung - 20.12.2010 (21)
  13. Kann Malware nicht löschen! Trojan.Agent und Malware.Trace
    Plagegeister aller Art und deren Bekämpfung - 18.06.2010 (19)
  14. Kann nicht Spyware Adware löschen!
    Plagegeister aller Art und deren Bekämpfung - 27.07.2006 (15)
  15. HELP!!!not-a-virus:AdWare.Win32.CommonName.g:( kann es nicht löschen..pls help
    Plagegeister aller Art und deren Bekämpfung - 23.10.2005 (11)
  16. Adware nicht zu löschen(webdlg32.dll)!!!
    Log-Analyse und Auswertung - 26.01.2005 (2)
  17. Norton meldet Adware und kann sie nicht löschen????
    Plagegeister aller Art und deren Bekämpfung - 01.12.2004 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Adware Cleaner kann Malware nicht löschen - Hallo, ich habe heute einen Suchlauf mit Adware Cleaner gemacht und der zeigt mir folgene Einträge an: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472F-A0FF-E1416B8B2E3A} als ich den Eintrag löschen wollte und - Adware Cleaner kann Malware nicht löschen...
Archiv
Du betrachtest: Adware Cleaner kann Malware nicht löschen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55