| Onlythis | 02.01.2015 22:45 |
Windows 8.1 Pro: PUP.Optional.OmigaPlus.A und andere
Hallo,
habe auf dem Laptop meines Vaters Malwarebytes laufen lassen, da Firefox mit einer seltsamen Startseite startet und anschließend Defrogger-, GMER- und FRST-Scans durchgeführt.
Logfiles:
1.) Malwarebytes Code:
Registry Keys: 5
PUP.Optional.ISearch.A, HKLM\SOFTWARE\WOW6432NODE\omiga-plusSoftware, , [a9f7e40e8afff73fa76abd17917320e0],
PUP.Optional.Softonic.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Softonic, , [3f61d71b791053e395e3a6bf1ee59c64],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [0f9106ec24658fa74dbc5e48b3507c84],
PUP.Optional.InstallCore.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [1a868171d6b363d38e9506b6ac582ad6],
PUP.Optional.Qone8, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{33BB0A4E-99AF-4226-BDF6-49120163DE86}, , [3868737f10791323723ea126729207f9],
Registry Values: 2
PUP.Optional.FastStart.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|faststartff@gmail.com, C:\Users\Supermario\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\extensions\faststartff@gmail.com, , [edb341b18ffa7eb8da4931aa8b794db3]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0N2X1N, , [1a868171d6b363d38e9506b6ac582ad6]
Registry Data: 12
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[316fa25096f38da9dd122463a164639d]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}),,[c9d7a44e3851261003f05a2d996c9a66]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[7030cb272564d85e02f096f112f38f71]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[8d13d220f7923bfbb63e1176ed18e61a]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}),,[118fcb27d6b3e2540deabfc820e58c74]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[950b0de526631323ac43b0d75da8fc04]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[bbe5faf81c6d79bdd12381065fa6e51b]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}),,[465a549e98f1c47243b460270ef701ff]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[c7d9af4399f070c6a151d7b014f1659b]
PUP.Optional.OmigaPlus.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}),,[a3fd9959dfaaa09637bcef9814f1f30d]
PUP.Optional.OmigaPlus.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[554bea086524be78f5f893f4c4412dd3]
PUP.Optional.OmigaPlus.A, HKU\S-1-5-21-40867682-1087133493-2937002368-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL, hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB, Good: (www.google.com), Bad: (hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB),,[544cc32fd7b24bebe6060d7a57ae867a]
Folders: 0
(No malicious items detected)
Files: 7
PUP.Optional.FlvPlayer, C:\Users\Supermario\AppData\Roaming\FlvPlayer\FlvPlayerApp.exe, , [e5bb8d655c2ddd59d12716bff9096799],
PUP.Optional.StartPage.A, C:\Users\Supermario\AppData\Local\Temp\a2Tkehw6me\Wtmp124414359\BaofengUpdate.exe, , [cdd3a44eed9c87af9a32ab4a9f62e917],
PUP.Optional.SkyTech.A, C:\Users\Supermario\AppData\Local\Temp\a2Tkehw6me\Wtmp124414359\BFVUpdateM.dll, , [920e559dcbbed0666d7717dec33e8c74],
PUP.Optional.DownloadAssistant, C:\Users\Supermario\AppData\Local\Temp\a2uPqaGE4M\1FI7Va7R\Setup.exe, , [871904eed5b4a78fc48c11d779887f81],
PUP.Optional.ISearch.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\omiga-plus.xml, , [346c51a13f4a7cba7fc633980ef6857b],
PUP.Optional.QuickStart.A, C:\Users\Supermario\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\prefs.js, Good: (), Bad: (user_pref("browser.newtab.url", "chrome://quick_start/content/index.html");), ,[b0f051a1fb8e61d5bddab7073ec735cb]
PUP.Optional.OmigaPlus.A, C:\Users\Supermario\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\prefs.js, Good: (), Bad: (user_pref("browser.startup.homepage", "hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB");), ,[554beb0721686cca3d72d7ea7c895da3]
Physical Sectors: 0
(No malicious items detected)
2.) Defrogger
Konnte nicht durchgeführt werden, daher disable_log Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:51 on 02/01/2015 (XXXX)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
3.) FRST
FRST.txt Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-01-2015
Ran by XXXXX (administrator) on XXXX on 02-01-2015 21:55:36
Running from C:\Users\XXXXX\Desktop
Loaded Profile: XXXXX (Available profiles: XXXXX)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Launcher)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATILGE.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2917176 2012-09-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2014-12-14] (AVAST Software)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058880 2013-03-28] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [LexwareInfoService] => C:\Program Files (x86)\Lexware\Update Manager\LxUpdateManager.exe [208424 2013-10-08] (Haufe-Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-07-25] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [Spotify Web Helper] => C:\Users\XXXXX\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171000 2014-05-08] (Spotify Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [Spotify] => C:\Users\XXXXX\AppData\Roaming\Spotify\spotify.exe [6087224 2014-05-08] (Spotify Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [ProgLauncher] => C:\Program Files\ProgDVB\ProgLauncher.exe [577960 2014-05-30] ()
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Run: [EPLTarget\P0000000000000000] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IATILGE.EXE [297024 2013-01-24] (SEIKO EPSON CORPORATION)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {39118170-7B07-4BC5-8B47-C62B1DC1DC99} URL = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC02&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> DefaultScope {39118170-7B07-4BC5-8B47-C62B1DC1DC99} URL = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC02&q={searchTerms}
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB&q={searchTerms}
SearchScopes: HKU\S-1-5-21-40867682-1087133493-2937002368-1001 -> {39118170-7B07-4BC5-8B47-C62B1DC1DC99} URL = hxxp://www.bing.com/search?FORM=INCOH1&PC=IC02&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll (SEIKO EPSON CORPORATION)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchUrl: https://www.google.com/search
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: omiga-plus
FF Homepage: hxxp://isearch.omiga-plus.com/?type=hp&ts=1420142837&from=air&uid=TOSHIBAXMK5059GSXP_915QD1OHBXX915QD1OHB
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*'))%20%7B%20return%20'PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml
FF Extension: WEB.DE MailCheck - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\toolbar@web.de [2014-12-31]
FF Extension: WOT - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-08-01]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-07-28]
FF Extension: Adblock Plus - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-28]
FF Extension: BetterPrivacy - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-07-28]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-26]
FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on
FF Extension: E-Web Print - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2014-03-19]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\XXXXX\AppData\Roaming\Mozilla\Firefox\Profiles\jspupy6y.default\extensions\faststartff@gmail.com
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [caeaobpemokdfnidgaebncaooofnbfha] - C:\Users\XXXXX\ChromeExtensions\caeaobpemokdfnidgaebncaooofnbfha\amazon-icon-fwde.crx [2014-12-31]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-11-29]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-11-29] (AVAST Software)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4012248 2014-11-29] (Avast Software)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-11-29] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-11-29] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-11-29] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-11-29] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-11-29] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-11-29] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-11-29] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-11-29] ()
S3 AtiDCM; C:\AMD\WU-CCC2\ccc2_install\Support64\atdcm64a.sys [28416 2014-03-13] (Advanced Micro Devices, Inc.)
S3 hcw66xxx; C:\Windows\System32\Drivers\hcw66x64.sys [758016 2014-06-03] (Hauppauge Computer Works, Inc.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
U4 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [271752 2014-11-29] (Avast Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 21:55 - 2015-01-02 21:56 - 00018559 _____ () C:\Users\XXXXX\Desktop\FRST.txt
2015-01-02 21:55 - 2015-01-02 21:55 - 00000000 ____D () C:\FRST
2015-01-02 21:51 - 2015-01-02 21:51 - 00000482 _____ () C:\Users\XXXXX\Desktop\defogger_disable.log
2015-01-02 21:49 - 2015-01-02 21:49 - 00000000 _____ () C:\Users\XXXXX\defogger_reenable
2015-01-02 21:35 - 2015-01-02 21:35 - 00380416 _____ () C:\Users\XXXXX\Downloads\Gmer-19357.exe
2015-01-02 21:34 - 2015-01-02 21:34 - 02123264 _____ (Farbar) C:\Users\XXXXX\Desktop\FRST64.exe
2015-01-02 21:33 - 2015-01-02 21:33 - 00050477 _____ () C:\Users\XXXXX\Desktop\Defogger.exe
2015-01-02 20:38 - 2015-01-02 20:38 - 00003260 _____ () C:\WINDOWS\System32\Tasks\avastBCLRestartS-1-5-21-40867682-1087133493-2937002368-1001
2014-12-31 13:39 - 2014-12-31 13:39 - 00000358 _____ () C:\WINDOWS\PFRO.log
2014-12-31 10:31 - 2015-01-02 21:31 - 00000300 _____ () C:\WINDOWS\Tasks\PC-Mechanic Maintenance.job
2014-12-31 10:31 - 2015-01-01 21:18 - 00000294 _____ () C:\WINDOWS\Tasks\PC-Mechanic Startup.job
2014-12-31 10:31 - 2014-12-31 10:31 - 00003206 _____ () C:\WINDOWS\System32\Tasks\PC-Mechanic Maintenance
2014-12-31 10:31 - 2014-12-31 10:31 - 00002510 _____ () C:\WINDOWS\System32\Tasks\PC-Mechanic Startup
2014-12-31 10:31 - 2014-12-31 10:31 - 00001185 _____ () C:\Users\Public\Desktop\PC Mechanic.lnk
2014-12-31 10:31 - 2014-12-31 10:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue
2014-12-31 10:30 - 2014-12-31 10:30 - 00000000 ____D () C:\Users\XXXXX\AppData\Roaming\Uniblue
2014-12-31 10:30 - 2014-12-31 10:30 - 00000000 ____D () C:\Program Files (x86)\Uniblue
2014-12-31 10:26 - 2014-12-31 10:26 - 00003846 _____ () C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1420017946
2014-12-31 10:26 - 2014-12-31 10:26 - 00000000 ____D () C:\Users\XXXXX\AppData\Roaming\Opera Software
2014-12-31 10:26 - 2014-12-31 10:26 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Opera Software
2014-12-31 10:25 - 2014-12-31 10:25 - 00001151 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-12-31 10:24 - 2015-01-01 21:01 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-31 10:23 - 2014-12-31 10:23 - 00792032 _____ (DownloadAstro) C:\Users\XXXXX\Downloads\business_inventory_software.exe
2014-12-31 10:21 - 2014-12-31 10:21 - 00792032 _____ (DownloadAstro) C:\Users\XXXXX\Downloads\microsoft_excel(3).exe
2014-12-31 10:21 - 2014-12-31 10:21 - 00792032 _____ (DownloadAstro) C:\Users\XXXXX\Downloads\microsoft_excel(2).exe
2014-12-31 09:48 - 2014-12-31 09:48 - 00000188 _____ () C:\Users\XXXXX\Desktop\Amazon.de.url
2014-12-31 09:48 - 2014-12-31 09:48 - 00000000 ____D () C:\Users\XXXXX\ChromeExtensions
2014-12-31 09:48 - 2014-12-31 09:48 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Temp46d5415f13cad40e10e3ff80c53296c5
2014-12-31 09:48 - 2014-12-31 09:48 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Temp3eee748db5bbb854a81c2e37ddc864a5
2014-12-31 09:48 - 2014-12-31 09:48 - 00000000 ____D () C:\Users\XXXXX\AppData\Local\Temp31a82631f16a4aa76ec56042e85463de
2014-12-31 09:48 - 2014-12-31 09:48 - 00000000 ____D () C:\Program Files (x86)\WEB.DE MailCheck
2014-12-31 09:46 - 2014-12-31 09:46 - 01048928 _____ () C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall(3).exe
2014-12-31 09:46 - 2014-12-31 09:46 - 01048928 _____ () C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall(2).exe
2014-12-31 09:45 - 2014-12-31 09:45 - 01048928 _____ () C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall.exe
2014-12-31 09:45 - 2014-12-31 09:45 - 01048928 _____ () C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall(1).exe
2014-12-21 09:06 - 2015-01-02 21:10 - 00737720 _____ () C:\WINDOWS\WindowsUpdate.log
2014-12-20 08:26 - 2014-12-20 08:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-12-20 08:25 - 2014-12-20 08:25 - 05317104 _____ (Piriform Ltd) C:\Users\XXXXX\Downloads\ccsetup501.exe
2014-12-16 20:55 - 2014-12-16 20:55 - 03753472 _____ () C:\Users\XXXXX\Downloads\msxml6_ia64(2).msi
2014-12-16 20:55 - 2014-12-16 20:55 - 01528320 _____ () C:\Users\XXXXX\Downloads\msxml6(2).msi
2014-12-16 20:53 - 2014-12-16 20:54 - 02721280 _____ () C:\Users\XXXXX\Downloads\msxml6_x64(1).msi
2014-12-16 20:53 - 2014-12-16 20:53 - 04614144 _____ () C:\Users\XXXXX\Downloads\msxml6_SDK(1).msi
2014-12-16 09:06 - 2015-01-02 21:06 - 00000931 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}.job
2014-12-16 09:06 - 2015-01-02 21:06 - 00000745 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}.job
2014-12-16 09:06 - 2014-12-16 09:06 - 00003962 _____ () C:\WINDOWS\System32\Tasks\EPSON XP-215 217 Series Update {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}
2014-12-16 09:06 - 2014-12-16 09:06 - 00003776 _____ () C:\WINDOWS\System32\Tasks\EPSON XP-215 217 Series Invitation {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}
2014-12-14 22:53 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-14 22:53 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-14 13:35 - 2015-01-02 21:05 - 00000884 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-12-14 13:35 - 2014-12-14 13:35 - 00003772 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2014-12-10 22:50 - 2014-12-10 22:50 - 00001799 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-12-10 22:50 - 2014-12-10 22:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-12-10 22:48 - 2014-12-10 22:50 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2014-12-10 22:48 - 2014-12-10 22:50 - 00000000 ____D () C:\Program Files\iTunes
2014-12-10 22:48 - 2014-12-10 22:50 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-12-10 22:48 - 2014-12-10 22:48 - 00000000 ____D () C:\Program Files\iPod
2014-12-10 20:54 - 2014-11-07 05:16 - 01762840 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2014-12-10 20:54 - 2014-11-07 04:26 - 01489072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2014-12-10 20:53 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-12-10 20:53 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-12-10 20:53 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-12-10 20:53 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-12-10 20:53 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-12-10 20:52 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-12-10 20:52 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-12-10 20:52 - 2014-11-22 03:49 - 00417280 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2014-12-10 20:52 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-12-10 20:52 - 2014-11-22 03:35 - 00812544 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2014-12-10 20:52 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-12-10 20:52 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-12-10 20:52 - 2014-11-22 03:06 - 00340992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2014-12-10 20:52 - 2014-11-22 03:06 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2014-12-10 20:52 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-12-10 20:52 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-12-10 20:52 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-12-10 20:52 - 2014-11-22 02:59 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2014-12-10 20:52 - 2014-11-22 02:55 - 00661504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2014-12-10 20:52 - 2014-11-22 02:52 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2014-12-10 20:52 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-12-10 20:52 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-12-10 20:52 - 2014-11-22 02:49 - 00373760 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-12-10 20:52 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-12-10 20:52 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-12-10 20:52 - 2014-11-22 02:34 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2014-12-10 20:52 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-12-10 20:52 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-12-10 20:52 - 2014-11-22 02:29 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2014-12-10 20:52 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-12-10 20:52 - 2014-11-22 02:25 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll
2014-12-10 20:52 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-12-10 20:52 - 2014-11-22 02:23 - 00326656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-12-10 20:52 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-12-10 20:52 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-12-10 20:52 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-12-10 20:52 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-12-10 20:52 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-12-10 20:52 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 21:54 - 2014-01-28 12:13 - 00000000 ____D () C:\Users\XXXXX\AppData\Roaming\Macromedia
2015-01-02 21:49 - 2014-05-30 10:36 - 00000000 ____D () C:\Users\XXXXX
2015-01-02 21:14 - 2014-01-26 14:35 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-40867682-1087133493-2937002368-1001
2015-01-02 21:12 - 2014-03-19 22:12 - 00000931 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {52007BB5-1292-40E7-962D-B6276578095F}.job
2015-01-02 21:12 - 2014-03-19 22:12 - 00000745 _____ () C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {52007BB5-1292-40E7-962D-B6276578095F}.job
2015-01-02 21:06 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp
2015-01-02 21:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-02 20:40 - 2014-07-25 12:33 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-02 20:40 - 2014-07-25 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-01-02 20:40 - 2014-07-25 12:33 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-01-01 21:20 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-01 21:15 - 2014-03-18 11:04 - 01776918 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-01 21:15 - 2014-03-18 10:25 - 00765582 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-01 21:15 - 2014-03-18 10:25 - 00159366 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-01 21:11 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-01 21:09 - 2014-12-01 22:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-01 21:09 - 2014-07-25 11:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-01 21:08 - 2014-07-25 11:50 - 00001175 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-01-01 21:08 - 2014-07-25 11:50 - 00001163 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-01 21:08 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-01 21:07 - 2014-07-25 12:00 - 00001749 _____ () C:\Users\XXXXX\Desktop\IE.lnk
2015-01-01 21:07 - 2014-07-25 11:59 - 00001486 _____ () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iexplore.lnk
2015-01-01 21:07 - 2014-05-30 20:27 - 00001678 _____ () C:\Users\XXXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-01 21:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-12-31 12:00 - 2014-11-12 17:29 - 00000000 ____D () C:\ProgramData\7bb6df21-8ca8-4eec-965d-8cd2261544c7
2014-12-20 08:26 - 2014-03-29 18:46 - 00000000 ____D () C:\Program Files\CCleaner
2014-12-18 10:02 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-16 22:43 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-14 09:26 - 2014-01-26 14:40 - 00004182 _____ () C:\WINDOWS\System32\Tasks\avast! Emergency Update
2014-12-14 09:20 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-RS
2014-12-14 09:20 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sr-Latn-CS
2014-12-14 09:20 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\PolicyDefinitions
2014-12-10 23:10 - 2014-01-27 17:07 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-12-10 23:05 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-12-10 23:04 - 2014-01-27 17:07 - 112710672 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-12-10 22:48 - 2014-09-17 22:25 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-12-10 22:48 - 2014-03-23 10:43 - 00000000 ____D () C:\Program Files\Common Files\Apple
Some content of TEMP:
====================
C:\Users\XXXXX\AppData\Local\Temp\amazonicon_fwde.exe
C:\Users\XXXXX\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\XXXXX\AppData\Local\Temp\Franzis_Office_2010_Vorlagen4.exe
C:\Users\XXXXX\AppData\Local\Temp\sdan.exe
C:\Users\XXXXX\AppData\Local\Temp\sdapk.exe
C:\Users\XXXXX\AppData\Local\Temp\sdaspwn.exe
C:\Users\XXXXX\AppData\Local\Temp\WEB.DE_MailCheck_FF_Setup_freeware.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-01 22:08
==================== End Of Log ============================
Addition.txt Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-01-2015
Ran by XXXXX at 2015-01-02 21:58:30
Running from C:\Users\XXXXX\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
4660_4680_Help (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Adobe Flash Player 16 NPAPI (HKLM-x32\...\{61F2FFE4-56BA-4F5E-91FB-BD34F92E44CE}) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avast Free Antivirus (HKLM-x32\...\Avast) (Version: 10.0.2208 - AVAST Software)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
bpd_scan (x32 Version: 3.00.0000 - Hewlett-Packard) Hidden
BPDSoftware (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
BPDSoftware_Ini (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.01 - Piriform)
Destinations (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
Epson Easy Photo Print 2 (HKLM-x32\...\{674E262F-72EA-41C1-AF16-9727311A4553}) (Version: 2.4.1.0 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{2970697F-2A11-4588-8B7F-97322D1CCF3C}) (Version: 3.10.0017 - Seiko Epson Corporation)
Epson E-Web Print (HKLM-x32\...\{CEC98C2A-9ED5-49DA-9F3A-92434E0A4FA3}) (Version: 1.19.0000 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation)
EPSON XP-215 217 Series Printer Uninstall (HKLM\...\EPSON XP-215 217 Series) (Version: - SEIKO EPSON Corporation)
Fax (x32 Version: 140.0.307.000 - Hewlett-Packard) Hidden
FlvPlayer (HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\FlvPlayer) (Version: ${VERSION} - ) <==== ATTENTION
GPBaseService2 (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 14.0 (HKLM\...\HPExtendedCapabilities) (Version: 14.0 - HP)
HP Imaging Device Functions 14.0 (HKLM\...\HP Imaging Device Functions) (Version: 14.0 - HP)
HP OfficeJet J4600 All-In-One Series (HKLM\...\{6122CE5C-9DD3-402D-8413-57B681739FA7}) (Version: 14.0 - HP)
HP Solution Center 14.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 14.0 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPProductAssistant (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
J4680 (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
K-Lite Codec Pack 9.9.9 (64-bit) (HKLM\...\KLiteCodecPack64_is1) (Version: 9.9.9 - )
Lexware buchhalter 2013 (HKLM-x32\...\{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}) (Version: 18.04.00.0021 - Haufe-Lexware GmbH Co.KG)
Lexware Elster (HKLM-x32\...\{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}) (Version: 13.00.00.0027 - Haufe-Lexware GmbH & Co.KG)
Lexware Info Service (HKLM-x32\...\{85BF9FDB-BD5B-407C-9CAE-3542E5164783}) (Version: 4.00.00.0075 - Haufe-Lexware GmbH & Co.KG)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MarketResearch (x32 Version: 140.0.212.000 - Hewlett-Packard) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{402ED4A1-8F5B-387A-8688-997ABF58B8F2}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\MyFreeCodec) (Version: - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
Network64 (Version: 140.0.306.000 - Hewlett-Packard) Hidden
OCR Software by I.R.I.S. 14.0 (HKLM\...\HPOCR) (Version: 14.0 - HP)
Opera Stable 26.0.1656.60 (HKLM-x32\...\Opera 26.0.1656.60) (Version: 26.0.1656.60 - Opera Software ASA)
PC Mechanic (HKLM-x32\...\{1F88FC5D-4D46-448A-AF59-7061FFC6ABBF}_is1) (Version: 1.0.2.1 - Uniblue Systems Limited)
ProductContext (x32 Version: 140.0.001.000 - Hewlett-Packard) Hidden
ProgDVB x64 (HKLM\...\ProgDVB) (Version: 7.x - Prog)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.2.14014_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14072.12 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14072.12 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 140.0.253.000 - Hewlett-Packard) Hidden
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 14.0 - HP)
SmartDVB (HKLM-x32\...\{22339F8B-4399-4253-A37C-675979DC558A}) (Version: 1.3.103 - SmartWARE)
Software Updater (HKLM-x32\...\{B9802DDC-53FD-4D44-A81D-49DC80448614}) (Version: 4.2.6 - SEIKO EPSON CORPORATION)
SolutionCenter (x32 Version: 140.0.299.000 - Hewlett-Packard) Hidden
Spotify (HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\Spotify) (Version: 0.9.8.296.g91f68827 - Spotify AB)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Status (x32 Version: 140.0.342.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.19 - Synaptics Incorporated)
TAXMAN 2013 (HKLM-x32\...\{F289D934-2224-473B-B57E-0040D2693F83}) (Version: 19.07.00.0004 - Haufe-Lexware GmbH & Co.KG)
TAXMAN 2014 (HKLM-x32\...\{4A1C559D-38F6-49CF-BDA5-CF354FFE04E4}) (Version: 20.04.00.0003 - Haufe-Lexware GmbH & Co.KG)
Toolbox (x32 Version: 140.0.596.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 140.0.297.000 - Hewlett-Packard) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
WEB.DE MailCheck für Mozilla Firefox (HKLM-x32\...\1&1 Mail & Media GmbH Toolbar FF) (Version: 3.0.2.1739 - 1&1 Mail & Media GmbH)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
14-12-2014 13:33:24 Installed Adobe Flash Player 16 NPAPI.
23-12-2014 13:21:04 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2014-08-02 12:14 - 00509407 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1 localhost
0.0.0.0 fr.a2dfp.net
0.0.0.0 m.fr.a2dfp.net
0.0.0.0 mfr.a2dfp.net
0.0.0.0 ad.a8.net
0.0.0.0 asy.a8ww.net
0.0.0.0 static.a-ads.com
0.0.0.0 abcstats.com
0.0.0.0 ad4.abradio.cz
0.0.0.0 a.abv.bg
0.0.0.0 adserver.abv.bg
0.0.0.0 adv.abv.bg
0.0.0.0 bimg.abv.bg
0.0.0.0 ca.abv.bg
0.0.0.0 www2.a-counter.kiev.ua
0.0.0.0 track.acclaimnetwork.com
0.0.0.0 accuserveadsystem.com
0.0.0.0 www.accuserveadsystem.com
0.0.0.0 achmedia.com
0.0.0.0 csh.actiondesk.com
0.0.0.0 ads.activepower.net
0.0.0.0 app.activetrail.com
0.0.0.0 stat.active24stats.nl #[Tracking.Cookie]
0.0.0.0 traffic.acwebconnecting.com
0.0.0.0 office.ad1.ru
0.0.0.0 cms.ad2click.nl
0.0.0.0 ad2games.com
0.0.0.0 ads.ad2games.com
0.0.0.0 content.ad20.net
There are 1000 more lines.
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0CF608ED-5A1A-4AB0-87C3-A5E24A6BA20F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {136C8176-6030-49F5-9589-0F92CDBAEE7D} - System32\Tasks\EPSON XP-215 217 Series Invitation {52007BB5-1292-40E7-962D-B6276578095F} => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {16D7C8B1-4626-4795-BA8C-7355FAD977E5} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
Task: {28EDAF77-23B9-4D92-A8D6-B21A01CBD404} - System32\Tasks\PC-Mechanic Startup => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe [2014-12-17] (Uniblue Systems Limited)
Task: {5A82033C-FED4-4005-B938-0C6C8300FED2} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-12-14] (Adobe Systems Incorporated)
Task: {632F82C4-04CC-4E80-BE12-B5382BE2179D} - System32\Tasks\EPSON XP-215 217 Series Update {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {63674B54-DA65-4286-9F0E-A6A3AD218A60} - System32\Tasks\EPSON XP-215 217 Series Update {52007BB5-1292-40E7-962D-B6276578095F} => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {67802CD7-69F5-4DF9-99A4-3170A7A09559} - System32\Tasks\EPSON XP-215 217 Series Invitation {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A} => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE [2013-02-28] (SEIKO EPSON CORPORATION)
Task: {A4DBF681-EFF7-42C3-9F41-F28CC10585C0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-12-12] (Piriform Ltd)
Task: {AB13EDFB-F3B8-44DE-BB86-35B7C7A4F661} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-12-10] (Microsoft Corporation)
Task: {BFC0E481-DDF6-46A3-A94E-42A22AB822E0} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-11-29] (AVAST Software)
Task: {EC80A229-FD4A-42A5-A8C4-F3D009A6862C} - System32\Tasks\avastBCLRestartS-1-5-21-40867682-1087133493-2937002368-1001 => Firefox.exe
Task: {F812C0A1-3989-4C92-9A88-7D28BB6AF9F2} - System32\Tasks\Opera scheduled Autoupdate 1420017946 => C:\Program Files (x86)\Opera\launcher.exe [2014-12-16] (Opera Software)
Task: {FE86D5AC-FA67-4162-BE92-1734BE80FC3F} - System32\Tasks\PC-Mechanic Maintenance => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe [2014-12-17] (Uniblue Systems Limited)
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {52007BB5-1292-40E7-962D-B6276578095F}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Invitation {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {52007BB5-1292-40E7-962D-B6276578095F}.job => C:\Windows\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\EPSON XP-215 217 Series Update {A586A7B3-1A70-48DA-AAB7-D07C0FDC008A}.job => C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_ITSLGE.EXE
Task: C:\WINDOWS\Tasks\PC-Mechanic Maintenance.job => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe
Task: C:\WINDOWS\Tasks\PC-Mechanic Startup.job => C:\Program Files (x86)\Uniblue\PC-Mechanic\pc-mechanic.exe
==================== Loaded Modules (whitelisted) =============
2014-11-29 17:39 - 2014-11-29 17:39 - 00388208 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxDDU.dll
2014-11-29 17:39 - 2014-11-29 17:39 - 05851328 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxRT.dll
2015-01-01 21:01 - 2015-01-01 21:01 - 02908160 _____ () C:\Program Files\AVAST Software\Avast\defs\15010100\algo.dll
2014-11-29 17:39 - 2014-11-29 17:39 - 04495336 _____ () C:\Program Files\AVAST Software\Avast\ng\vbox\x86\VBoxRT-x86.dll
2015-01-02 17:56 - 2015-01-02 17:56 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010200\algo.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-11-29 17:39 - 2014-11-29 17:39 - 38562088 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:5C321E34
AlternateDataStreams: C:\Users\XXXXX\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\StartupFolder: => "Secunia PSI Tray.lnk"
HKLM\...\StartupApproved\Run32: => "LexwareInfoService"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\StartupApproved\Run: => "KiesPreload"
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\StartupApproved\Run: => "ProgLauncher"
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\StartupApproved\Run: => "Spotify"
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-40867682-1087133493-2937002368-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
========================= Accounts: ==========================
Administrator (S-1-5-21-40867682-1087133493-2937002368-500 - Administrator - Disabled)
Gast (S-1-5-21-40867682-1087133493-2937002368-501 - Limited - Disabled)
XXXXX (S-1-5-21-40867682-1087133493-2937002368-1001 - Administrator - Enabled) => C:\Users\XXXXX
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/02/2015 08:37:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x13bc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (01/01/2015 09:19:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: rundll32.exe_winethc.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504eb8
Name des fehlerhaften Moduls: USER32.dll, Version: 6.3.9600.17415, Zeitstempel: 0x5450559e
Ausnahmecode: 0xc0000142
Fehleroffset: 0x00000000000ec5a0
ID des fehlerhaften Prozesses: 0x9ac
Startzeit der fehlerhaften Anwendung: 0xrundll32.exe_winethc.dll0
Pfad der fehlerhaften Anwendung: rundll32.exe_winethc.dll1
Pfad des fehlerhaften Moduls: rundll32.exe_winethc.dll2
Berichtskennung: rundll32.exe_winethc.dll3
Vollständiger Name des fehlerhaften Pakets: rundll32.exe_winethc.dll4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: rundll32.exe_winethc.dll5
Error: (12/31/2014 02:01:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Error: (12/31/2014 10:26:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: COPSTU~1.EXE, Version: 0.0.0.0, Zeitstempel: 0x2a425e19
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54504ade
Ausnahmecode: 0x000006a6
Fehleroffset: 0x00014598
ID des fehlerhaften Prozesses: 0x1648
Startzeit der fehlerhaften Anwendung: 0xCOPSTU~1.EXE0
Pfad der fehlerhaften Anwendung: COPSTU~1.EXE1
Pfad des fehlerhaften Moduls: COPSTU~1.EXE2
Berichtskennung: COPSTU~1.EXE3
Vollständiger Name des fehlerhaften Pakets: COPSTU~1.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: COPSTU~1.EXE5
Error: (12/31/2014 10:10:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Vollversion_-Kostenlose-Office-Vorlagen-lnstall(3).exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1080
Startzeit: 01d024d66c70605d
Endzeit: 543
Anwendungspfad: C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall(3).exe
Berichts-ID: 08c8cc06-90cc-11e4-be9e-e840f23788d3
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1609
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1609
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/29/2014 10:01:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
Error: (12/28/2014 05:35:12 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifest.
System errors:
=============
Error: (01/02/2015 09:22:02 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/02/2015 09:21:32 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/02/2015 09:17:01 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/02/2015 09:16:30 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/02/2015 08:23:37 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/02/2015 08:23:07 PM) (Source: DCOM) (EventID: 10010) (User: Mario)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/02/2015 06:49:58 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
Error: (01/02/2015 06:34:59 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
Error: (01/02/2015 04:16:09 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
Error: (01/02/2015 00:07:09 AM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 137) (User: )
Description: 4
Microsoft Office Sessions:
=========================
Error: (01/02/2015 08:37:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe34.0.5.54435475dd5dmozalloc.dll34.0.5.54435475d664800000030000142513bc01d026c399bcaed0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlldaab5e43-92b6-11e4-bea0-e840f23788d3
Error: (01/01/2015 09:19:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: rundll32.exe_winethc.dll6.3.9600.1741554504eb8USER32.dll6.3.9600.174155450559ec000014200000000000ec5a09ac01d026002def561cC:\WINDOWS\System32\rundll32.exeUSER32.dll6bea8fa6-91f3-11e4-bea0-e840f23788d3
Error: (12/31/2014 02:01:01 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifestc:\program files\CCleaner\CCleaner.exe
Error: (12/31/2014 10:26:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: COPSTU~1.EXE0.0.0.02a425e19KERNELBASE.dll6.3.9600.1741554504ade000006a600014598164801d024dbbacbf8d0C:\Users\SUPERM~1\AppData\Local\Temp\IS1301~1\097D58~1\COPSTU~1.EXEC:\WINDOWS\SYSTEM32\KERNELBASE.dll0e8f48d2-90cf-11e4-be9e-e840f23788d3
Error: (12/31/2014 10:10:04 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Vollversion_-Kostenlose-Office-Vorlagen-lnstall(3).exe0.0.0.0108001d024d66c70605d543C:\Users\XXXXX\Downloads\Vollversion_-Kostenlose-Office-Vorlagen-lnstall(3).exe08c8cc06-90cc-11e4-be9e-e840f23788d3
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1609
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1609
Error: (12/30/2014 10:22:09 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (12/29/2014 10:01:55 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifestc:\program files\CCleaner\CCleaner.exe
Error: (12/28/2014 05:35:12 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1.manifestC:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_6240486fecbd8abb.manifestc:\program files\CCleaner\CCleaner.exe
==================== Memory info ===========================
Processor: AMD E-450 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 16%
Total physical RAM: 7913.9 MB
Available physical RAM: 6581.58 MB
Total Pagefile: 9193.9 MB
Available Pagefile: 7819.63 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (Acer) (Fixed) (Total:447.22 GB) (Free:382.64 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1F732B1D)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=447.2 GB) - (Type=07 NTFS)
==================== End Of Log ============================
4) GMER Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-02 22:18:32
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000029 TOSHIBA_MK5059GSXP rev.GN003J 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\XXXXX\AppData\Local\Temp\fgldypod.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff9600007b200 15 bytes [00, 28, F6, 01, 80, 1C, 6C, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff9600007b210 11 bytes [00, 0E, FC, FF, 00, 05, C4, ...]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [576:600] fffff960008ba2d0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -951212622
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 1949
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ...
---- EOF - GMER 2.1 ----
Vielen Dank schon mal im Voraus |
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
AdwCleaner auf deinen Desktop.
SecurityCheck und:
dann auf 
und dann auf 
. 
