|
Probleme mit Edeals, Snap.do und dem download von tools Hallo allerseits Habe mir irgendwelche Malware durch unvorsichtiges downloaden eingefangen. Lange Zeit wurde mir in der Systemsteuerung unter den Programmen Edeals und Snap.do angezeigt. ich konnte beides entfernen mittels Adware Cleaner, Malwarebytes Anti Malware Premium und IObit Uninstaller. Trotzdem ist die Werbung noch direkt auf den Seiten vorhanden mit penetranten Werbelinks und dazu öffnen sich auch ungewollt pop ups mit unseriösen links. Ich wollte die Logs wie im Hilfethread erarbeiten, leider lassen sich aber weder FRST, noch eset online scanner und diverse andere Tools downloaden. bei "normalen" dateien problemloser download. ich erhalte die Fehlermeldung: C:\Users\S9B32~1.AER\AppData\Local\Temp\O2h2DXRT.exe.part konnte nicht gespeichert werden, weil die Quelldatei nicht gelesen werden konnte. egal wie oft ich das versuche. alternativ poste ich JRT und Adware Cleaner logs. Bitte um Hilfestellung. Besten Dank ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.3.3 (10.14.2014:1) OS: Windows 7 Professional x64 Ran by S.Aerne on 23.10.2014 at 14:47:48.49 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ FireFox Emptied folder: C:\Users\S.Aerne\AppData\Roaming\mozilla\firefox\profiles\hca1uvkk.default-1413971435070\minidumps [1 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 23.10.2014 at 14:51:46.21 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # AdwCleaner v4.001 - Bericht erstellt am 23/10/2014 um 15:05:13 # Aktualisiert 20/10/2014 von Xplode # Datenbank : 2014-10-21.1 # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzername : S.Aerne - SAERNE-PC # Gestartet von : C:\Users\S.Aerne\Downloads\adwcleaner_4.001(1).exe # Option : Suchen ***** [ Dienste ] ***** ***** [ Dateien / Ordner ] ***** Ordner Gefunden : C:\Users\S.Aerne\AppData\Local\CheckCode ***** [ Tasks ] ***** ***** [ Verknüpfungen ] ***** ***** [ Registrierungsdatenbank ] ***** Schlüssel Gefunden : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec Schlüssel Gefunden : HKLM\SOFTWARE\RST Schlüssel Gefunden : HKLM\SOFTWARE\SI-App Schlüssel Gefunden : HKLM\SOFTWARE\Upt Schlüssel Gefunden : HKLM\SOFTWARE\WinUpd Schlüssel Gefunden : [x64] HKLM\SOFTWARE\RST Schlüssel Gefunden : [x64] HKLM\SOFTWARE\SI-App Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Upt Schlüssel Gefunden : [x64] HKLM\SOFTWARE\WinUpd ***** [ Browser ] ***** -\\ Internet Explorer v11.0.9600.17344 -\\ Mozilla Firefox v33.0 (x86 de) ************************* AdwCleaner[R0].txt - [11560 octets] - [14/09/2014 09:39:43] AdwCleaner[R10].txt - [2160 octets] - [21/10/2014 14:35:18] AdwCleaner[R11].txt - [2529 octets] - [22/10/2014 11:45:02] AdwCleaner[R12].txt - [2654 octets] - [22/10/2014 12:25:57] AdwCleaner[R13].txt - [1356 octets] - [23/10/2014 15:05:13] AdwCleaner[R1].txt - [1275 octets] - [14/09/2014 09:50:58] AdwCleaner[R2].txt - [1398 octets] - [14/09/2014 10:06:10] AdwCleaner[R3].txt - [1518 octets] - [14/09/2014 10:17:04] AdwCleaner[R4].txt - [1506 octets] - [14/09/2014 11:00:38] AdwCleaner[R5].txt - [2012 octets] - [15/10/2014 10:58:32] AdwCleaner[R6].txt - [2207 octets] - [16/10/2014 11:25:51] AdwCleaner[R7].txt - [2267 octets] - [16/10/2014 11:28:42] AdwCleaner[R8].txt - [2108 octets] - [16/10/2014 11:38:26] AdwCleaner[R9].txt - [8479 octets] - [21/10/2014 13:19:24] AdwCleaner[S0].txt - [8584 octets] - [14/09/2014 09:40:37] AdwCleaner[S10].txt - [2583 octets] - [22/10/2014 11:47:44] AdwCleaner[S11].txt - [2708 octets] - [22/10/2014 12:27:56] AdwCleaner[S1].txt - [1340 octets] - [14/09/2014 09:53:15] AdwCleaner[S2].txt - [1327 octets] - [14/09/2014 10:08:10] AdwCleaner[S3].txt - [1583 octets] - [14/09/2014 10:18:22] AdwCleaner[S4].txt - [1567 octets] - [14/09/2014 11:02:35] AdwCleaner[S5].txt - [2065 octets] - [15/10/2014 11:01:24] AdwCleaner[S6].txt - [2274 octets] - [16/10/2014 11:32:29] AdwCleaner[S7].txt - [2161 octets] - [16/10/2014 11:41:46] AdwCleaner[S8].txt - [8642 octets] - [21/10/2014 13:21:53] AdwCleaner[S9].txt - [2167 octets] - [21/10/2014 14:37:59] ########## EOF - C:\AdwCleaner\AdwCleaner[R13].txt - [2679 octets] ########## |
hi, Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014 |
FRST liess sich mit Internet Explorer downloaden. Hier die Logs: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014--- --- --- FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014 |
Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte. |
Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.10.2014 Suchlauf-Zeit: 09:09:28 Logdatei: mbam.txt Administrator: Ja Version: 2.00.3.1025 Malware Datenbank: v2014.10.24.03 Rootkit Datenbank: v2014.10.22.01 Lizenz: Premium Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: S.Aerne Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 349801 Verstrichene Zeit: 8 Min, 36 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 1 PUP.Optional.SuperFish.A, HKU\S-1-5-21-762131175-2521822999-1656188121-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, In Quarantäne, [8201ae6ae89461d5b34785ae2cd7e020], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 1 PUP.Optional.UptUpdater.A, C:\Windows\Temp\UptUpdater.exe, In Quarantäne, [077c0b0d85f76bcbc54edcf73dc4aa56], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) AdwCleaner Logfile: Code: # AdwCleaner v4.001 - Bericht erstellt am 24/10/2014 um 09:29:44~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.3.3 (10.21.2014:1) OS: Windows 7 Professional x64 Ran by S.Aerne on 24.10.2014 at 9:33:13.38 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 24.10.2014 at 9:37:56.85 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014--- --- --- FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014 |
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? :) |
C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir Win32/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir Win64/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir Win32/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Users\S.Aerne\AppData\Local\Temp\VOPackage.exe.vir Win32/VOPackage.AD evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Documents\Downloads\Integrated_BrotherSoft_TB.exe Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Documents\Downloads\Integrated_CT2776682.exe Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\wzmp_8.exe Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\Brothersoft_downloader_For_Dungeon_Keeper.exe Variante von Win32/BSDownloader evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\com.herocraft.game.revivaldeluxe.demo.apk Variante von Android/TrojanSMS.Agent.AJM Trojaner gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\installer_elven__legacy_1_0_Deutsch.exe Win32/Toggle evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Musik\Eluveitie_2010_Everything_Remains_As_It_Never_Was_[Limited_Edition].exe Win32/AdWare.1ClickDownload.AT Anwendung Gesäubert durch Löschen - in Quarantäne kopiert FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014Security Check kann ich leider nicht ausführen, ich erhalte die Meldung: UNSUPPORTED OPERATING SYSTEM! ABORTED! Und ja das Problem mit eDeals besteht noch genauso wie vorher |
Security Check kann ich leider nicht ausführen, ich erhalte die Meldung: UNSUPPORTED OPERATING SYSTEM! ABORTED! Und ja das Problem mit eDeals besteht leider noch genauso wie vorher. C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\HpUI.exe.vir Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader32.exe.vir Win32/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\Loader64.exe.vir Win64/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\uninstall.exe.vir Win32/Thinknice.E evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Program Files (x86)\SupTab\WindowsSupportDll64.dll.vir Variante von Win32/Thinknice.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\AdwCleaner\Quarantine\C\Users\S.Aerne\AppData\Local\Temp\VOPackage.exe.vir Win32/VOPackage.AD evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Documents\Downloads\Integrated_BrotherSoft_TB.exe Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Documents\Downloads\Integrated_CT2776682.exe Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\wzmp_8.exe Variante von MSIL/AdvancedSystemProtector.F evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\Brothersoft_downloader_For_Dungeon_Keeper.exe Variante von Win32/BSDownloader evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\com.herocraft.game.revivaldeluxe.demo.apk Variante von Android/TrojanSMS.Agent.AJM Trojaner gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Games\installer_elven__legacy_1_0_Deutsch.exe Win32/Toggle evtl. unerwünschte Anwendung gelöscht - in Quarantäne kopiert C:\Users\S.Aerne\Downloads\Musik\Eluveitie_2010_Everything_Remains_As_It_Never_Was_[Limited_Edition].exe Win32/AdWare.1ClickDownload.AT Anwendung Gesäubert durch Löschen - in Quarantäne kopiert FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014--- --- --- --- --- --- --- --- --- --- --- ---FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-10-2014 |
In welchen Browsern? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code: GroupPolicy: Group Policy on Chrome detected <======= ATTENTIONSpeichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
|
Edeals zeigt sich bei Firefox und Internet Explorer. Chrome benutze ich nicht. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-10-2014 Ran by S.Aerne at 2014-10-26 05:54:32 Run:1 Running from C:\Users\S.Aerne\Desktop Loaded Profile: S.Aerne (Available profiles: S.Aerne) Boot Mode: Normal ============================================== Content of fixlist: ***************** GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ProxyEnable: Internet Explorer proxy is enabled. ProxyServer: http=127.0.0.1:23868 S2 CodecFolderMotion.exe; C:\Users\S.Aerne\AppData\Local\CodecFolderMotion\CodecFolderMotion.exe [X] S2 CodecImportMotion.exe; C:\Users\S.Aerne\AppData\Local\CodecImportMotion\CodecImportMotion.exe [X] S2 ControlDebugOCR.exe; C:\Users\S.Aerne\AppData\Local\ControlDebugOCR\ControlDebugOCR.exe [X] S2 FileKernelScreenshot.exe; C:\Users\S.Aerne\AppData\Local\FileKernelScreenshot\FileKernelScreenshot.exe [X] S2 FormatMemoryMotion.exe; C:\Users\S.Aerne\AppData\Local\FormatMemoryMotion\FormatMemoryMotion.exe [X] Task: {1BCDBB30-79DA-45F0-AC6A-7EFA2D763068} - \PC Performer Scheduled Scan No Task File <==== ATTENTION Task: {AEAE8254-C339-44CE-BD29-B2E72526D93C} - \PC Performer Logon Scan No Task File <==== ATTENTION ***************** C:\Windows\system32\GroupPolicy\Machine => Moved successfully. C:\Windows\system32\GroupPolicy\GPT.ini => Moved successfully. "HKLM\SOFTWARE\Policies\Google" => Key deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully. CodecFolderMotion.exe => Service deleted successfully. CodecImportMotion.exe => Service deleted successfully. ControlDebugOCR.exe => Service deleted successfully. FileKernelScreenshot.exe => Service deleted successfully. FormatMemoryMotion.exe => Service deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1BCDBB30-79DA-45F0-AC6A-7EFA2D763068}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1BCDBB30-79DA-45F0-AC6A-7EFA2D763068}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer Scheduled Scan" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{AEAE8254-C339-44CE-BD29-B2E72526D93C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AEAE8254-C339-44CE-BD29-B2E72526D93C}" => Key deleted successfully. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PC Performer Logon Scan" => Key deleted successfully. The system needed a reboot. ==== End of Fixlog ==== |
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen Setze folgendermassen den Internet Explorer zurück:
Frisches FRST log bitte. |
Habe Firefox komplett deinstalliert inkl allen persönlichen Einstellungen usw und danach Internet Explorer komplett zurückgesetzt. Das Problem besteht weiterhin. Hier die Logs: FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014FRST Additions Logfile: Code: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014 |
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code: ProxyEnable: Internet Explorer proxy is enabled.Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
|
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-10-2014 Ran by S.Aerne at 2014-10-27 13:00:35 Run:2 Running from C:\Users\S.Aerne\Desktop Loaded Profile: S.Aerne (Available profiles: S.Aerne) Boot Mode: Normal ============================================== Content of fixlist: ***************** ProxyEnable: Internet Explorer proxy is enabled. ProxyServer: http=127.0.0.1:20091 S2 GammaMethodRegister; C:\Windows\SysWOW64\GammaMethodRegister\GammaMethodRegister.exe [68096 2014-10-13] () [File not signed] C:\Windows\SysWOW64\GammaMethodRegister R2 InterpreterProcessRemote.exe; C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\InterpreterProcessRemote.exe [158720 2014-10-13] () [File not signed] C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => value deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => value deleted successfully. GammaMethodRegister => Unable to stop service GammaMethodRegister => Service deleted successfully. C:\Windows\SysWOW64\GammaMethodRegister => Moved successfully. InterpreterProcessRemote.exe => Unable to stop service InterpreterProcessRemote.exe => Service deleted successfully. "C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote" directory move: C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\ArchiveODBCWiget.exe => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\InterpreterProcessRemote.exe => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\msvcp100.dll => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\msvcr100.dll => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\qjson0.dll => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\QtCore4.dll => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\QtNetwork4.dll => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\SrDt.exe => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-6892)-4521189\adwcleaner_4.001.exe-(PID-6352).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-6892)-4521189\ArchiveODBCWiget.exe-(PID-6892).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-632)-1926315\adwcleaner_4.001(1).exe-(PID-292).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-632)-1926315\ArchiveODBCWiget.exe-(PID-632).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-4720)-497097\adwcleaner_4.000.exe-(PID-4176).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-4720)-497097\ArchiveODBCWiget.exe-(PID-4720).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-4712)-46965286\adwcleaner_4.001(1).exe-(PID-6416).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-4712)-46965286\ArchiveODBCWiget.exe-(PID-4712).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3912)-5846277\adwcleaner_4.001(1).exe-(PID-1164).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3912)-5846277\ArchiveODBCWiget.exe-(PID-3912).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3712)-1823433\adwcleaner_4.000.exe-(PID-5384).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3712)-1823433\ArchiveODBCWiget.exe-(PID-3712).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3608)-7857255\adwcleaner_4.001.exe-(PID-2376).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3608)-7857255\ArchiveODBCWiget.exe-(PID-3608).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3380)-545379\adwcleaner_4.001(1).exe-(PID-4888).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3380)-545379\ArchiveODBCWiget.exe-(PID-3380).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3360)-606656\adwcleaner_4.001(1).exe-(PID-4580).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-3360)-606656\ArchiveODBCWiget.exe-(PID-3360).dmp => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-1484)-1816631\adwcleaner_4.001.exe-(PID-1528).dmp_PROCESS_SUBMITTED => Moved successfully. C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote\desktop\ArchiveODBCWiget.exe-(PID-1484)-1816631\ArchiveODBCWiget.exe-(PID-1484).dmp => Moved successfully. Could not move "C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote" directory. => Scheduled to move on reboot. => Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-10-27 13:01:53)<= C:\Users\S.Aerne\AppData\Local\InterpreterProcessRemote => Is moved successfully. ==== End of Fixlog ==== |
Jetzt bitte nochmal ein frisches FRST log. |
FRST Logfile: Code: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-10-2014Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-10-2014 Ran by S.Aerne at 2014-10-28 11:39:20 Running from C:\Users\S.Aerne\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) 7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.2.0.2070 - Adobe Systems Incorporated) Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.9.149 - Adobe Systems, Inc.) Age of Empires III (HKLM-x32\...\InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}) (Version: 1.00.0000 - Microsoft Game Studios) Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden Age of Wonders III (HKLM-x32\...\Steam App 226840) (Version: - Triumph Studios) Alien Swarm (HKLM-x32\...\Steam App 630) (Version: - Valve) Banished (HKLM-x32\...\Steam App 242920) (Version: - Shining Rock Software LLC) Battle Isle Platinum (HKLM-x32\...\GOGPACKBATTLEISLEPLATINUM_is1) (Version: 2.1.0.19 - GOG.com) Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment) Blackguards (HKLM-x32\...\Steam App 249650) (Version: - Daedalic Entertainment) Blood Bowl: Chaos Edition (HKLM-x32\...\Steam App 216890) (Version: - Cyanide Studios) Braveland (HKLM-x32\...\GOGPACKBRAVELAND_is1) (Version: 2.1.0.3 - GOG.com) CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.7.2423 - CDBurnerXP) CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5118 - CDBurnerXP) Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version: - Relic Entertainment) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Defender's Quest: Valley of the Forgotten (HKLM-x32\...\Steam App 218410) (Version: - Level Up Labs, LLC) Dell Driver Download Manager (HKCU\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.) Die Siedler 7 (HKLM-x32\...\{9C916142-C18C-429D-BFED-40094A7E0BEB}) (Version: 1.12.1396 - Ubisoft) Dota 2 (HKLM-x32\...\Steam App 570) (Version: - Valve) Draconian Wars (HKLM-x32\...\Steam App 296590) (Version: - Kardfy Studios) Duel of Champions (HKLM-x32\...\MMDoC-PDCLive) (Version: - Ubisoft) Dungeon Keeper 2 (HKLM-x32\...\GOGPACKDUNGEONKEEPER2_is1) (Version: 2.0.0.32 - GOG.com) Dungeon Keeper Gold (HKLM-x32\...\GOGPACKDUNGEONKEEPER_is1) (Version: 2.0.0.4 - GOG.com) Etherlords (HKLM-x32\...\Steam App 270770) (Version: - Nival) Etherlords II (HKLM-x32\...\Steam App 270790) (Version: - Nival) Fallen Enchantress: Legendary Heroes (HKLM-x32\...\Steam App 228260) (Version: - Stardock Entertainment) FLOCK! (HKLM-x32\...\Steam App 21640) (Version: - Proper Games) Foxit Reader 5.0 (HKLM-x32\...\Foxit Reader_is1) (Version: 5.0.2.718 - Foxit Corporation) GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden GOG.com Downloader version 3.6.0 (HKLM-x32\...\{456A5815-604D-4D72-94DF-346D2B978A59}_is1) (Version: 3.6.0 - GOG.com) GOG.com Dungeon Keeper 2 (HKLM\...\{b6462b67-caf5-4a74-99df-cc2811bd1957}.sdb) (Version: - ) GOG.com Heroes of Might and Magic 3 (HKLM\...\{1d3c859c-1028-4822-b0a7-da4f7bbc18bc}.sdb) (Version: - ) Gorky 17 (HKLM-x32\...\Steam App 253920) (Version: - ) Grotesque Tactics: Evil Heroes (HKLM-x32\...\Steam App 46450) (Version: - Headup Games) Half-Life (HKLM-x32\...\Steam App 70) (Version: - Valve) Hearthstone (HKLM-x32\...\Hearthstone) (Version: - Blizzard Entertainment) Heroes of Might & Magic V: Hammers of Fate (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200091}) (Version: - ) Heroes of Might and Magic 3 Complete (HKLM-x32\...\GOGPACKHOMM3COMPLETE_is1) (Version: 2.0.0.16 - GOG.com) Heroes of Might and Magic V - Tribes of the East (HKLM-x32\...\{66FF4C48-0083-4E60-8556-B883AB200092}) (Version: - ) Heroes of Might and Magic V (HKLM-x32\...\{20071984-5EB1-4881-8EDB-082532ACEC6D}) (Version: - ) Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version: - Blizzard Entertainment) HEX (HKLM-x32\...\{E31B651A-B48C-423C-8D0D-855756C8B7E8}_is1) (Version: - HEX Entertainment) Infinity Wars - Animated Trading Card Game (HKLM-x32\...\Steam App 257730) (Version: - Lightmare Studios) Jagged Alliance 2 Gold: Unfinished Business (HKLM-x32\...\Steam App 12380) (Version: - Strategy First) Jagged Alliance 2: Gold Pack (HKLM-x32\...\Steam App 12370) (Version: - Strategy First) Java Auto Updater (x32 Version: 2.0.4.1 - Sun Microsystems, Inc.) Hidden Java(TM) 6 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216025FF}) (Version: 6.0.250 - Oracle) League of Legends (HKLM-x32\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games) MAGIX Speed burnR (HKLM-x32\...\MAGIX Speed burnR D) (Version: 6.0.1.4 - MAGIX AG) Majesty 2 Collection (HKLM-x32\...\Steam App 73020) (Version: - 1C:InoCo) Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.) Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation) Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Virtual PC 2007 SP1 (HKLM\...\{AD483998-2E9A-4405-83FF-6E503AF49CBB}) (Version: 6.0.192.0 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{3bcf8c72-b231-4d28-9f39-3405c22d8b5a}) (Version: 11.0.61030.0 - Microsoft Corporation) Might & Magic Heroes VI - Shades of Darkness (HKLM-x32\...\{745D37C2-26F4-4B65-BA13-F9840EBFA75B}) (Version: 2.1.0 - Ubisoft) MMDoC-PDCLive Launcher (HKCU\...\3114a86aa00b92d7) (Version: 1.0.1.1 - Ubisoft) Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.0 - Mozilla) MP Manager (HKLM-x32\...\{D62460AF-5A0E-44F7-A647-C79076C5CA65}) (Version: 1.0.4715 - MPMAN) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation) MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation) NVIDIA 3D Vision Controller-Treiber 340.50 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 340.50 - NVIDIA Corporation) NVIDIA 3D Vision Treiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation) NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5896 - NVIDIA Corporation) NVIDIA GeForce Experience 1.8.2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2.1 - NVIDIA Corporation) NVIDIA Grafiktreiber 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation) NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation) NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation) NVIDIA ShadowPlay 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden NVIDIA Systemsteuerung 340.52 (Version: 340.52 - NVIDIA Corporation) Hidden NVIDIA Update 11.10.13 (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Update Core (Version: 11.10.13 - NVIDIA Corporation) Hidden NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation) Pox Nora 1.8 (HKLM-x32\...\3055-2232-0137-3195) (Version: 1.8 - Desert Owl Games) Prime World (HKLM-x32\...\Steam App 235340) (Version: - Nival) Prime World: Defenders (HKLM-x32\...\Steam App 235360) (Version: - Nival) Realtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5859 - Realtek Semiconductor Corp.) Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group) RIFT™ (HKLM-x32\...\Steam App 39120) (Version: - Trion Worlds) Shadow Warrior Classic Redux (HKLM-x32\...\Steam App 225160) (Version: - 3D Realms) Shadowrun Returns (HKLM-x32\...\Steam App 234650) (Version: - Harebrained Schemes) SHIELD Streaming (Version: 1.7.321 - NVIDIA Corporation) Hidden Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.6.8442 - Skype Technologies S.A.) Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.) Space Hulk (HKLM-x32\...\Steam App 242570) (Version: - Full Control Studios) StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) Stronghold Crusader Extreme HD (HKLM-x32\...\Steam App 16700) (Version: - Firefly Studios) Stronghold Crusader HD (HKLM-x32\...\Steam App 40970) (Version: - FireFly Studios) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: - TeamSpeak Systems GmbH) TeamViewer 6 (HKLM-x32\...\TeamViewer 6) (Version: 6.0.10511 - TeamViewer GmbH) Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH) The Banner Saga (HKLM-x32\...\Steam App 237990) (Version: - Stoic) Tropico 4 (HKLM-x32\...\Steam App 57690) (Version: - Haemimont Games) Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT) Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) VLC media player 1.1.4 (HKLM-x32\...\VLC media player) (Version: 1.1.4 - VideoLAN) Wakfu (HKLM-x32\...\Steam App 215080) (Version: - Ankama) Warlock - Master of the Arcane (HKLM-x32\...\Steam App 203630) (Version: - Paradox Interactive) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden WinRAR (HKLM\...\WinRAR archiver) (Version: - ) WinSCP 5.1.4 (HKLM-x32\...\winscp3_is1) (Version: 5.1.4 - Martin Prikryl) World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 21-10-2014 08:50:30 AA11 21-10-2014 08:50:43 Windows Update 21-10-2014 10:59:15 Removed Bonjour 21-10-2014 10:59:55 Removed Apple Mobile Device Support 21-10-2014 11:00:40 Removed Apple Application Support 21-10-2014 11:01:16 Removed Apple Software Update 21-10-2014 12:27:09 Revo Uninstaller's restore point - Shopping Helper Smartbar 21-10-2014 12:43:33 Removed iTunes 21-10-2014 12:45:15 Removed QuickTime 26-10-2014 15:11:27 Revo Uninstaller's restore point - Mozilla Maintenance Service 26-10-2014 15:16:47 Revo Uninstaller's restore point - Mozilla Firefox 33.0 (x86 de) 28-10-2014 10:27:08 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 03:34 - 2014-10-16 18:49 - 00450713 ____R C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 123haustiereundmehr.com 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123moviedownload.com There are 1000 more lines. ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1497AE49-32B5-4CB5-A34B-5E683461C01E} - System32\Tasks\{2D11BC38-BC04-40C6-89C1-82353F9ABE4B} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.) Task: {AF1BE5C7-2138-4C5F-869C-7C3ED971F9F7} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => c:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation) Task: {BBCE63A8-9FDD-48C8-8CF0-BFFB6A9A450A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated) Task: {FBDB51E8-1AC7-4A3B-867F-D2B43E4FF7A5} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe ==================== Loaded Modules (whitelisted) ============= 2011-12-19 13:04 - 2014-07-02 19:55 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll 2014-08-29 08:22 - 2014-08-21 19:15 - 01171456 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll 2014-08-29 08:22 - 2014-08-21 19:15 - 00442368 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll 2014-08-29 08:22 - 2014-08-21 19:15 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll 2014-02-23 11:53 - 2014-10-02 00:16 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll 2014-05-22 10:44 - 2014-10-21 20:22 - 02226880 _____ () C:\Program Files (x86)\Steam\video.dll 2014-08-29 08:22 - 2014-08-21 19:15 - 00403968 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll 2014-08-29 08:22 - 2014-08-21 19:15 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll 2014-02-23 11:53 - 2014-10-21 20:22 - 00682176 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL 2014-02-23 11:53 - 2014-09-05 00:29 - 34589376 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll 2014-10-26 16:37 - 2014-10-11 13:53 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll 2014-09-11 09:09 - 2014-09-11 09:09 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) ========================= Accounts: ========================== Administrator (S-1-5-21-762131175-2521822999-1656188121-500 - Administrator - Disabled) ASPNET (S-1-5-21-762131175-2521822999-1656188121-1004 - Administrator - Enabled) Gast (S-1-5-21-762131175-2521822999-1656188121-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-762131175-2521822999-1656188121-1002 - Limited - Enabled) S.Aerne (S-1-5-21-762131175-2521822999-1656188121-1000 - Administrator - Enabled) => C:\Users\S.Aerne ==================== Faulty Device Manager Devices ============= Name: Teredo Tunneling Pseudo-Interface Description: Microsoft-Teredo-Tunneling-Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (10/27/2014 03:05:14 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/27/2014 01:00:37 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.0.0.5397, Zeitstempel: 0x543924b1 Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.0.0.5397, Zeitstempel: 0x5438ffbb Ausnahmecode: 0x80000003 Fehleroffset: 0x00001425 ID des fehlerhaften Prozesses: 0x118c Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0 Pfad der fehlerhaften Anwendung: plugin-container.exe1 Pfad des fehlerhaften Moduls: plugin-container.exe2 Berichtskennung: plugin-container.exe3 Error: (10/26/2014 05:42:13 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/26/2014 05:40:38 PM) (Source: SideBySide) (EventID: 75) (User: ) Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3. Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig. Error: (10/26/2014 04:21:22 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNvVAD initialization failed [6] Error: (10/26/2014 04:21:22 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0] Error: (10/26/2014 04:21:20 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNvVAD endpoint registration failed [0] Error: (10/26/2014 04:20:18 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/26/2014 05:54:34 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 33.0.0.5397, Zeitstempel: 0x543924b1 Name des fehlerhaften Moduls: mozalloc.dll, Version: 33.0.0.5397, Zeitstempel: 0x5438ffbb Ausnahmecode: 0x80000003 Fehleroffset: 0x00001425 ID des fehlerhaften Prozesses: 0xb74 Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0 Pfad der fehlerhaften Anwendung: plugin-container.exe1 Pfad des fehlerhaften Moduls: plugin-container.exe2 Berichtskennung: plugin-container.exe3 Error: (10/25/2014 05:30:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Name der fehlerhaften Anwendung: ja2.exe, Version: 1.1.2.0, Zeitstempel: 0x3df9f604 Name des fehlerhaften Moduls: mss32.dll, Version: 3.0.0.0, Zeitstempel: 0x3bccbaf7 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00001c52 ID des fehlerhaften Prozesses: 0xcc4 Startzeit der fehlerhaften Anwendung: 0xja2.exe0 Pfad der fehlerhaften Anwendung: ja2.exe1 Pfad des fehlerhaften Moduls: ja2.exe2 Berichtskennung: ja2.exe3 System errors: ============= Error: (10/28/2014 11:22:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/27/2014 01:01:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/27/2014 00:54:29 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "InterpreterProcessRemote.exe" wurde nicht richtig gestartet. Error: (10/27/2014 00:52:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/26/2014 05:12:47 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "InterpreterProcessRemote.exe" wurde nicht richtig gestartet. Error: (10/26/2014 05:11:13 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/26/2014 04:40:14 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "InterpreterProcessRemote.exe" wurde nicht richtig gestartet. Error: (10/26/2014 04:38:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (10/26/2014 04:30:15 PM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Der Dienst "InterpreterProcessRemote.exe" wurde nicht richtig gestartet. Error: (10/26/2014 04:28:44 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Der Dienst "ClipboardFAT32Program.exe" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Microsoft Office Sessions: ========================= Error: (10/27/2014 03:05:14 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/27/2014 01:00:37 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: plugin-container.exe33.0.0.5397543924b1mozalloc.dll33.0.0.53975438ffbb8000000300001425118c01cff1dd44bd6a1bC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlldcb4bb8a-5dd0-11e4-a532-485b39b2a165 Error: (10/26/2014 05:42:13 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/26/2014 05:40:38 PM) (Source: SideBySide) (EventID: 75) (User: ) Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2 Error: (10/26/2014 04:21:22 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNvVAD initialization failed [6] Error: (10/26/2014 04:21:22 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0] Error: (10/26/2014 04:21:20 PM) (Source: NvStreamSvc) (EventID: 1) (User: ) Description: NvStreamSvcNvVAD endpoint registration failed [0] Error: (10/26/2014 04:20:18 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: ) Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008] Error: (10/26/2014 05:54:34 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: plugin-container.exe33.0.0.5397543924b1mozalloc.dll33.0.0.53975438ffbb8000000300001425b7401cff0d790ba6684C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll2db12392-5ccc-11e4-96ee-485b39b2a165 Error: (10/25/2014 05:30:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: ja2.exe1.1.2.03df9f604mss32.dll3.0.0.03bccbaf7c000000500001c52cc401cff01fdf961aa4C:\Program Files (x86)\Steam\steamapps\common\Jagged Alliance 2 Gold\ja2.exeC:\Program Files (x86)\Steam\steamapps\common\Jagged Alliance 2 Gold\mss32.dll3d8ce488-5c64-11e4-8700-485b39b2a165 ==================== Memory info =========================== Processor: Intel(R) Core(TM)2 Quad CPU Q8300 @ 2.50GHz Percentage of memory in use: 43% Total physical RAM: 4095.18 MB Available physical RAM: 2314.48 MB Total Pagefile: 8188.54 MB Available Pagefile: 5939.09 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:931.41 GB) (Free:319.35 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A745740) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Keine Edeals Links, keine ständig aufploppenden Werbefenster mehr. Malwarebytes meldet mir nur noch PUP.optional.Uptupdater.exe in C:\windows\temp. jeweils bei jedem suchlauf, wird auch jedes mal in Quarantäne verschoben. abgesehen davon scheint es gut zu sein |
Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Fertig :) Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :) Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 09:55 Uhr. |
Copyright ©2000-2025, Trojaner-Board
