Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Inactive Support Threads
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Google search via address line of goggle chrome redirects to search, that seems to be yahoo-search
Message
<blockquote data-quote="NLio" data-source="post: 1117217" data-attributes="member: 120198"><p>Hello again icotonev,</p><p></p><p>unfortunately I still get redirected, so here are the results from the FMRS log</p><p></p><p># ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #</p><p># Furtivex Malware Removal Script v5.5.4</p><p># <a href="https://furtivex.net" target="_blank">Furtivex – Furtivex Computer Solutions</a></p><p># Microsoft Windows 11 Home x64 24H2 0407 // 1252 // 65001</p><p># 2025_02_09__19_28_04 - nicol - </p><p># ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #</p><p></p><p></p><p></p><p># Abläufe:</p><p></p><p># Treiber:</p><p></p><p># Dienste:</p><p></p><p># Dateien:</p><p></p><p>C:\ProgramData\SEC9167.tmp</p><p>C:\ProgramData\SECA090.tmp</p><p>C:\Users\nicol\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data (507)</p><p>C:\Users\nicol\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js (2437)</p><p>C:\Users\nicol\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data (19)</p><p>C:\Users\nicol\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js (255)</p><p>C:\Users\nicol\AppData\Local\Tempwd.tmp</p><p>C:\Users\nicol\AppData\LocalLow\Sun\Java\Deployment\cache (0)</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM297CE.tmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2CA4F.tmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2CB3E.tmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2DC0.tmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\tw-694-3e60-c58845.tmp</p><p></p><p># Ordner:</p><p></p><p>C:\Users\nicol\AppData\Local\D3DSCache (39)</p><p>C:\Users\nicol\AppData\Local\Microsoft\Windows\INetCache\IE (4)</p><p>C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\D3DSCache (2)</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local (2198)</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\D3DSCache (9)</p><p></p><p># Aufgaben:</p><p></p><p># Registrierung:</p><p></p><p>HKLM\Software\Policies\Mozilla\Firefox</p><p>HKLM\Software\Microsoft\Tracing\HPWarrantyChecker_RASAPI32</p><p>HKLM\Software\Microsoft\Tracing\HPWarrantyChecker_RASMANCS</p><p>HKLM\Software\Microsoft\Tracing\SolutionFinder_RASAPI32</p><p>HKLM\Software\Microsoft\Tracing\SolutionFinder_RASMANCS</p><p>HKLM\Software\Microsoft\Tracing\Squirrel_RASAPI32</p><p>HKLM\Software\Microsoft\Tracing\Squirrel_RASMANCS</p><p>HKLM\Software\Microsoft\Tracing\Update_RASAPI32</p><p>HKLM\Software\Microsoft\Tracing\Update_RASMANCS</p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-338388Enabled</p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-338389Enabled</p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-88000326Enabled</p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\CiscoMeetingDaemon </p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\com.squirrel.Teams.Teams</p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher </p><p>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MicrosoftEdgeAutoLaunch_B9B257C7C4ABB38D87EB5195476F971F</p><p>HKLM\System\CurrentControlSet\Control\CrashControl\\AutoReboot [1] => [0]</p><p></p><p># Verschiedenes:</p><p></p><p>AntiVirus Software: Avast</p><p>AntiVirus Software: Malwarebytes</p><p>AntiVirus Software: McAfee</p><p>AntiVirus Software: Windows Defender</p><p>Wiederherstellungspunkt: Furtivex Malware Removal Script - Erstellt</p><p></p><p>HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions</p><p></p><p>HKLM\Software\Microsoft\Windows Defender\Exclusions\IpAddresses</p><p></p><p>HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths</p><p></p><p>HKLM\Software\Microsoft\Windows Defender\Exclusions\Processes</p><p></p><p>HKLM\Software\Microsoft\Windows Defender\Exclusions\TemporaryPaths</p><p></p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.12476.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13228.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13464.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13860.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.1416.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.14784.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.17288.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.4796.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\ctfmon.exe.10260.dmp</p><p>C:\Users\nicol\AppData\Local\CrashDumps\slicer.exe.6380.dmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CrashDumps\iprntsrv.exe.5760.dmp</p><p>C:\WINDOWS\System32\config\systemprofile\AppData\Local\CrashDumps\iprntsrv.exe.7480.dmp</p><p>C:\FRST\Quarantine\C\Program Files\HitmanPro\HitmanPro.exe</p><p>C:\FRST\Quarantine\C\Program Files\HitmanPro\hmpsched.exe</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\HitmanPro.key</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\HitmanPro.lic</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\Remnants.bin</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\Logs\HitmanPro_20250209_0636.log</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\Logs\HitmanPro_20250209_1559.log</p><p>C:\FRST\Quarantine\C\ProgramData\HitmanPro\Quarantine\quarantine.xml</p><p>C:\FRST\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro 3.8 entfernen.lnk</p><p>C:\FRST\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnk</p><p>C:\FRST\Quarantine\C\Users\nicol\Downloads\HitmanPro_x64.exe.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\HPDataRetriever.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\HPSupportTool.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1612079694.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery.xBAD</p><p>C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker.xBAD</p><p></p><p></p><p># ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ #</p><p></p><p>The FRST logs are once again attached.</p><p>Thanks for your quick and easy to understand responses!</p></blockquote><p></p>
[QUOTE="NLio, post: 1117217, member: 120198"] Hello again icotonev, unfortunately I still get redirected, so here are the results from the FMRS log # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Furtivex Malware Removal Script v5.5.4 # [URL="https://furtivex.net"]Furtivex – Furtivex Computer Solutions[/URL] # Microsoft Windows 11 Home x64 24H2 0407 // 1252 // 65001 # 2025_02_09__19_28_04 - nicol - # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Abläufe: # Treiber: # Dienste: # Dateien: C:\ProgramData\SEC9167.tmp C:\ProgramData\SECA090.tmp C:\Users\nicol\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data (507) C:\Users\nicol\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js (2437) C:\Users\nicol\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data (19) C:\Users\nicol\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js (255) C:\Users\nicol\AppData\Local\Tempwd.tmp C:\Users\nicol\AppData\LocalLow\Sun\Java\Deployment\cache (0) C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM297CE.tmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2CA4F.tmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2CB3E.tmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\CM2DC0.tmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\tw-694-3e60-c58845.tmp # Ordner: C:\Users\nicol\AppData\Local\D3DSCache (39) C:\Users\nicol\AppData\Local\Microsoft\Windows\INetCache\IE (4) C:\WINDOWS\ServiceProfiles\LocalService\AppData\Local\D3DSCache (2) C:\WINDOWS\System32\config\systemprofile\AppData\Local (2198) C:\WINDOWS\System32\config\systemprofile\AppData\Local\D3DSCache (9) # Aufgaben: # Registrierung: HKLM\Software\Policies\Mozilla\Firefox HKLM\Software\Microsoft\Tracing\HPWarrantyChecker_RASAPI32 HKLM\Software\Microsoft\Tracing\HPWarrantyChecker_RASMANCS HKLM\Software\Microsoft\Tracing\SolutionFinder_RASAPI32 HKLM\Software\Microsoft\Tracing\SolutionFinder_RASMANCS HKLM\Software\Microsoft\Tracing\Squirrel_RASAPI32 HKLM\Software\Microsoft\Tracing\Squirrel_RASMANCS HKLM\Software\Microsoft\Tracing\Update_RASAPI32 HKLM\Software\Microsoft\Tracing\Update_RASMANCS HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-338388Enabled HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-338389Enabled HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\\SubscribedContent-88000326Enabled HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\CiscoMeetingDaemon HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\com.squirrel.Teams.Teams HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\HPSEU_Host_Launcher HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\MicrosoftEdgeAutoLaunch_B9B257C7C4ABB38D87EB5195476F971F HKLM\System\CurrentControlSet\Control\CrashControl\\AutoReboot [1] => [0] # Verschiedenes: AntiVirus Software: Avast AntiVirus Software: Malwarebytes AntiVirus Software: McAfee AntiVirus Software: Windows Defender Wiederherstellungspunkt: Furtivex Malware Removal Script - Erstellt HKLM\Software\Microsoft\Windows Defender\Exclusions\Extensions HKLM\Software\Microsoft\Windows Defender\Exclusions\IpAddresses HKLM\Software\Microsoft\Windows Defender\Exclusions\Paths HKLM\Software\Microsoft\Windows Defender\Exclusions\Processes HKLM\Software\Microsoft\Windows Defender\Exclusions\TemporaryPaths C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.12476.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13228.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13464.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.13860.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.1416.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.14784.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.17288.dmp C:\Users\nicol\AppData\Local\CrashDumps\click_and_teach.exe.4796.dmp C:\Users\nicol\AppData\Local\CrashDumps\ctfmon.exe.10260.dmp C:\Users\nicol\AppData\Local\CrashDumps\slicer.exe.6380.dmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\CrashDumps\iprntsrv.exe.5760.dmp C:\WINDOWS\System32\config\systemprofile\AppData\Local\CrashDumps\iprntsrv.exe.7480.dmp C:\FRST\Quarantine\C\Program Files\HitmanPro\HitmanPro.exe C:\FRST\Quarantine\C\Program Files\HitmanPro\hmpsched.exe C:\FRST\Quarantine\C\ProgramData\HitmanPro\HitmanPro.key C:\FRST\Quarantine\C\ProgramData\HitmanPro\HitmanPro.lic C:\FRST\Quarantine\C\ProgramData\HitmanPro\Remnants.bin C:\FRST\Quarantine\C\ProgramData\HitmanPro\Logs\HitmanPro_20250209_0636.log C:\FRST\Quarantine\C\ProgramData\HitmanPro\Logs\HitmanPro_20250209_1559.log C:\FRST\Quarantine\C\ProgramData\HitmanPro\Quarantine\quarantine.xml C:\FRST\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro 3.8 entfernen.lnk C:\FRST\Quarantine\C\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnk C:\FRST\Quarantine\C\Users\nicol\Downloads\HitmanPro_x64.exe.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\HPDataRetriever.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\HPSupportTool.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1612079694.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_UpdateInterval.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery.xBAD C:\FRST\Quarantine\C\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker.xBAD # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # The FRST logs are once again attached. Thanks for your quick and easy to understand responses! [/QUOTE]
Insert quotes…
Verification
Post reply
Top
