| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Fehlermeldung ".exe - ungültiges Bild" + Ergebniss Farbar's Recovery Scan ToolWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
04.05.2015, 08:41
| #9 |
| |  Fehlermeldung ".exe - ungültiges Bild" + Ergebniss Farbar's Recovery Scan Tool Ich entschuldige mich für die späte Antwort aber ich war über das Weekend im Ausland. Anbei meine Ergebnisse der Scans. Malwarebytes Anti-Malware (Scan Log): Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 04.05.2015 Suchlauf-Zeit: 08:27:01 Logdatei: Malwarebytes Anti-Malware .txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.03.06 Rootkit Datenbank: v2015.04.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: ew Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 554931 Verstrichene Zeit: 23 Min, 36 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 2 PUP.Optional.SearchProtect.A, HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [5be74a45cfbb70c6cd48ac9fa45fdf21], PUP.Optional.SearchProtect.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}, In Quarantäne, [5be74a45cfbb70c6cd48ac9fa45fdf21], Registrierungswerte: 3 PUP.Optional.Trovi.A, HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|URL, hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=58&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&q={searchTerms}&SSPV=, In Quarantäne, [20226728beccf83e3948f26b17ee5fa1] PUP.Optional.Conduit.A, HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|SuggestionsURL_JSON, hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}, In Quarantäne, [a89a355a9eec78be38afd8f4b94ab14f] PUP.Optional.Trovi.A, HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}|DisplayName, Trovi search, In Quarantäne, [dd65d4bb4d3da690bdc465f811f48a76] Registrierungsdaten: 1 PUP.Optional.Trovi.A, HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV=, Gut: (www.google.com), Schlecht: (hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV=),Ersetzt,[d86af6991a70999d6e58a85eea1ce41c] Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 6 PUP.Optional.Conduit.A, C:\Users\ew\AppData\Roaming\RHEng\0A256E6855C54D918C58CECDD6CC45E1\sp-downloader.exe, In Quarantäne, [a0a2602fcac0d462db1a89c53bc6fc04], PUP.Optional.Trovi.A, C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "homepage": "hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV=",), Ersetzt,[48fa315e5634a19564a69eb3d72fe719] PUP.Optional.Trovi.A, C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences, Gut: (), Schlecht: ({"homepage":"hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV=","protection":{"super_mac":"D6BE667504E364A01BD26DF8E371EEF8F29C8AB52A66755A5CEC945E29FEAE95"},"session":{"startup_urls":["hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV="],"restore_on_startup":4,"urls_to_restore_on_startup":["hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV="]},"homepage_is_newtabpage":false,"browser":{"show_home_button":true},"default_search_provider":{"synced_guid":"BFFD9B08-C30F-4EA4-AC03-5AFD316CB981"},"default_search_provider_data":{"template_url_data":{"short_name":"Trovi search","keyword":"trovi.search","url":"hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=58&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&q={searchTerms}&SSPV=","suggestions_url":"hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}","id":"6","prepopulate_id":0,"synced_guid":"BFFD9B08-C30F-4EA4-AC03-5AFD316CB981","instant_url":"","favicon_url":""}}}), Ersetzt,[cc765639b7d337ff8189ef62ee186a96] PUP.Optional.Trovi, C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "search_url": "hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=58&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&q={searchTerms}&SSPV=",), Ersetzt,[7cc63956236738feee91cf81fd09a45c] PUP.Optional.Conduit, C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "suggest_url": "hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}"), Ersetzt,[3210c7c896f465d1720e0848e224cb35] PUP.Optional.Trovi.A, C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: ( "startup_urls": [ "hxxp://www.trovi.com/?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=55&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&SSPV=" ],), Ersetzt,[af93f79892f875c19277db76d5315ca4] Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 04.05.2015 08:26:34, SYSTEM, JMO0713, Protection, Malware Protection, Starting, Protection, 04.05.2015 08:26:34, SYSTEM, JMO0713, Protection, Malware Protection, Started, Protection, 04.05.2015 08:26:34, SYSTEM, JMO0713, Protection, Malicious Website Protection, Starting, Protection, 04.05.2015 08:26:34, SYSTEM, JMO0713, Protection, Malicious Website Protection, Started, Update, 04.05.2015 08:26:39, SYSTEM, JMO0713, Manual, Remediation Database, 2015.3.9.1, 2015.4.22.1, Update, 04.05.2015 08:26:39, SYSTEM, JMO0713, Manual, Rootkit Database, 2015.2.25.1, 2015.4.21.1, Update, 04.05.2015 08:26:44, SYSTEM, JMO0713, Manual, Malware Database, 2015.3.9.5, 2015.5.3.6, Protection, 04.05.2015 08:26:44, SYSTEM, JMO0713, Protection, Refresh, Starting, Protection, 04.05.2015 08:26:44, SYSTEM, JMO0713, Protection, Malicious Website Protection, Stopping, Protection, 04.05.2015 08:26:44, SYSTEM, JMO0713, Protection, Malicious Website Protection, Stopped, Protection, 04.05.2015 08:26:48, SYSTEM, JMO0713, Protection, Refresh, Success, Protection, 04.05.2015 08:26:48, SYSTEM, JMO0713, Protection, Malicious Website Protection, Starting, Protection, 04.05.2015 08:26:48, SYSTEM, JMO0713, Protection, Malicious Website Protection, Started, Scan, 04.05.2015 08:55:30, SYSTEM, JMO0713, Manual, Start: 04.05.2015 08:27:01, Dauer: 23 Minuten 36 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, "12" nicht-Malwareerkennung, Protection, 04.05.2015 08:56:58, SYSTEM, JMO0713, Protection, Malware Protection, Starting, Protection, 04.05.2015 08:56:58, SYSTEM, JMO0713, Protection, Malware Protection, Started, Protection, 04.05.2015 08:56:58, SYSTEM, JMO0713, Protection, Malicious Website Protection, Starting, Protection, 04.05.2015 08:57:52, SYSTEM, JMO0713, Protection, Malicious Website Protection, Started, Protection, 04.05.2015 09:00:05, SYSTEM, JMO0713, Protection, Malware Protection, Starting, Protection, 04.05.2015 09:00:05, SYSTEM, JMO0713, Protection, Malware Protection, Started, Protection, 04.05.2015 09:00:05, SYSTEM, JMO0713, Protection, Malicious Website Protection, Starting, Protection, 04.05.2015 09:01:32, SYSTEM, JMO0713, Protection, Malicious Website Protection, Started, Protection, 04.05.2015 09:25:04, SYSTEM, JMO0713, Protection, Malware Protection, Starting, Protection, 04.05.2015 09:25:04, SYSTEM, JMO0713, Protection, Malware Protection, Started, Protection, 04.05.2015 09:25:04, SYSTEM, JMO0713, Protection, Malicious Website Protection, Starting, Protection, 04.05.2015 09:26:02, SYSTEM, JMO0713, Protection, Malicious Website Protection, Started, (end) Code:
ATTFilter # AdwCleaner v4.203 - Bericht erstellt 04/05/2015 um 09:24:06
# Aktualisiert 30/04/2015 von Xplode
# Datenbank : 2015-05-02.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : ew - JMO0713
# Gestarted von : \\JMSRV01\RedirectedFolders\ew\Desktop\AdwCleaner_4.203.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\ew\AppData\Roaming\RHEng
Datei Gelöscht : C:\Users\ew\AppData\Roaming\Mozilla\Firefox\Profiles\s7sjdn3i.default\searchplugins\ask-search.xml
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKU\.DEFAULT\Software\AskPartnerNetwork
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17728
Einstellung Wiederhergestellt : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
-\\ Mozilla Firefox v37.0.2 (x86 de)
-\\ Google Chrome v
[C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325585&octid=EB_ORIGINAL_CTID&ISID=M53729E43-7957-4776-B0EA-C15340AA459F&SearchSource=58&CUI=&UM=6&UP=SP581C485C-FC41-4A3D-8BBF-B14160454E65&q={searchTerms}&SSPV=
*************************
AdwCleaner[R0].txt - [3610 Bytes] - [04/05/2015 09:15:39]
AdwCleaner[R1].txt - [3669 Bytes] - [04/05/2015 09:22:38]
AdwCleaner[S0].txt - [3010 Bytes] - [04/05/2015 09:24:06]
########## EOF - U:\AdwCleaner\AdwCleaner[S0].txt - [3069 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.7 (04.30.2015:1)
OS: Windows 7 Professional x64
Ran by ew on 04.05.2015 at 9:33:31.76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\ew\AppData\Roaming\mozilla\firefox\profiles\s7sjdn3i.default\minidumps [112 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 04.05.2015 at 9:35:12.55
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hier noch mein neuer FRST Log: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2015
Ran by ew (administrator) on JMO0713 on 04-05-2015 09:40:24
Running from \\JMSRV01\RedirectedFolders\ew\Desktop
Loaded Profiles: ew (Available profiles: hugener & nv & ew & Administrator & Hugener)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) \\JMSRV01\RedirectedFolders\ew\Desktop\FRST64.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe
(Farbar) \\JMSRV01\RedirectedFolders\ew\Desktop\FRST64.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-03-28] (Realtek Semiconductor)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-21] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [290688 2012-10-25] (Intel Corporation)
HKLM-x32\...\Run: [RemoteControl10] => c:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-14] (CyberLink Corp.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [373760 2013-03-14] (shbox.de)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704248 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111576 2013-08-05] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-08-07] (CyberLink Corp.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\...\Run: [Power2GoExpress8] => NA
HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\...\Run: [eDial.exe] => C:\Program Files (x86)\Aastra\Office eDial\eDial.exe [251192 2008-11-14] (Aastra Telecom Schweiz AG)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3445035357-1150739943-2538757247-1199\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-09-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-09-26] (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.70.1
Tcpip\..\Interfaces\{37E5F6A4-6A74-430D-B3E4-EA16EDE54B5C}: [NameServer] 192.168.70.1,8.8.8.8
FireFox:
========
FF ProfilePath: C:\Users\ew\AppData\Roaming\Mozilla\Firefox\Profiles\s7sjdn3i.default
FF SearchEngineOrder.1: Ask Search
FF Homepage: https://www.google.ch/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll [2014-12-02] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-09-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-09-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3445035357-1150739943-2538757247-1199: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\ew\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-08-08] (Unity Technologies ApS)
FF SearchPlugin: C:\Users\ew\AppData\Roaming\Mozilla\Firefox\Profiles\s7sjdn3i.default\searchplugins\trovi-search-1.xml [2014-11-07]
Chrome:
=======
CHR Profile: C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-05]
CHR Extension: (Google Drive) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-05]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-15]
CHR Extension: (YouTube) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-05]
CHR Extension: (Google Search) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-05]
CHR Extension: (Google Wallet) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-05]
CHR Extension: (Gmail) - C:\Users\ew\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-05]
Geändert von wechos (04.05.2015 um 08:37 Uhr) |
| Themen zu Fehlermeldung ".exe - ungültiges Bild" + Ergebniss Farbar's Recovery Scan Tool |
| ahnung, anderen, anhang, bild, computer, ebenfalls, empfehlung, fehlermeldung, folge, guten, internet, laden, lösung, problem, programmstart, ratlos, recovery, scan, schließen, screenshot, speicher, tool, virus, windows, windows 7 |
Baum-Darstellung