Trojaner-Board - Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt (https://www.trojaner-board.de/161974-windows-befehlsprozessor-oeffnet-dauernd-unteren-bildschirmrand-blinkt.html)

Windows- Befehlsprozessor öffnet sich dauernd am unteren Bildschirmrand und blinkt

Hallo zusammen,

Ich habe seit zwei Tagen ein Problem mit meinem Laptop. Ich habe ihn 2007 gekauft und keine nennenswerten Veränderungen vorgenommen seitdem eine Bekannte ihn mir eingerichtet hat.

Am Wochenanfang kam das erste Mal die Meldung, dass der Windows- Befehlsprozessor für einen Vorgang meine Zustimmung braucht. Die Fenster erscheinen nicht auf dem Bildschirm, sondern in der unteren Bildschirmleiste. Wenn man die Fenster wegklickt, was auch im minimierten Zustand funktioniert, dann kommen sie kurze Zeit später wieder und blinken weiter. Bisher habe ich nur drei auf einmal gehabt, habe aber nie länger gewartet, ob noch ein viertes auftaucht. (Edit: Es kommt ein viertes, und sicher auch ein fünftes; die Tabs flackern ab und an, wenn ein neues Fenster in der unteren Bildschirmleiste auftaucht).

Die Meldungen des Windows- Befehlsprozessors treten unabhängig von der Nutzung des Browsers auf. Wenn ich aber aktiv im Internet bin, scheinen sie sich schneller "zu vermehren"

Zusätzlich öffnen sich auch Firefox- Fenster im Hintergrund mit irgendwelcher Werbung. Es öffnen sich aber keine neuen Tabs mit Werbung.

Ich hoffe, ich kann hier Hilfe bekommen, obwohl mein Laptop nicht mehr der Neueste ist.
Das Betriebssystem ist Windows Vista.

Liebe Grüße Pebbels

Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!

Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Hallo cosinus,

Vielen Dank für die schnelle Antwort! Ich bin leider gar nicht versiert was die Internetsicherheit betrifft, ich habe nicht mal groß Ahnung, wie mein Virenprogramm heißt, ich weiß nur, dass ich eins hab.

Ich habe jetzt nur das von Dir gewünschte Programm (ist doch ein Programm?) runtergeladen, es nach Anleitung "laufen" lassen und jetzt folgende Ergebnisse:

FRST Editor

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014

Ran by Christina (administrator) on UNI-PC on 19-12-2014 14:37:37

Running from c:\Users\Christina\Downloads

Loaded Profile: Christina (Available profiles: Christina)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Agere Systems) C:\Windows\System32\agrsmsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

() C:\Program Files\ICQ6Toolbar\ICQ Service.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe

(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Smartbar) C:\Users\Christina\AppData\Local\Smartbar\Application\Linkury.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe

(Microsoft Corporation) C:\Windows\System32\conime.exe

(Microsoft Corporation) C:\Windows\System32\wercon.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)

HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)

HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Browser Infrastructure Helper] => C:\Users\Christina\AppData\Local\Smartbar\Application\Linkury.exe [20248 2013-03-04] (Smartbar)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30524520 2014-11-27] (Skype Technologies S.A.)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [cmd] => C:\Users\Christina\AppData\Local\Temp\Shuka\PackerV2.exe [5165056 2014-12-14] (Packer Framework) <===== ATTENTION

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk

ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Prev Search Bar = hxxp://google.icq.com/search/search_frame.php

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=hp&babsrc=lnkry_nt

URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.

URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)

SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}

SearchScopes: HKLM -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> DefaultScope {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=102&apn_dtid=BND102&apn_ptnrs=AG7&o=APN10646&apn_uid=1683333715324387&q={searchTerms}

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> {9EFE9CA0-6ABE-44DD-9C91-4B5EBB8FA2A1} URL = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

BHO: No Name -> {0124123D-61B4-456f-AF86-78C53A0790C5} ->  No File

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: XTTBPos00 Class -> {055FD26D-3A88-4e15-963D-DC8493744B1D} -> C:\Program Files\ICQToolbar\toolbaru.dll (IE Toolbar)

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Linkury SmartbarEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} -  No File

Toolbar: HKLM - Linkury Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Toolbar: HKLM - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)

Toolbar: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default

FF NewTab: hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=nt&babsrc=lnkry_nt

FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF SearchEngineOrder.3: Bing 

FF SelectedSearchEngine: ICQ Search

FF Homepage: hxxp://start.icq.com/

FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\bingp.xml

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.gif

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.src

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.xml

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Search_Results.xml

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Web Search.xml

FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\helperbar@helperbar.com [2013-03-04]

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]

FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]

FF Extension: ICQ Toolbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2014-11-18]

FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext

FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]

FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]

R2 ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [247608 2010-11-21] ()

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)

R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)

S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-19 14:37 - 2014-12-19 14:38 - 00019200 _____ () C:\Users\Christina\Downloads\FRST.txt

2014-12-19 14:37 - 2014-12-19 14:37 - 00000000 ____D () C:\FRST

2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe

2014-12-16 20:59 - 2014-12-19 14:24 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService

2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-03 05:42 - 2014-12-03 05:42 - 00002489 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ___RD () C:\Program Files\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe

2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe

2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java

2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java

2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk

2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels

2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe

2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe

2014-11-21 22:27 - 2014-11-22 10:46 - 00000000 ____D () C:\ProgramData\Oracle

2014-11-21 22:24 - 2014-11-21 22:24 - 00638888 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jxpiinstall.exe

2014-11-20 19:26 - 2014-12-06 14:40 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-19 14:34 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-19 14:29 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job

2014-12-19 14:28 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job

2014-12-19 14:24 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-19 14:19 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-19 14:17 - 2007-09-16 05:00 - 01473615 _____ () C:\Windows\WindowsUpdate.log

2014-12-19 14:13 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-19 14:13 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-19 14:13 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-19 07:22 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat

2014-12-19 07:22 - 2006-11-02 14:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-12-19 07:13 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat

2014-12-18 13:49 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-16 20:42 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype

2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-12-03 05:42 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype

2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log

2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches

2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-11-19 20:14 - 2014-11-18 20:29 - 00000000 ____D () C:\Program Files\ICQ7.5
 

Files to move or delete:

====================

C:\Users\Christina\AppData\Local\Temp\Shuka\PackerV2.exe

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Christina\AppData\Local\Temp\AskSLib.dll

C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE

C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL

C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe

C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe

C:\Users\Christina\AppData\Local\Temp\installhelper.dll

C:\Users\Christina\AppData\Local\Temp\JavaRa.exe

C:\Users\Christina\AppData\Local\Temp\jli.dll

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe

C:\Users\Christina\AppData\Local\Temp\keytool.exe

C:\Users\Christina\AppData\Local\Temp\Kraus.exe

C:\Users\Christina\AppData\Local\Temp\msvcr100.dll

C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Christina\AppData\Local\Temp\node.exe

C:\Users\Christina\AppData\Local\Temp\propsys.dll

C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Christina\AppData\Local\Temp\sqlite3.exe

C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll

C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe

C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-19 14:28
 

==================== End Of Log ============================

--- --- ---

FRST Addition Editor

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014

Ran by Christina at 2014-12-19 14:39:17

Running from c:\Users\Christina\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

2007 Microsoft Office system (HKLM\...\PROHYBRIDR) (Version: 12.0.6425.1000 - Microsoft Corporation)

7-Zip 4.65 (HKLM\...\7-Zip) (Version:  - )

AC3Filter 1.63b (HKLM\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)

Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Reader 9 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)

Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version:  - Agere Systems)

Atheros WLAN Client (HKLM\...\{04983D37-2202-4295-94A2-8B547C66133F}) (Version: 1.00.000 - )

ATI Catalyst Install Manager (HKLM\...\{1ABD9408-C1DC-EF1F-40E8-2D9A6531CDA3}) (Version: 3.0.624.0 - ATI Technologies, Inc.)

AVStation Now (HKLM\...\InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}) (Version: 4.0.10.6 - Ihr Firmenname)

AVStation Now (Version: 4.0.10.6 - Ihr Firmenname) Hidden

Bass Audio Decoder (remove only) (HKLM\...\Bass Audio Decoder) (Version:  - )

BufferChm (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Business Contact Manager für Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)

Business Contact Manager für Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden

ccc-core-static (Version: 2007.0730.2152.37233 - Ihr Firmenname) Hidden

Content Transfer (HKLM\...\{CFADE4AF-C0CF-4A04-A776-741318F1658F}) (Version: 1.3.0.23190 - Sony Corporation)

CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

D4200 (Version: 90.0.235.000 - Hewlett-Packard) Hidden

D4200_Help (Version: 90.0.235.000 - Hewlett-Packard) Hidden

DC-Bass Source 1.1.1 (HKLM\...\DC-Bass Source) (Version:  - )

DCoder Image Source (remove only) (HKLM\...\DCoder Image Source) (Version:  - )

DeviceDiscovery (Version: 110.0.180.000 - Hewlett-Packard) Hidden

DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

DirectVobSub (remove only) (HKLM\...\DirectVobSub) (Version:  - )

dj_sf_ProductContext (Version: 90.0.235.000 - Hewlett-Packard) Hidden

dj_sf_software (Version: 90.0.235.000 - Hewlett-Packard) Hidden

dj_sf_software_req (Version: 90.0.235.000 - Hewlett-Packard) Hidden

DScaler 5 Mpeg Decoders (HKLM\...\DScaler 5 Mpeg Decoders_is1) (Version:  - )

DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.0.1603 - CyberLink Corporation)

Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.1 - )

Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.0.0.0 - Samsung)

Easy Network Manager 3.0 (HKLM\...\InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}) (Version: 3.0.0.0 - Ihr Firmenname)

Easy Network Manager 3.0 (Version: 3.0.0.0 - Ihr Firmenname) Hidden

Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.0.11 - )

eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)

ffdshow [rev 3124] [2009-11-03] (HKLM\...\ffdshow_is1) (Version: 1.0 - )

FFMPEG Core Files (remove only) (HKLM\...\FFMPEG Core Files) (Version:  - )

Gabest MPEG Splitter (remove only) (HKLM\...\Gabest MPEG Splitter) (Version:  - )

GameSpy Comrade (HKLM\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)

GEAR 32bit Driver Installer (HKLM\...\{E89B484C-B913-49A0-959B-89E836001658}) (Version: 2.005.1 - GEAR Software, Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Haali Media Splitter (HKLM\...\HaaliMkx) (Version:  - )

HP Customer Participation Program 9.0 (HKLM\...\HPExtendedCapabilities) (Version: 9.0 - HP)

HP Deskjet Printer Driver Software 9.0 (HKLM\...\{03E66394-42F0-4745-85F7-0A2F8F35C09F}) (Version: 9.0 - HP)

HP Imaging Device Functions 9.0 (HKLM\...\HP Imaging Device Functions) (Version: 9.0 - HP)

HP Photosmart Essential 2.01 (HKLM\...\HP Photosmart Essential) (Version: 2.01 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 9.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 9.0 - HP)

HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)

HPProductAssistant (Version: 90.0.146.000 - Hewlett-Packard) Hidden

HPSSupply (HKLM\...\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}) (Version: 2.2.0.0000 - Ihr Firmenname)

ICQ Toolbar (HKLM\...\ICQToolbar) (Version: 3.0.0 - ICQ)

ICQ7.5 (HKLM\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)

imagine digital freedom - Samsung (HKLM\...\{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}) (Version: 1.0.2.0 - Samsung Electronics Co., LTD)

Install McAfee (HKLM\...\{6B32EF07-8A23-4824-91BD-B0F24E50E974}) (Version: 1.00.0000 - Samsung Electronics Co., LTD,)

Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

jZip (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\jZip) (Version: 2.0.0.131211 - Bandoo Media Inc) <==== ATTENTION

Linkury Smartbar (HKLM\...\{01CE337E-F88F-437B-A71A-AF527986BE48}) (Version: 1.6.1.909 - Linkury Inc.) <==== ATTENTION

MarketResearch (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB2572067) (HKLM\...\M2572067) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version:  - )

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)

Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)

Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)

Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)

Microsoft SOAP Toolkit 2.0 SP2 (HKLM\...\{36BEAD11-8577-49AD-9250-E06A50AE87B0}) (Version: 623.1 - Microsoft Corporation)

Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)

Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MONOGRAM AMR Splitter/Decoder (remove only) (HKLM\...\MONOGRAM AMR Splitter/Decoder) (Version:  - )

Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Move Networks Player - IE) (Version:  - )

Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)

NWZ-E450 WALKMAN Guide (HKLM\...\{0A6C2811-AD29-473F-8086-F0B401276DEC}) (Version: 2.1.0.17210 - Sony Corporation)

PanoStandAlone (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Play AVStation (HKLM\...\InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}) (Version: 4.1.20.46 - Ihr Firmenname)

Play AVStation (Version: 4.1.20.46 - Ihr Firmenname) Hidden

PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2802.0 - CyberLink Corporation)

PSSWCORE (Version: 2.01.0000 - Hewlett-Packard) Hidden

RealMedia (remove only) (HKLM\...\RealMedia) (Version:  - )

RealPlayer (HKLM\...\RealPlayer 12.0) (Version:  - RealNetworks)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version:  - )

Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.00 - )

Samsung Recovery Solution II (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 2.0 - Samsung)

Samsung Update Plus (HKLM\...\InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}) (Version: 2.0 - Samsung Electronics Co., LTD)

Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD) Hidden

SHOUTcast Source (remove only) (HKLM\...\SHOUTcast Source) (Version:  - )

Skins (Version: 2007.0730.2152.37233 - ATI) Hidden

Skype™ 6.22 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.22.107 - Skype Technologies S.A.)

SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)

Status (Version: 110.0.180.000 - Hewlett-Packard) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.1.22.0 - Synaptics)

Toolbox (Version: 90.0.146.000 - Hewlett-Packard) Hidden

TrayApp (Version: 110.0.180.000 - Hewlett-Packard) Hidden

UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Outlook 2007 Junk Email Filter (KB2596560) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{2964DDE1-4925-4DF1-AF2C-0A36B3442228}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )

VideoToolkit01 (Version: 90.0.146.000 - Hewlett-Packard) Hidden

VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)

WebReg (Version: 90.0.146.000 - Hewlett-Packard) Hidden

WIDCOMM Bluetooth Software 6.0.1.5000 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5000 - WIDCOMM, Inc.)

Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)

Zoom Player (remove only) (HKLM\...\ZoomPlayer) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
 

==================== Restore Points  =========================
 

13-12-2014 12:38:07 Geplanter Prüfpunkt

14-12-2014 19:00:03 Windows-Sicherung

18-12-2014 13:21:14 Geplanter Prüfpunkt
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2006-11-02 11:23 - 2010-09-17 17:07 - 00419366 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {00407FA0-B26A-4D78-BAE4-DCED18CE0BBD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)

Task: {2E73D919-5704-48F5-BD45-2DA050634DD6} - System32\Tasks\advSRSII => C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe [2007-04-04] ()

Task: {36CC60E7-F073-45B7-92D3-2D0FCA4284BD} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2007-04-26] (Samsung Electronics Co., Ltd.)

Task: {4A0BA790-7E2E-41C2-9630-365ED6C19CE8} - System32\Tasks\{F8403358-9DFC-48DD-9814-C3C5B64B5224} => C:\Program Files\Skype\Phone\Skype.exe [2014-11-27] (Skype Technologies S.A.)

Task: {75A56371-2508-45D0-B522-4FFA66030227} - System32\Tasks\SupBackGroundTask => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe [2010-04-20] ()

Task: {80AF346F-AA8E-4BBC-8A2E-87C003976B06} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2007-06-01] (SAMSUNG Electronics)

Task: {9DBC4E1A-1A47-4365-985F-7EE43499F7AB} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2007-06-29] (SAMSUNG Electronics co., LTD.)

Task: {A2905CD7-15D6-4F90-9726-C98606071C61} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)

Task: {AB3D9F35-AFB4-48F0-83D2-09826838A45F} - System32\Tasks\{D36EF826-E004-4D3A-8C17-E5566C882B0D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124.259/en/abandoninstall?page=tsPlugin&amp;installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled

Task: {B57FF0ED-4252-4D91-9B7C-6BDEB436AC3C} - System32\Tasks\{2EBAA3D6-013C-4628-BBCC-CA3BCB57800C} => pcalua.exe -a "C:\Users\Christina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0MADX4B0\miranda-im-v0.7.10-unicode[1].exe" -d "C:\Users\Christina\AppData\Roaming\ICQ Toolbar"

Task: {B8A0DA75-CD83-48CB-9EBA-7F9AE7FC2FAB} - System32\Tasks\{EA6DECD8-58E9-4AE1-A135-2AE6697E86F7} => C:\Program Files\Skype\Phone\Skype.exe [2014-11-27] (Skype Technologies S.A.)

Task: {C954C976-60FD-4FB5-95E6-628BF7CDBE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)

Task: {E1EDABFD-F216-4F52-9A90-0759D4836240} - System32\Tasks\{2E3842F9-8974-4CD3-8E95-B5376AF0C567} => pcalua.exe -a "C:\Program Files\OpenSource Flash Video Splitter\uninstall.exe"

Task: {E90E0C26-3D38-4B64-893D-954ADAFB7503} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2007-04-24] (Samsung Electronics Co., Ltd.)
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\SupBackGroundTask.job => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Loaded Modules (whitelisted) =============
 

2008-11-02 22:38 - 2010-11-21 11:49 - 00247608 _____ () C:\Program Files\ICQ6Toolbar\ICQ Service.exe

2014-10-27 16:04 - 2014-10-27 16:04 - 00028160 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe

2007-08-07 23:39 - 2007-01-08 14:39 - 00171040 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe

2014-12-01 17:01 - 2014-12-01 17:01 - 00974848 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe

2014-12-01 17:01 - 2014-12-01 17:01 - 01686016 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMHost.dll

2014-12-01 17:01 - 2014-12-01 17:01 - 02745856 _____ () C:\Users\Christina\AppData\Local\RGMService\MonetizationToolsManager.dll

2014-12-01 17:02 - 2014-12-01 17:02 - 01592832 _____ () C:\Users\Christina\AppData\Local\RGMService\ProtectorsManager.dll

2007-08-08 00:17 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll

2007-08-07 06:06 - 2007-08-07 01:31 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll

2007-08-07 23:51 - 2007-04-04 06:10 - 01379328 _____ () C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe

2007-08-07 23:50 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll

2007-08-07 23:50 - 2006-09-19 01:52 - 00028672 _____ () C:\Program Files\Samsung\Easy Display Manager\WinMove.dll

2007-08-07 23:54 - 2007-02-23 10:32 - 00065536 _____ () C:\Program Files\Samsung\EBM\ChkSec.dll

2007-08-07 23:55 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00029464 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Core.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00044312 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00018712 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Utilities.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00069400 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 01629976 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.MainClient.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00078104 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Personalization.BusinessLogic.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00012568 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.EventManager.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00659224 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00081176 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00013592 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.BusinessEntities.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00016152 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Personalization.Common.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00019736 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00019736 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00057112 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00014104 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.GUI.Multimedia.Loader.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00050968 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00013592 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll

2013-03-04 09:33 - 2013-03-04 09:33 - 00047384 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\MACTrackBarLib.dll

2013-03-04 09:32 - 2013-03-04 09:32 - 00025368 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\de\Smartbar.Resources.LanguageSettings.resources.dll

2013-03-04 09:34 - 2013-03-04 09:34 - 00025368 _____ () C:\Users\Christina\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll

2007-04-24 10:32 - 2007-04-24 10:32 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL

2014-12-09 20:02 - 2014-12-09 20:03 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2014-12-09 20:34 - 2014-12-09 20:34 - 16841392 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\View Baldur's Gate: Tales of The Sword Coast Readme.lnk
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^G DATA Firewall Tray.lnk => C:\Windows\pss\G DATA Firewall Tray.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe => C:\Windows\pss\PowerReg Scheduler V3.exe.Startup

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: AVKTray => "C:\Program Files\G DATA TotalCare\AVKTray\AVKTray.exe"

MSCONFIG\startupreg: GDFirewallTray => C:\Program Files\G DATA TotalCare\Firewall\GDFirewallTray.exe

MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

MSCONFIG\startupreg: LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

MSCONFIG\startupreg: RemoteControl => "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: TkBellExe => "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-3116156678-3848323971-3931140469-500 - Administrator - Disabled)

ASPNET (S-1-5-21-3116156678-3848323971-3931140469-1005 - Limited - Enabled)

Christina (S-1-5-21-3116156678-3848323971-3931140469-1003 - Administrator - Enabled) => C:\Users\Christina

Gast (S-1-5-21-3116156678-3848323971-3931140469-501 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/18/2014 01:05:42 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:42 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:24 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:24 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:17 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:17 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:10 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/18/2014 01:05:10 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/17/2014 08:53:32 PM) (Source: EventSystem) (EventID: 4621) (User: )

Description: 80070005EventSystem.EventSubscription{CEB8B221-89C5-41A8-98CE-79B413BF150B}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}
 

Error: (12/16/2014 06:06:40 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 
 

System errors:

=============

Error: (12/19/2014 02:15:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/19/2014 02:15:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (12/19/2014 02:13:24 PM) (Source: atikmdag) (EventID: 10266) (User: )

Description: Unknown EDID version
 

Error: (12/19/2014 07:22:36 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 

Error: (12/19/2014 07:12:45 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/19/2014 07:12:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (12/19/2014 07:11:01 AM) (Source: atikmdag) (EventID: 10266) (User: )

Description: Unknown EDID version
 

Error: (12/18/2014 02:14:49 PM) (Source: DCOM) (EventID: 10010) (User: )

Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 

Error: (12/18/2014 00:39:53 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/18/2014 00:39:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 
 

Microsoft Office Sessions:

=========================

Error: (08/03/2009 11:53:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 353 seconds with 60 seconds of active time.  This session ended with a crash.
 

Error: (09/21/2008 00:37:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2402 seconds with 300 seconds of active time.  This session ended with a crash.
 

Error: (09/18/2008 10:22:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 114 seconds with 60 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2011-10-23 21:12:16.785

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-10-23 21:12:16.558

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-04 19:42:55.860

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-04 19:42:55.537

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 19:42:30.523

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 19:42:30.302

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 18:22:01.281

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 18:22:00.829

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-04-28 23:05:49.918

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-04-28 23:05:49.705

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz

Percentage of memory in use: 60%

Total physical RAM: 2045.45 MB

Available physical RAM: 812.09 MB

Total Pagefile: 4340.18 MB

Available Pagefile: 2883.11 MB

Total Virtual: 2047.88 MB

Available Virtual: 1886.96 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:69.05 GB) (Free:10.54 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: () (Fixed) (Total:70 GB) (Free:5.95 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 149.1 GB) (Disk ID: 69F484A5)

Partition 1: (Not Active) - (Size=10 GB) - (Type=27)

Partition 2: (Active) - (Size=69 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Gruß
Pebbels

Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hallo

Adw Cleaner

Code:

# AdwCleaner v4.105 - Bericht erstellt am 20/12/2014 um 10:08:16

# Aktualisiert 08/12/2014 von Xplode

# Database : 2014-12-16.1 [Live]

# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)

# Benutzername : Christina - UNI-PC

# Gestartet von : c:\Users\Christina\Downloads\AdwCleaner_4.105.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

Dienst Gelöscht : ICQ Service
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Browser Manager

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\Program Files\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files\icqtoolbar

Ordner Gelöscht : C:\Program Files\jZip

Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\jZip

Ordner Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Smartbar

Ordner Gelöscht : C:\Users\Christina\AppData\Local\jZip

Ordner Gelöscht : C:\Users\Christina\AppData\Local\Smartbar

Ordner Gelöscht : C:\Users\Christina\AppData\LocalLow\HPAppData

Ordner Gelöscht : C:\Users\Christina\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\HPAppData

Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{800B5000-A755-47E1-992B-48A1C1357F07}

Ordner Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\helperbar@helperbar.com

Datei Gelöscht : C:\Users\CHRIST~1\AppData\Local\Temp\Searchqu.ini

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\jZip.lnk

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\jZip.lnk

Datei Gelöscht : C:\Users\Christina\Desktop\jZip.lnk

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\bingp.xml

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.gif

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.src

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icqplugin.xml

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Search_Results.xml

Datei Gelöscht : C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\Web Search.xml
 

***** [ Tasks ] *****
 
 

***** [ Verknüpfungen ] *****
 

Verknüpfung Desinfiziert : C:\Users\Christina\Desktop\Search.lnk
 

***** [ Registrierungsdatenbank ] *****
 

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [Browser Infrastructure Helper]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\jZip.file

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppPath\jZip.exe

Wert Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [cmd]

Schlüssel Gelöscht : HKCU\Software\XTTB00001

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.XTTBPos00

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ToolBand.XTTBPos00.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.IEToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.IEToolbar.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.XTTB00001

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\XTTB00001.XTTB00001.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{055FD26D-3A88-4E15-963D-DC8493744B1D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4BD2D6C3-31DC-B947-23D0-DC52EC4F0C4C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4E15-963D-DC8493744B1D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9D717F81-9148-4F12-8568-69135F087DB0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7ABE12CA-E995-4AB4-9A4E-EF8820A20182}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9EFE9CA0-6ABE-44DD-9C91-4B5EBB8FA2A1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}

Schlüssel Gelöscht : HKCU\Software\Ask.com.tmp

Schlüssel Gelöscht : HKCU\Software\DataMngr

Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar

Schlüssel Gelöscht : HKCU\Software\ICQ\ICQToolbar

Schlüssel Gelöscht : HKCU\Software\ICQToolbar

Schlüssel Gelöscht : HKCU\Software\jZip

Schlüssel Gelöscht : HKCU\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\smartbarbackup

Schlüssel Gelöscht : HKCU\Software\smartbarlog

Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\jZip

Schlüssel Gelöscht : HKLM\SOFTWARE\SearchquSRTB

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\jZip

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ICQToolbar

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\jZip

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
 

***** [ Browser ] *****
 

-\\ Internet Explorer v8.0.6001.19154
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Prev Search Bar]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Secondary Start Pages]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v34.0.5 (x86 de)
 

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=65e0b4f7-fd95-48b0-b862-6b6f933b5484&affid=111583&searchtype=nt&babsrc=lnkry_nt");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.startup.homepage", "hxxp://start.icq.com/");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledAddons", "helperbar%40helperbar.com:1.1,%7B65e0b4f7-fd95-48b0-b862-6b6f933b5484%7D:1.1,%7B800b5000-a755-47e1-992b-48a1c1357f07%7D:1.1.9,%7B972ce4c6-7e08-4474-a285-3208198c[...]

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.enabledItems", "{65e0b4f7-fd95-48b0-b862-6b6f933b5484}:1.0,helperbar@helperbar.com:1.0,{800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.4,{ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0,{[...]

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.Country", "Germany");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.LastHiddenTime", 23118993);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarDisabled", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.SmartbarStateMinimaized", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.UserID", "65e0b4f7-fd95-48b0-b862-6b6f933b5484");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.allowSendURL", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.engineVerified", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.geolastmodified", 1418764248);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.hiddenElements", "itb_options");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.history", "bronchitisfjodreknuddelsdeutsche%20schauspielerBollenhutleotoby%20stephensmylanguageexchangetrojanerboardfledermaus%20etymologiegmxyoutubewindo[...]

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.icqgeo", 49);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installTime", "1416424602");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.installsource", "1");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.itbsitescount", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.newtab_state", "1");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.numberOfSearches", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.previousFFVersion", "34.0.5");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.removedsitescount", 469);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.skip_default_search", "no");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.suggestions", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.uniqueID", "119806246411980624541223585139729");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.usageStatstTimestamp", 1419059698);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.version", "1.1.9");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherHideClicks", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherMoreLinkClicks", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherRedeemClicks", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.voucherWasShown", 0);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlEnableSuggestions", false);

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("icqtoolbar.xmlLanguage", "de");

[wtnu05y1.default\prefs.js] - Zeile gelöscht : user_pref("keyword.URL", "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=");
 

*************************
 

AdwCleaner[R0].txt - [16507 octets] - [20/12/2014 10:04:56]

AdwCleaner[S0].txt - [15608 octets] - [20/12/2014 10:08:16]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15669 octets] ##########

JRT

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.4.0 (11.29.2014:1)

OS: Windows Vista (TM) Home Premium x86

Ran by Christina on 20.12.2014 at 10:16:01,32

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key - Orphan] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0124123D-61B4-456f-AF86-78C53A0790C5}

Successfully deleted: [Registry Key - Orphan] HKEY_CLASSES_ROOT\CLSID\{0124123D-61B4-456f-AF86-78C53A0790C5}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\prefetch\APNSTUB.EXE-D8A941F0.pf

Successfully deleted: [File] "C:\Windows\wininit.ini"
 
 
 

~~~ Folders
 
 
 

~~~ FireFox
 

Emptied folder: C:\Users\Christina\AppData\Roaming\mozilla\firefox\profiles\wtnu05y1.default\minidumps [19 files]
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 20.12.2014 at 10:19:37,66

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014

Ran by Christina (administrator) on UNI-PC on 20-12-2014 10:23:06

Running from c:\Users\Christina\Downloads

Loaded Profile: Christina (Available profiles: Christina)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Agere Systems) C:\Windows\System32\agrsmsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Microsoft Corporation) C:\Windows\System32\msiexec.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Microsoft Corporation) C:\Windows\System32\conime.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)

HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)

HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [258512 2011-10-11] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk

ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.

URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} -  No File

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default

FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF SearchEngineOrder.3: Bing 

FF SelectedSearchEngine: ICQ Search

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]

FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]

FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext

FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]

FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86224 2011-10-11] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110032 2011-10-11] (Avira Operations GmbH & Co. KG)

R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)

R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [74640 2011-10-11] (Avira GmbH)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [134344 2011-10-11] (Avira GmbH)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [36000 2011-10-11] (Avira GmbH)

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)

S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2010-06-17] (Avira GmbH)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-20 10:19 - 2014-12-20 10:19 - 00001196 _____ () C:\Users\Christina\Desktop\JRT.txt

2014-12-20 10:15 - 2014-12-20 10:15 - 00000000 ____D () C:\Windows\ERUNT

2014-12-20 10:04 - 2014-12-20 10:08 - 00000000 ____D () C:\AdwCleaner

2014-12-20 10:02 - 2014-12-20 10:02 - 00001847 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-12-20 10:02 - 2014-12-20 10:02 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Avira

2014-12-20 10:02 - 2014-12-20 10:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-20 10:02 - 2011-10-11 15:00 - 00134344 _____ (Avira GmbH) C:\Windows\system32\Drivers\avipbb.sys

2014-12-20 10:02 - 2011-10-11 15:00 - 00074640 _____ (Avira GmbH) C:\Windows\system32\Drivers\avgntflt.sys

2014-12-20 10:02 - 2011-10-11 15:00 - 00036000 _____ (Avira GmbH) C:\Windows\system32\Drivers\avkmgr.sys

2014-12-20 10:02 - 2010-06-17 15:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2014-12-20 10:01 - 2014-12-20 10:01 - 00000000 ____D () C:\ProgramData\Avira

2014-12-20 10:01 - 2014-12-20 10:01 - 00000000 ____D () C:\Program Files\Avira

2014-12-20 09:59 - 2014-12-20 09:59 - 01707646 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe

2014-12-20 09:58 - 2014-12-20 09:58 - 02166272 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.105.exe

2014-12-19 14:39 - 2014-12-19 14:40 - 00038808 _____ () C:\Users\Christina\Downloads\Addition.txt

2014-12-19 14:37 - 2014-12-20 10:23 - 00014353 _____ () C:\Users\Christina\Downloads\FRST.txt

2014-12-19 14:37 - 2014-12-20 10:23 - 00000000 ____D () C:\FRST

2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe

2014-12-16 20:59 - 2014-12-20 10:10 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService

2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-03 05:42 - 2014-12-20 10:13 - 00000000 ___RD () C:\Program Files\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00002489 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe

2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe

2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java

2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java

2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk

2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels

2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe

2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe

2014-11-21 22:27 - 2014-11-22 10:46 - 00000000 ____D () C:\ProgramData\Oracle

2014-11-21 22:24 - 2014-11-21 22:24 - 00638888 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jxpiinstall.exe

2014-11-20 19:26 - 2014-12-06 14:40 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-20 10:15 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job

2014-12-20 10:15 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-20 10:13 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype

2014-12-20 10:13 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype

2014-12-20 10:12 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job

2014-12-20 10:10 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-20 10:10 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-20 10:09 - 2007-09-16 05:00 - 01529957 _____ () C:\Windows\WindowsUpdate.log

2014-12-20 10:09 - 2007-08-08 00:59 - 00139694 _____ () C:\Windows\PFRO.log

2014-12-20 10:09 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat

2014-12-20 10:09 - 2006-11-02 14:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-12-20 10:09 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-20 10:09 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-20 10:08 - 2013-03-04 10:20 - 00000846 _____ () C:\Users\Christina\Desktop\Search.lnk

2014-12-20 10:08 - 2008-11-02 22:38 - 00000000 ____D () C:\ProgramData\ICQ

2014-12-20 09:53 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-20 09:53 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-19 17:35 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat

2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log

2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches

2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Christina\AppData\Local\Temp\AskSLib.dll

C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE

C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL

C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe

C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe

C:\Users\Christina\AppData\Local\Temp\installhelper.dll

C:\Users\Christina\AppData\Local\Temp\JavaRa.exe

C:\Users\Christina\AppData\Local\Temp\jli.dll

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe

C:\Users\Christina\AppData\Local\Temp\keytool.exe

C:\Users\Christina\AppData\Local\Temp\Kraus.exe

C:\Users\Christina\AppData\Local\Temp\msvcr100.dll

C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Christina\AppData\Local\Temp\node.exe

C:\Users\Christina\AppData\Local\Temp\propsys.dll

C:\Users\Christina\AppData\Local\Temp\Quarantine.exe

C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Christina\AppData\Local\Temp\sqlite3.dll

C:\Users\Christina\AppData\Local\Temp\sqlite3.exe

C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll

C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe

C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-20 10:17
 

==================== End Of Log ============================

--- --- ---

LG
Pebbels

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

Hier nochmal zwei neue FRST Logs

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-12-2014

Ran by Christina (administrator) on UNI-PC on 22-12-2014 10:43:32

Running from c:\Users\Christina\Downloads

Loaded Profile: Christina (Available profiles: Christina)

Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 8

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Agere Systems) C:\Windows\System32\agrsmsvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe

() C:\Program Files\CyberLink\Shared Files\RichVideo.exe

() C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe

() C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe

(SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe

(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe

(Sony Corporation) C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe

(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe

(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_15_0_0_246.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [90112 2006-11-10] ()

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [857648 2007-03-23] (Synaptics, Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6273568 2008-07-08] (Realtek Semiconductor)

HKLM\...\Run: [ContentTransferWMDetector.exe] => C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exe [583016 2009-11-19] (Sony Corporation)

HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-21] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: E - E:\AutoRun.exe

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\MountPoints2: {82a436b2-c256-11df-ab59-0013773d8e01} - F:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk

ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

URLSearchHook: [S-1-5-21-3116156678-3848323971-3931140469-1003] ATTENTION ==> Default URLSearchHook is missing.

URLSearchHook: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003 -> 09185A9399FA4BAB88517F7A6196CA3E URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox

BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: RealPlayer Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - No Name - {0124123D-61B4-456f-AF86-78C53A0790C5} -  No File

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0018-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_25-windows-i586.cab

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
 

FireFox:

========

FF ProfilePath: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default

FF DefaultSearchUrl: hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF SearchEngineOrder.3: Bing 

FF SelectedSearchEngine: ICQ Search

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll ()

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprjplug;version=1.0.3.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF SearchPlugin: C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\searchplugins\icq-search.xml

FF Extension: Avira Browser Safety - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\abs@avira.com [2014-12-21]

FF Extension: Microsoft .NET Framework Assistant - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-09-19]

FF Extension: Linkury Smartbar - C:\Users\Christina\AppData\Roaming\Mozilla\Firefox\Profiles\wtnu05y1.default\Extensions\{65e0b4f7-fd95-48b0-b862-6b6f933b5484} [2013-02-28]

FF Extension: Google Toolbar for Firefox - C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2014-12-09]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-15]

FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext

FF Extension: RealPlayer Browser Record Plugin - C:\Program Files\Real\RealPlayer\browserrecord\firefox\ext [2010-02-06]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-02-18]

FF HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path

CHR HKLM\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - No Path
 

========================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [431920 2014-12-21] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-21] (Avira Operations GmbH & Co. KG)

R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)

R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2008-03-25] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [135168 2008-03-25] (Hewlett-Packard Co.) [File not signed]

S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [File not signed]

S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)

R2 RGMUpdater; C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe [28160 2014-10-27] () [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [171040 2007-01-08] () [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98160 2014-12-21] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-12-21] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2014-12-21] (Avira Operations GmbH & Co. KG)

R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-08-07] (SAMSUNG ELECTRONICS CO., LTD.)

S3 NETw2v32; C:\Windows\System32\DRIVERS\NETw2v32.sys [2589184 2006-11-02] (Intel® Corporation)

R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2014-12-21] (Avira GmbH)

S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-21 10:55 - 2014-12-21 10:55 - 00001002 _____ () C:\Users\Public\Desktop\Avira.lnk

2014-12-21 10:48 - 2014-12-21 10:55 - 00000000 ____D () C:\ProgramData\Package Cache

2014-12-21 10:47 - 2014-12-21 10:47 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Avira

2014-12-21 10:46 - 2014-12-21 10:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira

2014-12-21 10:46 - 2014-12-21 10:46 - 00001847 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk

2014-12-21 10:45 - 2014-12-21 10:55 - 00000000 ____D () C:\Program Files\Avira

2014-12-21 10:45 - 2014-12-21 10:48 - 00000000 ____D () C:\ProgramData\Avira

2014-12-21 10:45 - 2014-12-21 10:31 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys

2014-12-21 10:45 - 2014-12-21 10:31 - 00098160 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

2014-12-21 10:45 - 2014-12-21 10:31 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys

2014-12-21 10:45 - 2014-12-21 10:31 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

2014-12-20 10:19 - 2014-12-20 10:19 - 00001196 _____ () C:\Users\Christina\Desktop\JRT.txt

2014-12-20 10:15 - 2014-12-20 10:15 - 00000000 ____D () C:\Windows\ERUNT

2014-12-20 10:04 - 2014-12-20 10:08 - 00000000 ____D () C:\AdwCleaner

2014-12-20 09:59 - 2014-12-20 09:59 - 01707646 _____ (Thisisu) C:\Users\Christina\Downloads\JRT.exe

2014-12-20 09:58 - 2014-12-20 09:58 - 02166272 _____ () C:\Users\Christina\Downloads\AdwCleaner_4.105.exe

2014-12-19 14:39 - 2014-12-19 14:40 - 00038808 _____ () C:\Users\Christina\Downloads\Addition.txt

2014-12-19 14:37 - 2014-12-22 10:45 - 00015180 _____ () C:\Users\Christina\Downloads\FRST.txt

2014-12-19 14:37 - 2014-12-22 10:43 - 00000000 ____D () C:\FRST

2014-12-19 14:36 - 2014-12-19 14:36 - 01113600 _____ (Farbar) C:\Users\Christina\Downloads\FRST.exe

2014-12-16 20:59 - 2014-12-22 10:35 - 00000000 ____D () C:\Users\Christina\AppData\Local\RGMService

2014-12-09 20:02 - 2014-12-09 20:03 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2014-12-03 05:42 - 2014-12-20 10:28 - 00002379 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-12-03 05:42 - 2014-12-20 10:13 - 00000000 ___RD () C:\Program Files\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype

2014-12-03 05:42 - 2014-12-03 05:42 - 00000000 ____D () C:\Program Files\Common Files\Skype

2014-11-22 11:13 - 2014-11-22 11:15 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(2).exe

2014-11-22 11:13 - 2014-11-22 11:14 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater(1).exe

2014-11-22 11:11 - 2014-11-22 11:11 - 00000000 ____D () C:\Program Files\Common Files\Java

2014-11-22 11:10 - 2014-11-22 11:09 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll

2014-11-22 11:09 - 2014-11-22 11:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-11-22 11:05 - 2014-11-22 11:05 - 00000000 ____D () C:\Program Files\Java

2014-11-22 10:56 - 2014-11-22 11:11 - 00001282 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Knuddels.de.lnk

2014-11-22 10:56 - 2014-11-22 10:56 - 00000000 ____D () C:\Program Files\Knuddels

2014-11-22 10:47 - 2014-11-22 10:48 - 75085992 _____ () C:\Users\Christina\Downloads\KnuddelsJavaUpdater.exe

2014-11-22 10:41 - 2014-11-22 10:41 - 29458856 _____ (Oracle Corporation) C:\Users\Christina\Downloads\jre-7u71-windows-i586.exe
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-12-22 10:44 - 2010-09-15 18:20 - 00000000 ____D () C:\Users\Christina\AppData\Roaming\Skype

2014-12-22 10:40 - 2008-10-16 12:47 - 00000416 ____H () C:\Windows\Tasks\SupBackGroundTask.job

2014-12-22 10:39 - 2007-09-16 05:00 - 01685578 _____ () C:\Windows\WindowsUpdate.log

2014-12-22 10:35 - 2010-02-09 09:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-12-22 10:34 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-12-22 10:34 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-12-22 10:34 - 2006-11-02 13:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-12-22 09:06 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-12-22 09:05 - 2007-08-07 23:21 - 00000012 _____ () C:\Windows\bthservsdp.dat

2014-12-22 08:53 - 2006-11-02 11:33 - 01703052 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-12-22 08:49 - 2010-02-09 09:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-12-22 06:03 - 2012-09-08 10:15 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-12-21 19:52 - 2008-12-25 11:21 - 00000426 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job

2014-12-21 19:46 - 2007-08-08 00:59 - 00142786 _____ () C:\Windows\PFRO.log

2014-12-20 10:13 - 2007-12-21 14:01 - 00000000 ____D () C:\ProgramData\Skype

2014-12-20 10:08 - 2013-03-04 10:20 - 00000846 _____ () C:\Users\Christina\Desktop\Search.lnk

2014-12-20 10:08 - 2008-11-02 22:38 - 00000000 ____D () C:\ProgramData\ICQ

2014-12-19 17:35 - 2009-07-03 23:55 - 00001356 _____ () C:\Users\Christina\AppData\Local\d3d9caps.dat

2014-12-10 18:10 - 2013-03-02 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2014-12-09 20:34 - 2012-09-08 10:15 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2014-12-09 20:34 - 2011-06-03 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2014-12-06 14:40 - 2014-11-20 19:26 - 00000000 ____D () C:\Users\Christina\Desktop\PiA Ausbildung

2014-11-30 22:39 - 2006-11-02 13:52 - 00082069 _____ () C:\Windows\setupact.log

2014-11-25 15:13 - 2007-11-20 21:30 - 00000000 ____D () C:\Users\Christina\Documents\Persönliches

2014-11-22 21:08 - 2006-11-02 13:37 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-11-22 10:46 - 2014-11-21 22:27 - 00000000 ____D () C:\ProgramData\Oracle
 

Files to move or delete:

====================

C:\ProgramData\ezsid.dat
 
 

Some content of TEMP:

====================

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\Users\Christina\AppData\Local\Temp\AskSLib.dll

C:\Users\Christina\AppData\Local\Temp\avgnt.exe

C:\Users\Christina\AppData\Local\Temp\BundleSweetIMSetup.exe

C:\Users\Christina\AppData\Local\Temp\EBU337E.EXE

C:\Users\Christina\AppData\Local\Temp\EBU3561.DLL

C:\Users\Christina\AppData\Local\Temp\FreemakeVideoConverter_3.1.1.4.exe

C:\Users\Christina\AppData\Local\Temp\IcqUpdater.exe

C:\Users\Christina\AppData\Local\Temp\installhelper.dll

C:\Users\Christina\AppData\Local\Temp\JavaRa.exe

C:\Users\Christina\AppData\Local\Temp\jli.dll

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-i586.exe

C:\Users\Christina\AppData\Local\Temp\jre-8u25-windows-x64.exe

C:\Users\Christina\AppData\Local\Temp\keytool.exe

C:\Users\Christina\AppData\Local\Temp\Kraus.exe

C:\Users\Christina\AppData\Local\Temp\msvcr100.dll

C:\Users\Christina\AppData\Local\Temp\MybabylonTB.exe

C:\Users\Christina\AppData\Local\Temp\node.exe

C:\Users\Christina\AppData\Local\Temp\propsys.dll

C:\Users\Christina\AppData\Local\Temp\Quarantine.exe

C:\Users\Christina\AppData\Local\Temp\SkypeSetup.exe

C:\Users\Christina\AppData\Local\Temp\sqlite3.dll

C:\Users\Christina\AppData\Local\Temp\sqlite3.exe

C:\Users\Christina\AppData\Local\Temp\SRAssetsHelper.dll

C:\Users\Christina\AppData\Local\Temp\ubi648D.tmp.exe

C:\Users\Christina\AppData\Local\Temp\{46258CAA-68AB-46A8-A1E8-6CB453B26174}-GoogleUpdateSetup.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-12-22 10:47
 

==================== End Of Log ============================

--- --- ---

und

Code:

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 17-12-2014

Ran by Christina at 2014-12-22 10:46:17

Running from c:\Users\Christina\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}

AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

2007 Microsoft Office system (HKLM\...\PROHYBRIDR) (Version: 12.0.6425.1000 - Microsoft Corporation)

7-Zip 4.65 (HKLM\...\7-Zip) (Version:  - )

AC3Filter 1.63b (HKLM\...\AC3Filter_is1) (Version: 1.63b - Alexander Vigovsky)

Activation Assistant for the 2007 Microsoft Office suites (HKLM\...\Activation Assistant for the 2007 Microsoft Office suites) (Version:  - Microsoft Corporation)

Activation Assistant for the 2007 Microsoft Office suites (Version: 1.0 - Microsoft Corporation) Hidden

Adobe Flash Player 15 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Flash Player 15 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 15.0.0.246 - Adobe Systems Incorporated)

Adobe Reader 9 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)

Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version:  - Agere Systems)

Atheros WLAN Client (HKLM\...\{04983D37-2202-4295-94A2-8B547C66133F}) (Version: 1.00.000 - )

ATI Catalyst Install Manager (HKLM\...\{1ABD9408-C1DC-EF1F-40E8-2D9A6531CDA3}) (Version: 3.0.624.0 - ATI Technologies, Inc.)

Avira (HKLM\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)

Avira (Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden

Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)

AVStation Now (HKLM\...\InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}) (Version: 4.0.10.6 - Ihr Firmenname)

AVStation Now (Version: 4.0.10.6 - Ihr Firmenname) Hidden

Bass Audio Decoder (remove only) (HKLM\...\Bass Audio Decoder) (Version:  - )

BufferChm (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Business Contact Manager für Outlook 2007 SP2 (HKLM\...\Business Contact Manager) (Version: 3.0.8619.1 - Microsoft Corporation)

Business Contact Manager für Outlook 2007 SP2 (Version: 3.0.8619.1 - Microsoft Corporation) Hidden

ccc-core-static (Version: 2007.0730.2152.37233 - Ihr Firmenname) Hidden

Content Transfer (HKLM\...\{CFADE4AF-C0CF-4A04-A776-741318F1658F}) (Version: 1.3.0.23190 - Sony Corporation)

CustomerResearchQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

D4200 (Version: 90.0.235.000 - Hewlett-Packard) Hidden

D4200_Help (Version: 90.0.235.000 - Hewlett-Packard) Hidden

DC-Bass Source 1.1.1 (HKLM\...\DC-Bass Source) (Version:  - )

DCoder Image Source (remove only) (HKLM\...\DCoder Image Source) (Version:  - )

DeviceDiscovery (Version: 110.0.180.000 - Hewlett-Packard) Hidden

DeviceManagementQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

DirectVobSub (remove only) (HKLM\...\DirectVobSub) (Version:  - )

dj_sf_ProductContext (Version: 90.0.235.000 - Hewlett-Packard) Hidden

dj_sf_software (Version: 90.0.235.000 - Hewlett-Packard) Hidden

dj_sf_software_req (Version: 90.0.235.000 - Hewlett-Packard) Hidden

DScaler 5 Mpeg Decoders (HKLM\...\DScaler 5 Mpeg Decoders_is1) (Version:  - )

DVD Suite (HKLM\...\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 5.0.1603 - CyberLink Corporation)

Easy Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 3.2.1.1 - )

Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.0.0.0 - Samsung)

Easy Network Manager 3.0 (HKLM\...\InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}) (Version: 3.0.0.0 - Ihr Firmenname)

Easy Network Manager 3.0 (Version: 3.0.0.0 - Ihr Firmenname) Hidden

Easy SpeedUp Manager (HKLM\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.0.0.11 - )

eSupportQFolder (Version: 1.00.0000 - Hewlett-Packard) Hidden

EVEREST Home Edition v2.20 (HKLM\...\EVEREST Home Edition_is1) (Version: 2.20 - Lavalys Inc)

ffdshow [rev 3124] [2009-11-03] (HKLM\...\ffdshow_is1) (Version: 1.0 - )

FFMPEG Core Files (remove only) (HKLM\...\FFMPEG Core Files) (Version:  - )

Gabest MPEG Splitter (remove only) (HKLM\...\Gabest MPEG Splitter) (Version:  - )

GameSpy Comrade (HKLM\...\{176B3593-72F1-459C-829C-5E9671E2CB35}) (Version: 1.4.3.154 - GameSpy)

GEAR 32bit Driver Installer (HKLM\...\{E89B484C-B913-49A0-959B-89E836001658}) (Version: 2.005.1 - GEAR Software, Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Haali Media Splitter (HKLM\...\HaaliMkx) (Version:  - )

HP Customer Participation Program 9.0 (HKLM\...\HPExtendedCapabilities) (Version: 9.0 - HP)

HP Deskjet Printer Driver Software 9.0 (HKLM\...\{03E66394-42F0-4745-85F7-0A2F8F35C09F}) (Version: 9.0 - HP)

HP Imaging Device Functions 9.0 (HKLM\...\HP Imaging Device Functions) (Version: 9.0 - HP)

HP Photosmart Essential 2.01 (HKLM\...\HP Photosmart Essential) (Version: 2.01 - HP)

HP Smart Web Printing 4.60 (HKLM\...\HP Smart Web Printing) (Version: 4.60 - HP)

HP Solution Center 9.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 9.0 - HP)

HP Update (HKLM\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)

HPProductAssistant (Version: 90.0.146.000 - Hewlett-Packard) Hidden

HPSSupply (HKLM\...\{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}) (Version: 2.2.0.0000 - Ihr Firmenname)

ICQ7.5 (HKLM\...\{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}) (Version: 7.5 - ICQ)

imagine digital freedom - Samsung (HKLM\...\{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}) (Version: 1.0.2.0 - Samsung Electronics Co., LTD)

Install McAfee (HKLM\...\{6B32EF07-8A23-4824-91BD-B0F24E50E974}) (Version: 1.00.0000 - Samsung Electronics Co., LTD,)

Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Linkury Smartbar (HKLM\...\{01CE337E-F88F-437B-A71A-AF527986BE48}) (Version: 1.6.1.909 - Linkury Inc.) <==== ATTENTION

MarketResearch (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1  (1033)) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB2572067) (HKLM\...\M2572067) (Version:  - )

Microsoft .NET Framework 1.1 Security Update (KB979906) (HKLM\...\M979906) (Version:  - )

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)

Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)

Microsoft Office 2003 Web Components (HKLM\...\{90A40407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8003.0 - Microsoft Corporation)

Microsoft Office 2007 Primary Interop Assemblies (HKLM\...\{50120000-1105-0000-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 2 (SP2) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}) (Version:  - Microsoft)

Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6425.1000 - Microsoft Corporation)

Microsoft Office Small Business Connectivity Components (HKLM\...\{A939D341-5A04-4E0A-BB55-3E65B386432D}) (Version: 2.0.7024.0 - Microsoft Corporation)

Microsoft SOAP Toolkit 2.0 SP2 (HKLM\...\{36BEAD11-8577-49AD-9250-E06A50AE87B0}) (Version: 623.1 - Microsoft Corporation)

Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)

Microsoft SQL Server Native Client (HKLM\...\{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft SQL Server VSS Writer (HKLM\...\{FDE96E86-7780-431C-92F7-679C6A7CEC51}) (Version: 9.00.5000.00 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

MONOGRAM AMR Splitter/Decoder (remove only) (HKLM\...\MONOGRAM AMR Splitter/Decoder) (Version:  - )

Move Networks Media Player for Internet Explorer (HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\...\Move Networks Player - IE) (Version:  - )

Mozilla Firefox 34.0.5 (x86 de) (HKLM\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)

NWZ-E450 WALKMAN Guide (HKLM\...\{0A6C2811-AD29-473F-8086-F0B401276DEC}) (Version: 2.1.0.17210 - Sony Corporation)

PanoStandAlone (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Play AVStation (HKLM\...\InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}) (Version: 4.1.20.46 - Ihr Firmenname)

Play AVStation (Version: 4.1.20.46 - Ihr Firmenname) Hidden

PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.2802.0 - CyberLink Corporation)

PSSWCORE (Version: 2.01.0000 - Hewlett-Packard) Hidden

RealMedia (remove only) (HKLM\...\RealMedia) (Version:  - )

RealPlayer (HKLM\...\RealPlayer 12.0) (Version:  - RealNetworks)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version:  - )

Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 5.00 - )

Samsung Recovery Solution II (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 2.0 - Samsung)

Samsung Update Plus (HKLM\...\InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}) (Version: 2.0 - Samsung Electronics Co., LTD)

Samsung Update Plus (Version: 2.0 - Samsung Electronics Co., LTD) Hidden

SHOUTcast Source (remove only) (HKLM\...\SHOUTcast Source) (Version:  - )

Skins (Version: 2007.0730.2152.37233 - ATI) Hidden

Skype™ 7.0 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)

SmartWebPrinting (Version: 140.0.186.000 - Hewlett-Packard) Hidden

SolutionCenter (Version: 90.0.146.000 - Hewlett-Packard) Hidden

Spybot - Search & Destroy (HKLM\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)

Status (Version: 110.0.180.000 - Hewlett-Packard) Hidden

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.1.22.0 - Synaptics)

Toolbox (Version: 90.0.146.000 - Hewlett-Packard) Hidden

TrayApp (Version: 110.0.180.000 - Hewlett-Packard) Hidden

UnloadSupport (Version: 9.0.0 - Hewlett-Packard) Hidden

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (HKLM\...\{07629207-FAA0-4F1A-8092-BF5085BE511F}) (Version: 9.00.5000.00 - Microsoft Corporation)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Outlook 2007 Junk Email Filter (KB2596560) (HKLM\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{2964DDE1-4925-4DF1-AF2C-0A36B3442228}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )

VideoToolkit01 (Version: 90.0.146.000 - Hewlett-Packard) Hidden

VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)

WebReg (Version: 90.0.146.000 - Hewlett-Packard) Hidden

WIDCOMM Bluetooth Software 6.0.1.5000 (HKLM\...\{03D1988F-469F-4843-8E6E-E5FE9D17889D}) (Version: 6.0.1.5000 - WIDCOMM, Inc.)

Windows Live Anmelde-Assistent (HKLM\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)

Zoom Player (remove only) (HKLM\...\ZoomPlayer) (Version:  - )
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll No File

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e3e02f12-2adb-478c-8742-5f0819f9f0f4}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{e473a65c-8087-49a3-affd-c5bc4a10669b}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fc345d4c-b8f4-4674-bff7-3c37d2e535ee}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)

CustomCLSID: HKU\S-1-5-21-3116156678-3848323971-3931140469-1003_Classes\CLSID\{fd6484ed-ebe3-4c3d-938a-8238003b41b7}\InprocServer32 -> C:\Users\Christina\AppData\Roaming\Move Networks\ie_bin\qsp2ie071302000004.dll (Move Networks)
 

==================== Restore Points  =========================
 

21-12-2014 11:38:55 Geplanter Prüfpunkt

21-12-2014 19:56:55 Windows-Sicherung
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2006-11-02 11:23 - 2010-09-17 17:07 - 00419366 ____R C:\Windows\system32\Drivers\etc\hosts

127.0.0.1       localhost

127.0.0.1        www.007guard.com

127.0.0.1        007guard.com

127.0.0.1        008i.com

127.0.0.1        www.008k.com

127.0.0.1        008k.com

127.0.0.1        www.00hq.com

127.0.0.1        00hq.com

127.0.0.1        010402.com

127.0.0.1        www.032439.com

127.0.0.1        032439.com

127.0.0.1        www.0scan.com

127.0.0.1        0scan.com

127.0.0.1        1000gratisproben.com

127.0.0.1        www.1000gratisproben.com

127.0.0.1        1001namen.com

127.0.0.1        www.1001namen.com

127.0.0.1        100888290cs.com

127.0.0.1        www.100888290cs.com

127.0.0.1        www.100sexlinks.com

127.0.0.1        100sexlinks.com

127.0.0.1        10sek.com

127.0.0.1        www.10sek.com

127.0.0.1        www.1-2005-search.com

127.0.0.1        1-2005-search.com

127.0.0.1        123fporn.info

127.0.0.1        www.123fporn.info

127.0.0.1        123haustiereundmehr.com

127.0.0.1        www.123haustiereundmehr.com
 

There are 1000 more lines.
 
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {00407FA0-B26A-4D78-BAE4-DCED18CE0BBD} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)

Task: {2E73D919-5704-48F5-BD45-2DA050634DD6} - System32\Tasks\advSRSII => C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe [2007-04-04] ()

Task: {36CC60E7-F073-45B7-92D3-2D0FCA4284BD} - System32\Tasks\SamsungMagicDoctor => C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe [2007-04-26] (Samsung Electronics Co., Ltd.)

Task: {4A0BA790-7E2E-41C2-9630-365ED6C19CE8} - System32\Tasks\{F8403358-9DFC-48DD-9814-C3C5B64B5224} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)

Task: {75A56371-2508-45D0-B522-4FFA66030227} - System32\Tasks\SupBackGroundTask => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe [2010-04-20] ()

Task: {80AF346F-AA8E-4BBC-8A2E-87C003976B06} - System32\Tasks\EasyDisplayMgr => C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe [2007-06-01] (SAMSUNG Electronics)

Task: {9DBC4E1A-1A47-4365-985F-7EE43499F7AB} - System32\Tasks\EasyBatteryManager => C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe [2007-06-29] (SAMSUNG Electronics co., LTD.)

Task: {A2905CD7-15D6-4F90-9726-C98606071C61} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-03] (Google Inc.)

Task: {AB3D9F35-AFB4-48F0-83D2-09826838A45F} - System32\Tasks\{D36EF826-E004-4D3A-8C17-E5566C882B0D} => Firefox.exe hxxp://ui.skype.com/ui/0/5.5.0.124.259/en/abandoninstall?page=tsPlugin&amp;installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled

Task: {B57FF0ED-4252-4D91-9B7C-6BDEB436AC3C} - System32\Tasks\{2EBAA3D6-013C-4628-BBCC-CA3BCB57800C} => pcalua.exe -a "C:\Users\Christina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0MADX4B0\miranda-im-v0.7.10-unicode[1].exe" -d "C:\Users\Christina\AppData\Roaming\ICQ Toolbar"

Task: {B8A0DA75-CD83-48CB-9EBA-7F9AE7FC2FAB} - System32\Tasks\{EA6DECD8-58E9-4AE1-A135-2AE6697E86F7} => C:\Program Files\Skype\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.)

Task: {C954C976-60FD-4FB5-95E6-628BF7CDBE9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-09] (Adobe Systems Incorporated)

Task: {E1EDABFD-F216-4F52-9A90-0759D4836240} - System32\Tasks\{2E3842F9-8974-4CD3-8E95-B5376AF0C567} => pcalua.exe -a "C:\Program Files\OpenSource Flash Video Splitter\uninstall.exe"

Task: {E90E0C26-3D38-4B64-893D-954ADAFB7503} - System32\Tasks\EasySpeedUpManager => C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [2007-04-24] (Samsung Electronics Co., Ltd.)
 

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
 

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\SupBackGroundTask.job => C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{FC9B79FB-262E-4EE2-81D9-601191299B76}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Loaded Modules (whitelisted) =============
 

2014-10-27 16:04 - 2014-10-27 16:04 - 00028160 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMUpdater.exe

2007-08-07 23:39 - 2007-01-08 14:39 - 00171040 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe

2014-12-01 17:01 - 2014-12-01 17:01 - 00974848 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMLoader.exe

2014-12-01 17:01 - 2014-12-01 17:01 - 01686016 _____ () C:\Users\Christina\AppData\Local\RGMService\RGMHost.dll

2014-12-01 17:01 - 2014-12-01 17:01 - 02745856 _____ () C:\Users\Christina\AppData\Local\RGMService\MonetizationToolsManager.dll

2014-12-01 17:02 - 2014-12-01 17:02 - 01592832 _____ () C:\Users\Christina\AppData\Local\RGMService\ProtectorsManager.dll

2014-11-20 14:09 - 2014-11-20 14:09 - 00245760 _____ () C:\Program Files\Avira\My Avira\System.ComponentModel.Composition.dll

2007-08-07 06:06 - 2007-08-07 01:31 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll

2007-08-08 00:17 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Samsung Magic Doctor\HookDllPS2.dll

2007-08-07 23:51 - 2007-04-04 06:10 - 01379328 _____ () C:\Program Files\Samsung\Samsung Recovery Solution II\WCScheduler.exe

2007-08-07 23:55 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\SAMSUNG\EasySpeedUpManager\HookDllPS2.dll

2007-08-07 23:54 - 2007-02-23 10:32 - 00065536 _____ () C:\Program Files\Samsung\EBM\ChkSec.dll

2007-08-07 23:50 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll

2007-08-07 23:50 - 2006-09-19 01:52 - 00028672 _____ () C:\Program Files\Samsung\Easy Display Manager\WinMove.dll

2014-12-09 20:02 - 2014-12-09 20:03 - 03758192 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

2007-04-24 10:32 - 2007-04-24 10:32 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL

2014-12-09 20:34 - 2014-12-09 20:34 - 16841392 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_246.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 

AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\View Baldur's Gate: Tales of The Sword Coast Readme.lnk
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^G DATA Firewall Tray.lnk => C:\Windows\pss\G DATA Firewall Tray.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\Windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupfolder: C:^Users^Christina^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe => C:\Windows\pss\PowerReg Scheduler V3.exe.Startup

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: AVKTray => "C:\Program Files\G DATA TotalCare\AVKTray\AVKTray.exe"

MSCONFIG\startupreg: GDFirewallTray => C:\Program Files\G DATA TotalCare\Firewall\GDFirewallTray.exe

MSCONFIG\startupreg: HP Software Update => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

MSCONFIG\startupreg: LanguageShortcut => "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

MSCONFIG\startupreg: RemoteControl => "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

MSCONFIG\startupreg: RtHDVCpl => RtHDVCpl.exe

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: TkBellExe => "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot

MSCONFIG\startupreg: Windows Defender => %ProgramFiles%\Windows Defender\MSASCui.exe -hide

MSCONFIG\startupreg: WMPNSCFG => C:\Program Files\Windows Media Player\WMPNSCFG.exe
 

========================= Accounts: ==========================
 

Administrator (S-1-5-21-3116156678-3848323971-3931140469-500 - Administrator - Disabled)

ASPNET (S-1-5-21-3116156678-3848323971-3931140469-1005 - Limited - Enabled)

Christina (S-1-5-21-3116156678-3848323971-3931140469-1003 - Administrator - Enabled) => C:\Users\Christina

Gast (S-1-5-21-3116156678-3848323971-3931140469-501 - Limited - Enabled)
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\WHITE-ON-BLACK> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:13 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\WHITE-ON-BLACK> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:12 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\RETINA> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 

Error: (12/22/2014 10:38:12 AM) (Source: Windows Search Service) (EventID: 3013) (User: )

Description: Eintrag <C:\USERS\CHRISTINA\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES\RETINA> in der Hash-Zuordnung kann nicht aktualisiert werden.
 

Kontext:  Anwendung, SystemIndex Katalog
 
 

Details:

        Ein an das System angeschlossenes Gerät funktioniert nicht.   (0x8007001f)
 
 

System errors:

=============

Error: (12/22/2014 10:36:34 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/22/2014 10:36:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (12/22/2014 10:34:21 AM) (Source: atikmdag) (EventID: 10266) (User: )

Description: Unknown EDID version
 

Error: (12/22/2014 09:05:55 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 

Error: (12/22/2014 08:48:54 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/22/2014 08:48:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 

Error: (12/22/2014 08:46:24 AM) (Source: atikmdag) (EventID: 10266) (User: )

Description: Unknown EDID version
 

Error: (12/22/2014 06:20:03 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 

Error: (12/21/2014 07:48:44 PM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: HP CUE DeviceDiscovery Service
 

Error: (12/21/2014 07:48:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Parallel port driver%%1058
 
 

Microsoft Office Sessions:

=========================

Error: (08/03/2009 11:53:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 353 seconds with 60 seconds of active time.  This session ended with a crash.
 

Error: (09/21/2008 00:37:38 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2402 seconds with 300 seconds of active time.  This session ended with a crash.
 

Error: (09/18/2008 10:22:40 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 114 seconds with 60 seconds of active time.  This session ended with a crash.
 
 

CodeIntegrity Errors:

===================================

  Date: 2011-10-23 21:12:16.785

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-10-23 21:12:16.558

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-04 19:42:55.860

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-04 19:42:55.537

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 19:42:30.523

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 19:42:30.302

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 18:22:01.281

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-06-03 18:22:00.829

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-04-28 23:05:49.918

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2011-04-28 23:05:49.705

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\atiumdag.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz

Percentage of memory in use: 54%

Total physical RAM: 2045.45 MB

Available physical RAM: 936.24 MB

Total Pagefile: 4336.18 MB

Available Pagefile: 2882.04 MB

Total Virtual: 2047.88 MB

Available Virtual: 1906.07 MB
 

==================== Drives ================================
 

Drive c: () (Fixed) (Total:69.05 GB) (Free:10.65 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: () (Fixed) (Total:70 GB) (Free:5.35 GB) NTFS
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (Size: 149.1 GB) (Disk ID: 69F484A5)

Partition 1: (Not Active) - (Size=10 GB) - (Type=27)

Partition 2: (Active) - (Size=69 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=70 GB) - (Type=07 NTFS)
 

==================== End Of Log ============================

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\ProgramData\ezsid.dat

EmptyTemp:

Hosts:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Hier das Fixlog

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2014

Ran by Christina at 2014-12-23 19:17:32 Run:1

Running from C:\Users\Christina\Downloads

Loaded Profile: Christina (Available profiles: Christina)

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\ProgramData\ezsid.dat

EmptyTemp:

Hosts:

*****************
 

"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

"HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google" => Key deleted successfully.

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe => Moved successfully.

C:\ProgramData\ezsid.dat => Moved successfully.

"C:\Windows\System32\Drivers\etc\hosts" => Could not move.

Could not reset Hosts.

EmptyTemp: => Removed 1.3 GB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 19:21:55 ====

Virenscanner deaktivieren, Fix wiederholen

Virenscanner ausgeschaltet, Fix wiederholt

Code:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 23-12-2014

Ran by Christina at 2014-12-24 18:45:09 Run:2

Running from C:\Users\Christina\Downloads\FRST-OlderVersion

Loaded Profile: Christina (Available profiles: Christina)

Boot Mode: Normal
 

==============================================
 

Content of fixlist:

*****************

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

CHR HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe

C:\ProgramData\ezsid.dat

EmptyTemp:

Hosts:

         

*****************
 

HKLM\SOFTWARE\Policies\Google => Key not found. 

HKU\S-1-5-21-3116156678-3848323971-3931140469-1003\SOFTWARE\Policies\Google => Key not found. 

"C:\Users\Christina\AppData\Local\Temp\0a50e25a83046228c11dcaa7eeed09bb.exe" => File/Directory not found.

"C:\ProgramData\ezsid.dat" => File/Directory not found.

C:\Windows\System32\Drivers\etc\hosts => Moved successfully.

Hosts was reset successfully.

EmptyTemp: => Removed 38.3 MB temporary data.
 
 

The system needed a reboot. 
 

==== End of Fixlog 18:45:19 ====

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset