| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: chinesischer DienstWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.03.2014, 07:04
| #1 |
 |  chinesischer Dienst Guten Morgen, zufällig ist mir heute im Taskmanager ein chinesischer Dienst aufgefallen, der dort sicher nicht hingehört. Wie kann ich ihn entfernen? Frst64.exe habe ich bereits laufen lassen. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Bernhard (administrator) on BERNHARD-PC on 13-03-2014 06:46:20
Running from C:\Users\Bernhard\Desktop\PC\Trojanerboard
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(SUPERAntiSpyware.com) C:\PROGRAM FILES\SUPERANTISPYWARE\SASCORE64.EXE
() C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO CORE TUNER 2\ACT2SERVICE.EXE
() C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\AHDDC2_SERVICE.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(CobianSoft, Luis Cobian) C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe
(Luis Cobian, CobianSoft) C:\PROGRAM FILES (X86)\COBIAN BACKUP 11\CBSERVICE.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\WINDOWS\SYSWOW64\SVCHOST.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY CBE\ENGINE\20.4.0.40\CCSVCHST.EXE
() C:\PROGRAM FILES\OCSTER BACKUP\BIN\BACKUPSERVICE-OX.EXE
(ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) C:\Windows\system32\PrintCtrl.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(ActMask Co.,Ltd - hxxp://www.all2pdf.com) C:\Windows\system32\PrintDisp.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Softwareentwicklung Remus - ArchiCrypt) C:\Windows\SysWOW64\STGRAMDiskHandler64.exe
() C:\PROGRAM FILES (X86)\1&1 SURF-STICK\ASSISTANTSERVICES.EXE
() C:\PROGRAM FILES (X86)\WATCHMI\TVDSERVICE.EXE
() c:\Program Files\Ocster Backup\bin\oxHelper.exe
(Microsoft Corp.) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WINDOWS LIVE\WLIDSVC.EXE
(Intel® Corporation) C:\PROGRAM FILES\INTEL\WIFI\BIN\ZEROCONFIGSERVICE.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\BLUETOOTH\OBEXSRV.EXE
(Microsoft Corporation) C:\PROGRAM FILES (X86)\MICROSOFT APPLICATION VIRTUALIZATION CLIENT\SFTLIST.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\CVHSVC.EXE
(Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY CBE\ENGINE\20.4.0.40\CCSVCHST.EXE
() C:\PROGRAM FILES (X86)\PHOTKEY\PHOTKEY.EXE
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\ATouch64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\PROGRAM FILES (X86)\PHOTKEY\PVDAGENT.EXE
() C:\PROGRAM FILES (X86)\PHOTKEY\POSD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(CyberLink Corp.) C:\PROGRAM FILES (X86)\CYBERLINK\YOUCAM\YOUCAMSERVICE.EXE
(Intel Corporation) C:\WINDOWS\SYSTEM32\HKCMD.EXE
(Intel Corporation) C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
(Realtek Semiconductor) C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVCPL64.EXE
(Realtek Semiconductor) C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVBG64.EXE
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(TODO: <Company name>) C:\PROGRAM FILES (X86)\PHOTKEY\HCSYNAPI.EXE
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Ashampoo Development GmbH & Co. KG) C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\AHDDC2_GUARD.EXE
(Google Inc.) C:\PROGRAM FILES (X86)\GOOGLE\GOOGLETOOLBARNOTIFIER\GOOGLETOOLBARNOTIFIER.EXE
(Microsoft Corporation) C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\STEGANOSBROWSERMONITOR.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) USB 3.0 EXTENSIBLE HOST CONTROLLER DRIVER\APPLICATION\IUSB3MON.EXE
(Dolby Laboratories Inc.) C:\PROGRAM FILES (X86)\DOLBY ADVANCED AUDIO V2\PCEE4.EXE
(CyberLink) C:\PROGRAM FILES (X86)\CYBERLINK\POWER2GO\CLMLSVC.EXE
() C:\PROGRAM FILES (X86)\1&1 SURF-STICK\UIEXEC.EXE
(Hewlett-Packard) C:\PROGRAM FILES (X86)\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\STEGANOSHOTKEYSERVICE.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\FREDIRSTARTER.EXE
(Intel(R) Corporation) C:\PROGRAM FILES\INTEL\BLUETOOTHHS\BTHSSECURITYMGR.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) RAPID STORAGE TECHNOLOGY\IASTORDATAMGRSVC.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) MANAGEMENT ENGINE COMPONENTS\LMS\LMS.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) MANAGEMENT ENGINE COMPONENTS\UNS\UNS.EXE
(Microsoft Corporation) C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\CVH.EXE
() C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\OFFICEVIRT.EXE
(Microsoft Corporation) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPSVC.EXE
(RealNetworks, Inc.) C:\PROGRAM FILES (X86)\REAL\REALPLAYER\UPDATE\REALSCHED.EXE
(AnVir Software) C:\PROGRAM FILES (X86)\ANVIR TASK MANAGER\ANVIR.EXE
(AnVir Software) C:\PROGRAM FILES (X86)\ANVIR TASK MANAGER\ANVIR64.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [11406608 2011-12-20] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-02-23] (Synaptics Incorporated)
HKLM\...\Run: [Ashampoo Core Tuner 2] - C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2.exe [5220768 2011-08-22] (Ashampoo Development GmbH & Co. KG)
HKLM\...\Run: [Ashampoo HDD-Control 2 Guard] - C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Guard.exe [3783592 2012-07-30] (Ashampoo Development GmbH & Co. KG)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-10-22] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-10-22] (Crawler.com)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AVMFBoxMonitor] - C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [1503232 2009-07-06] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [Steganos HotKeys] - C:\Program Files (x86)\Steganos Privacy Suite 14\SteganosHotKeyService.exe [100864 2013-12-18] (Steganos Software GmbH)
HKLM-x32\...\Run: [SSS14 File Redirection Starter] - C:\Program Files (x86)\Steganos Privacy Suite 14\fredirstarter.exe [17920 2013-12-18] (Steganos Software GmbH)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2014-01-03] (RealNetworks, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-03] (Google Inc.)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [SUPERAntiSpyware] - C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE [6563608 2014-01-21] (SUPERAntiSpyware)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [Google Update] - C:\Users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-09-21] (Google Inc.)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [SSS14 Browser Monitor] - C:\Program Files (x86)\Steganos Privacy Suite 14\SteganosBrowserMonitor.exe [70656 2013-12-18] (Steganos Software GmbH)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [] - [X]
HKU\S-1-5-21-4070342091-3793343965-3738386277-1006\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-22] ()
HKU\SCANNERMAP\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-22] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - C:\Program Files (x86)\Steganos Privacy Suite 14\SPMIEToolbar64.dll (Steganos Software GmbH)
Toolbar: HKLM - Perfect Print 7 - {F723BF1C-C826-44B0-A8E2-28BBA1C5D201} - C:\Program Files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent64.dll (soft Xpansion)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - C:\Program Files (x86)\Steganos Privacy Suite 14\SPMIEToolbar.dll (Steganos Software GmbH)
Toolbar: HKLM-x32 - Perfect Print 7 - {F723BF1C-C826-44B0-A8E2-28BBA1C5D201} - C:\Program Files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent32.dll (soft Xpansion)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper - C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Bernhard\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Bernhard\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Firefox Synchronisation Extension - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\synchronize@nokia.suite [2014-03-04]
FF Extension: DownloadHelper - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-02-12]
FF Extension: Ghostery - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\firefox@ghostery.com.xpi [2014-02-12]
FF Extension: NoScript - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-12]
FF Extension: Adblock Plus - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-12]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afext@anchorfree.com [2014-02-16]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-29]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-01-03]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF [2013-10-09]
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] - C:\Program Files (x86)\Steganos Privacy Suite 14\spmplugin3
FF Extension: Steganos Password Manager - C:\Program Files (x86)\Steganos Privacy Suite 14\spmplugin3 [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{704E31A6-E680-48D0-BDEA-B0FE737AEB4D}] - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb
FF Extension: soft Xpansion Perfect Print 7 Express - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb [2013-12-23]
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Thunderbird\Extensions: [{704E31A6-E680-48D0-BDEA-B0FE737AEB4D}] - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb
FF Extension: soft Xpansion Perfect Print 7 Express - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb [2013-12-23]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-29]
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DealPlyLive Update) - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (Protect Disc License Acquisition Plugin) - C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Plugin: (Citrix Online Web Deployment Plugin 1.0.0.104) - C:\Users\Bernhard\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
CHR Plugin: (Google Update) - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (Google Docs) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-10]
CHR Extension: (Google Drive) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-10]
CHR Extension: (YouTube) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-10]
CHR Extension: (Adblock Plus) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-09-27]
CHR Extension: (Google-Suche) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-10]
CHR Extension: (SpeedTao Download Helper) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\eifpflhplblejfpibogcnnepoldboioh [2013-09-27]
CHR Extension: (RealDownloader) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-09-26]
CHR Extension: (Norton Identity Protection) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-05-10]
CHR Extension: (Ghostery) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2014-03-02]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (Google Mail) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-10]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\Exts\Chrome.crx [2014-02-02]
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\PROGRAM FILES\SUPERANTISPYWARE\SASCORE64.EXE [143088 2013-05-07] (SUPERAntiSpyware.com)
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1421216 2011-08-22] ()
R2 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [1518504 2012-07-30] ()
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 cbVSCService11; C:\Program Files (x86)\Cobian Backup 11\cbVSCService11.exe [67584 2012-12-05] (CobianSoft, Luis Cobian)
R2 CobianBackup11; C:\Program Files (x86)\Cobian Backup 11\cbService.exe [1131008 2012-12-05] (Luis Cobian, CobianSoft)
S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
S4 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [187456 2013-05-02] (DATA BECKER GmbH & Co KG)
S3 DfSdkS; C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\DFSDKS64.EXE [544768 2009-08-24] (mst software GmbH, Germany)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 ocster_backup; c:\Program Files\Ocster Backup\bin\backupService-ox.exe [22472 2012-12-05] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-10-22] (Crawler.com)
R2 Steganos Volatile Disk; C:\Windows\SysWOW64\STGRAMDiskHandler64.exe [450560 2013-07-17] (Softwareentwicklung Remus - ArchiCrypt)
S3 supereasy_backup; c:\Program Files\SuperEasy Software\Backup Pro\bin\backupService-sezbp.exe [24664 2013-11-21] ()
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-12-23] (soft Xpansion)
R2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 updatesvca; C:\Windows\system32\updatesvca.dll [209920 2013-03-04] (Digital Dynamic)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)
S4 FreemakeVideoCapture; "C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe" [X]
S4 楗敳潂瑯獁楳瑳湡tǬ"; 㩃停潲牧浡䘠汩獥⠠㡸⤶坜獩履楗敳䌠牡㘳尵潂瑯楔敭攮數 [X]
==================== Drivers (Whitelisted) ====================
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
S4 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-01] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46792 2013-04-24] (AnchorFree Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20140312.001\IDSvia64.sys [524504 2014-03-06] (Symantec Corporation)
S3 leawo_vad; C:\Windows\System32\drivers\leawo_vad.sys [33048 2013-05-21] (Shenzhen Moyea Software)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140312.025\ENG64.SYS [126040 2014-03-05] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140312.025\EX64.SYS [2099288 2014-03-05] (Symantec Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527872 2007-11-08] (PixArt Imaging Inc.)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2013-11-18] (Softwareentwicklung Remus - ArchiCrypt - )
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-06] (Windows (R) Win 7 DDK provider)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R3 stdriver; C:\Windows\System32\DRIVERS\stdriverx64.sys [32536 2013-01-28] ()
R1 STGMFEngine64; C:\Windows\system32\drivers\STGMFEngine64.sys [28576 2013-07-17] (Softwareentwicklung Remus - ArchiCrypt.com)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-20] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [12400 1999-10-13] (Microsoft Corporation)
S3 Bulk1528; System32\Drivers\Bulk1528.sys [X]
S2 Ca1528av; System32\Drivers\Ca1528av.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-04 16:26 - 2014-03-04 16:26 - 00176128 _____ () C:\Users\Bernhard\Downloads\aacdec.exe
2014-03-04 16:26 - 2014-03-04 16:26 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\NCH Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00001359 _____ () C:\Users\Public\Desktop\Video Converter 2.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\Supereasy
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Program Files (x86)\SuperEasy Software
2014-03-04 07:32 - 2014-03-04 07:32 - 00002093 _____ () C:\Users\Public\Desktop\Nokia Suite.lnk
2014-03-04 07:29 - 2014-03-04 07:29 - 00018180 _____ () C:\Windows\DPINST.LOG
2014-03-04 07:29 - 2014-03-04 07:29 - 00000000 ____D () C:\Program Files (x86)\PC Connectivity Solution
2014-03-04 07:29 - 2012-10-17 14:53 - 00026112 _____ (Nokia) C:\Windows\system32\Drivers\pccsmcfdx64.sys
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\SanDisc
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\Neuer Ordner (2)
2014-02-23 17:08 - 2014-02-23 17:08 - 00001997 _____ () C:\Users\Bernhard\Desktop\K-ML.lnk
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\KC Softwares
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Program Files (x86)\KC Softwares
2014-02-23 17:08 - 2013-03-20 22:36 - 00151552 _____ (KC Softwares) C:\Windows\SysWOW64\kmail.ocx
2014-02-23 17:08 - 2009-04-11 19:17 - 00053248 _____ (Katarn Corp.) C:\Windows\SysWOW64\kvblib.ocx
2014-02-23 17:08 - 2009-04-11 16:45 - 00126976 _____ (KC Softwares) C:\Windows\SysWOW64\kftp.ocx
2014-02-23 17:08 - 2008-04-14 04:31 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dhtmled.ocx
2014-02-23 17:08 - 2003-04-01 07:36 - 00094208 _____ (vbAccelerator) C:\Windows\SysWOW64\vbalIml6.ocx
2014-02-23 17:08 - 2003-01-26 15:41 - 00040960 _____ (vbAccelerator) C:\Windows\SysWOW64\SSubTmr6.dll
2014-02-23 17:08 - 2002-06-08 19:09 - 00204800 _____ (vbAccelerator) C:\Windows\SysWOW64\KTbar.ocx
2014-02-23 17:08 - 2001-04-05 19:43 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Msstkprp.dll
2014-02-23 17:08 - 2000-10-02 00:00 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.dll
2014-02-23 17:08 - 2000-07-15 00:00 - 00204907 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRIEDIT.DLL
2014-02-22 22:18 - 2014-03-02 23:59 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Apple Computer
2014-02-22 22:18 - 2014-02-22 22:18 - 00001787 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-22 22:18 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\Program Files\iTunes
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-22 22:16 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iPod
2014-02-22 22:14 - 2014-02-22 22:14 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-22 22:03 - 2014-02-22 22:10 - 148896080 _____ (Apple Inc.) C:\Users\Bernhard\Downloads\iTunes64Setup.exe
2014-02-19 14:37 - 2014-03-06 23:26 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-02-19 14:37 - 2014-03-06 23:26 - 00003246 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-02-19 14:23 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-19 14:23 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-19 14:23 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-19 14:23 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-19 14:23 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-19 14:23 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-19 14:23 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-19 14:23 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-19 14:23 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-19 14:23 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-19 14:23 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-19 14:23 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-19 14:23 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-19 14:23 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-19 14:23 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-19 14:23 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-19 14:23 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-19 14:23 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-19 14:23 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-19 14:23 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-19 14:23 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-19 14:23 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-19 14:23 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-19 14:23 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-19 14:23 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-19 14:23 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-19 14:23 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-19 14:23 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-19 14:23 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-19 14:23 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-19 14:23 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-19 14:23 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-19 14:23 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-19 14:23 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-19 14:23 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-19 14:23 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-19 14:23 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-19 14:23 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-19 14:23 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-19 14:23 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-19 14:23 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-16 13:38 - 2014-02-16 13:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-12 10:06 - 2014-02-12 10:06 - 00001155 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-12 09:52 - 2014-02-12 09:52 - 00770279 _____ () C:\Users\Bernhard\Downloads\video_downloadhelper-4.9.21-fx_sm.zip
2014-02-12 08:32 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-12 08:32 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-12 08:32 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 08:32 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 08:31 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 08:31 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-12 08:31 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-12 08:31 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 08:31 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-12 08:31 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-12 08:31 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-12 08:31 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-12 08:31 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-12 08:31 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-12 08:31 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-12 08:31 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-12 08:31 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-12 08:31 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-12 08:31 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-12 08:31 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-12 08:31 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-12 08:31 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-12 08:31 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-12 08:31 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-12 08:31 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-12 08:31 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-12 08:31 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 08:31 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-11 05:25 - 2014-02-11 05:25 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\{C441B55B-0987-47FE-953B-174D02DFCF24}
==================== One Month Modified Files and Folders =======
2014-03-13 06:46 - 2013-09-25 08:44 - 00000000 ____D () C:\FRST
2014-03-13 06:43 - 2012-02-21 19:50 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-03-13 06:43 - 2012-02-21 19:50 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-03-13 06:43 - 2009-07-14 06:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-13 06:36 - 2012-05-03 08:49 - 01444063 _____ () C:\Windows\WindowsUpdate.log
2014-03-13 06:28 - 2012-10-24 10:53 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA.job
2014-03-13 06:25 - 2013-06-04 06:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-13 06:25 - 2013-06-04 06:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-13 06:25 - 2013-03-19 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-13 06:25 - 2013-03-19 21:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-13 06:25 - 2009-07-14 05:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-13 06:25 - 2009-07-14 05:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-13 06:24 - 2012-05-03 08:55 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-13 06:22 - 2012-09-24 18:37 - 00000000 ____D () C:\Users\Bernhard\Desktop\PC
2014-03-13 06:20 - 2012-05-03 09:04 - 00103200 _____ () C:\Users\Bernhard\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-13 06:04 - 2013-01-07 22:01 - 00000000 ____D () C:\Users\Bernhard\Desktop\Linklisten
2014-03-13 05:50 - 2013-12-10 07:58 - 00025221 _____ () C:\Windows\setupact.log
2014-03-13 05:48 - 2013-09-02 15:34 - 00000000 ____D () C:\Program Files (x86)\Wondershare
2014-03-13 05:43 - 2012-05-03 08:55 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-13 05:40 - 2012-08-27 00:20 - 00000000 ____D () C:\Users\Bernhard\Desktop\Coaches
2014-03-12 09:32 - 2012-10-24 10:53 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core.job
2014-03-11 20:28 - 2012-10-18 09:48 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Mozilla
2014-03-11 02:57 - 2014-01-06 23:03 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-03-06 23:29 - 2012-05-03 09:09 - 00000000 ____D () C:\Users\Bernhard\Documents\Youcam
2014-03-06 23:26 - 2014-02-19 14:37 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-03-06 23:26 - 2014-02-19 14:37 - 00003246 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-03-06 23:24 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-06 23:23 - 2013-12-13 06:39 - 00052360 _____ () C:\Windows\PFRO.log
2014-03-06 23:21 - 2012-05-03 09:21 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SoftGrid Client
2014-03-06 22:50 - 2014-01-09 00:19 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\genienext
2014-03-06 09:42 - 2009-07-14 06:08 - 00032584 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-06 09:35 - 2013-01-11 09:46 - 00000000 ____D () C:\Users\Bernhard\Desktop\1
2014-03-04 22:16 - 2012-05-03 09:20 - 01596516 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-04 22:11 - 2013-05-29 14:02 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-04 22:11 - 2013-05-29 14:02 - 00000000 ____D () C:\ProgramData\Skype
2014-03-04 21:02 - 2012-06-04 22:21 - 00000000 ____D () C:\Users\Bernhard\Documents\Gesundheit
2014-03-04 16:26 - 2014-03-04 16:26 - 00176128 _____ () C:\Users\Bernhard\Downloads\aacdec.exe
2014-03-04 16:26 - 2014-03-04 16:26 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\NCH Software
2014-03-04 12:35 - 2013-01-17 18:47 - 00002382 _____ () C:\Users\Bernhard\Desktop\Google Chrome.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00001359 _____ () C:\Users\Public\Desktop\Video Converter 2.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\Supereasy
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Program Files (x86)\SuperEasy Software
2014-03-04 10:55 - 2012-12-04 23:32 - 00000000 ____D () C:\Users\Bernhard\Documents\My Received Files
2014-03-04 09:13 - 2013-06-25 08:09 - 00000000 ____D () C:\Users\Bernhard\Desktop\Aktenschrank
2014-03-04 08:24 - 2013-05-10 14:06 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\CrashDumps
2014-03-04 07:44 - 2012-11-12 11:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Nokia Suite
2014-03-04 07:32 - 2014-03-04 07:32 - 00002093 _____ () C:\Users\Public\Desktop\Nokia Suite.lnk
2014-03-04 07:29 - 2014-03-04 07:29 - 00018180 _____ () C:\Windows\DPINST.LOG
2014-03-04 07:29 - 2014-03-04 07:29 - 00000000 ____D () C:\Program Files (x86)\PC Connectivity Solution
2014-03-04 07:29 - 2012-09-03 11:10 - 00000000 ____D () C:\Program Files (x86)\Nokia
2014-03-03 18:06 - 2013-04-19 08:55 - 00000000 ____D () C:\Users\Bernhard\Desktop\Lotuscafe
2014-03-03 18:00 - 2012-09-11 19:34 - 00000000 ____D () C:\Users\Bernhard\Desktop\Maria
2014-03-03 17:58 - 2012-06-04 22:18 - 00000000 ____D () C:\Users\Bernhard\Documents\Ulla
2014-03-03 17:46 - 2013-01-06 11:57 - 00000000 ____D () C:\Users\Bernhard\.freemind
2014-03-03 01:19 - 2012-12-01 10:31 - 00000000 ____D () C:\Users\Bernhard\Desktop\P
2014-03-02 23:59 - 2014-02-22 22:18 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Apple Computer
2014-03-02 21:09 - 2013-03-13 23:29 - 00003394 _____ () C:\Users\Bernhard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Apps deinstallieren - Chrome Web Store-Hilfe.lnk
2014-03-02 21:09 - 2013-03-13 23:29 - 00003386 _____ () C:\Users\Bernhard\Desktop\Apps deinstallieren - Chrome Web Store-Hilfe.lnk
2014-02-26 10:07 - 2013-02-22 19:29 - 00000000 ____D () C:\Users\Bernhard\Desktop\WordPress Homepageerstellung
2014-02-25 10:36 - 2014-01-09 11:35 - 00000959 _____ () C:\Users\Bernhard\Desktop\oCam.lnk
2014-02-25 10:36 - 2014-01-09 11:35 - 00000000 ____D () C:\Program Files (x86)\oCam
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\SanDisc
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\Neuer Ordner (2)
2014-02-23 17:08 - 2014-02-23 17:08 - 00001997 _____ () C:\Users\Bernhard\Desktop\K-ML.lnk
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\KC Softwares
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Program Files (x86)\KC Softwares
2014-02-23 17:06 - 2014-02-09 12:06 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\SuperEasy Backup
2014-02-22 22:19 - 2013-01-05 00:31 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Apple Computer
2014-02-22 22:18 - 2014-02-22 22:18 - 00001787 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iTunes
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-22 22:16 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iPod
2014-02-22 22:16 - 2013-09-01 17:03 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-22 22:14 - 2014-02-22 22:14 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-22 22:14 - 2013-01-04 22:14 - 00000000 ____D () C:\ProgramData\Apple
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-22 22:10 - 2014-02-22 22:03 - 148896080 _____ (Apple Inc.) C:\Users\Bernhard\Downloads\iTunes64Setup.exe
2014-02-19 22:19 - 2012-05-03 08:55 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-19 22:19 - 2012-05-03 08:55 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-19 15:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-19 14:33 - 2014-02-09 12:06 - 00000000 ____D () C:\Users\_supereasy_backup_
2014-02-19 14:31 - 2013-03-19 16:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-18 17:08 - 2012-06-04 23:39 - 00000000 ____D () C:\Users\Bernhard\Documents\L
2014-02-16 13:39 - 2014-02-16 13:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 08:23 - 2012-10-24 10:53 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA
2014-02-16 08:23 - 2012-10-24 10:53 - 00003712 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core
2014-02-13 20:54 - 2012-05-23 23:30 - 00000000 ____D () C:\Users\Bernhard\dwhelper
2014-02-12 10:06 - 2014-02-12 10:06 - 00001155 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-02-12 09:52 - 2014-02-12 09:52 - 00770279 _____ () C:\Users\Bernhard\Downloads\video_downloadhelper-4.9.21-fx_sm.zip
2014-02-12 09:14 - 2013-04-28 21:15 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Mozilla Firefox
2014-02-12 09:04 - 2013-12-04 19:10 - 00000000 ____D () C:\Users\Bernhard\Desktop\Alte Firefox-Daten
2014-02-11 05:25 - 2014-02-11 05:25 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\{C441B55B-0987-47FE-953B-174D02DFCF24}
Files to move or delete:
====================
C:\Users\Bernhard\AppData\Roaming\CamLayout.ini
C:\Users\Bernhard\AppData\Roaming\CamShapes.ini
C:\Users\Bernhard\AppData\Roaming\CamStudio.Producer.Data.ini
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Bernhard\AppData\Local\Temp\mp3el.exe
C:\Users\Bernhard\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Bernhard\AppData\Local\Temp\Quarantine.exe
C:\Users\Bernhard\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Bernhard\AppData\Local\Temp\tmp770E.tmp.exe
C:\Users\Bernhard\AppData\Local\Temp\tmp881F.tmp.exe
C:\Users\Bernhard\AppData\Local\Temp\tmp8830.tmp.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 12:04
==================== End Of Log ============================
|
|
13.03.2014, 07:06
| #2 |
| | chinesischer Dienst Und hier die adition.txt:
__________________Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Bernhard at 2014-03-13 06:46:47
Running from C:\Users\Bernhard\Desktop\PC\Trojanerboard
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton Internet Security CBE (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security CBE (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security CBE (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
1&1 Surf-Stick (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - )
4500_G510gm_Help (x32 Version: 000.0.440.000 - Hewlett-Packard) Hidden
4500G510gm (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
4500G510gm_Software_Min (x32 Version: 000.0.423.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
abylon EXIF-CLEANER 2014 (Privatversion) (HKLM-x32\...\abylonprotectionmanager-exif-cleaner_is1) (Version: 2014 - abylonsoft)
Acoustica Special Edition 5.0 (HKLM-x32\...\Acoustica Special Edition_is1) (Version: 5.0 - Acon AS)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0 - Adobe Systems Incorporated)
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.70 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.06 - Adobe Systems Incorporated)
Aiseesoft Total Video Converter Platinum 7.1.10 (HKLM-x32\...\{3661F243-518C-4d05-8BDF-7B10CC22689F}_is1) (Version: 7.1.10 - Aiseesoft Studio)
ALDI SÜD Mah Jong (HKLM-x32\...\ALDI SÜD Mah Jong) (Version: - )
AllDup 3.4.24 (HKLM-x32\...\AllDup_is1) (Version: 3.4.24 - Michael Thummerer Software Design)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
AMI VR-pulse OS Switcher (HKLM\...\{EC1369CF-15BD-4FAF-BA84-65E4788C682E}) (Version: 1.1 - American Megatrends Inc.)
AnVir Task Manager (HKLM-x32\...\AnVir Task Manager) (Version: - AnVir Software)
Any Video Converter 5.0.5 (HKLM-x32\...\Any Video Converter_is1) (Version: - Any-Video-Converter.com)
Apowersoft kostenloser Bildschirmrekorder V1.2.4 (HKLM-x32\...\{4EFA42DB-E4EC-4537-9DF3-5158D08A9785}_is1) (Version: 1.2.4 - Apowersoft)
Apple Application Support (HKLM-x32\...\{21FC2093-6E43-460B-B9B0-5F5AA35BBB0F}) (Version: 3.0 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{FE86CB0C-FCB3-4358-B4B0-B0A41E33B3DD}) (Version: 7.1.0.32 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft PhotoImpression 5 (HKLM-x32\...\{5863B6EF-76D0-4FF8-AA2F-EEBE7CC49DAA}) (Version: - ArcSoft)
ArcSoft VideoImpression 2 (HKLM-x32\...\{5339885F-4597-4343-BD3B-74280CC79424}) (Version: - ArcSoft)
Ashampoo Burning Studio (HKLM-x32\...\Ashampoo Burning Studio_is1) (Version: 10.0.10 - Ashampoo GmbH & Co. KG)
Ashampoo Burning Studio 2013 v.11.0.6 (HKLM-x32\...\{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1) (Version: 11.0.6 - Ashampoo GmbH & Co. KG)
Ashampoo Core Tuner 2 v.2.0.1 (HKLM-x32\...\{4209F371-2541-6C11-55DB-6103A83FCB9B}_is1) (Version: 2.01 - Ashampoo GmbH & Co. KG)
Ashampoo HDD Control 2 v.2.1.0 (HKLM-x32\...\{4209F371-A431-385E-2D7E-ACDA5DA3BA0B}_is1) (Version: 2.1.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander (HKLM-x32\...\Ashampoo Photo Commander_is1) (Version: 9.2.0 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Commander 10 v.10.2.1 (HKLM-x32\...\{C92AB6F1-4B66-808A-D77C-25EF81C0176A}_is1) (Version: 10.2.1 - Ashampoo GmbH & Co. KG)
Ashampoo Photo Optimizer (HKLM-x32\...\Ashampoo Photo Optimizer_is1) (Version: 4.0.0 - Ashampoo GmbH & Co. KG)
Ashampoo Snap (HKLM-x32\...\Ashampoo Snap_is1) (Version: 4.3.0 - Ashampoo GmbH & Co. KG)
Ashampoo Video Styler 2013 v.1.0.1 (HKLM-x32\...\{91B33C97-8914-D2D4-EB40-39C1714271FF}_is1) (Version: 1.0.1 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 10 v.10.2.5 (HKLM-x32\...\{4209F371-88D4-AB00-ED2B-D6520C84D9D5}_is1) (Version: 10.02.05 - Ashampoo GmbH & Co. KG)
Ashampoo WinOptimizer 2013 v.1.0.0 (HKLM-x32\...\{4209F371-7B85-60AD-E5CE-E4409D39E3DE}_is1) (Version: 1.00.00 - Ashampoo GmbH & Co. KG)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Audials (HKLM-x32\...\{85B5CB65-2AC3-4C1C-A950-B20DE5520C79}) (Version: 10.2.19305.500 - Audials AG)
AVM FRITZ!Box Monitor (HKLM-x32\...\AVMFBoxMonitor) (Version: - AVM Berlin)
Balabolka (HKLM-x32\...\Balabolka) (Version: 2.6.0.538 - Ilya Morozov)
Biet-O-Matic v2.14.10 (HKLM-x32\...\Biet-O-Matic v2.14.10) (Version: 2.14.10 - BOM Development Team)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BrainWave Generator (HKLM-x32\...\BrainWave Generator) (Version: - )
BroadCam Video Streaming Server (HKLM-x32\...\BroadCam) (Version: - NCH Software)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
CamStudio 2.7.2 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7.2 - CamStudio Open Source)
CCleaner (HKLM\...\CCleaner) (Version: 3.25 - Piriform)
CleverPrint (HKLM-x32\...\CleverPrint_is1) (Version: 3.00 - Abelssoft GmbH)
Cobian Backup 11 Gravity (HKLM-x32\...\CobBackup11) (Version: - )
ColorPage-SF600 (HKLM-x32\...\{A5505456-B9C3-43DA-A588-F6947422C134}) (Version: V4.3.0 - )
concept/design Video Jukebox (HKLM-x32\...\{37569A10-CB38-4615-8B32-0BF9FF5D887D}_is1) (Version: 1.3.0.0 - concept/design GmbH)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Convert AVI to MP4 1.3 (HKLM-x32\...\{9ECE13D2-C028-44CB-8A96-A65196E7BBE7}_is1) (Version: - convertavitomp3.com)
Corel Graphics - Windows Shell Extension (HKLM-x32\...\_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}) (Version: 15.2.0.686 - Corel Corporation)
Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686 - Corel Corporation) Hidden
Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Common (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Connect (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Custom Data (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - DE (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Draw (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - EN (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - ES (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Extra Content (HKLM-x32\...\_{5A10CFDA-FA2B-453C-B561-AE864E62EAC8}) (Version: - Corel Corporation)
CorelDRAW Essentials X5 - Extra Content (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Filters (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - FR (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - IPM (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - IT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - PHOTO-PAINT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Redist (x32 Version: 15.0 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - Setup Files (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 - WT (x32 Version: 15.3 - Corel Corporation) Hidden
CorelDRAW Essentials X5 (HKLM-x32\...\_{EDBEBF07-F880-48FB-9AA5-0E8E71E02D83}) (Version: 15.2.0.686 - Corel Corporation)
CorelDRAW Essentials X5 (x32 Version: 15.3 - Corel Corporation) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
CyberLink MediaEspresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.1508_36229 - CyberLink Corp.)
CyberLink MediaEspresso (x32 Version: 6.5.1508_36229 - CyberLink Corp.) Hidden
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.1.2414a - CyberLink Corp.)
CyberLink MediaShow (x32 Version: 5.1.2414a - CyberLink Corp.) Hidden
CyberLink PhotoDirector 2011 (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.2430 - CyberLink Corp.)
CyberLink PhotoDirector 2011 (x32 Version: 2.0.2430 - CyberLink Corp.) Hidden
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.4428 - CyberLink Corp.)
CyberLink PhotoDirector 3 (x32 Version: 3.0.4428 - CyberLink Corp.) Hidden
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.7717 - CyberLink Corp.)
CyberLink PhotoNow (x32 Version: 1.1.7717 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1327 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 7.0.0.1327 - CyberLink Corp.) Hidden
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 9.0.0.3621 - CyberLink Corp.)
CyberLink PowerDirector (Version: 9.0.0.3621 - CyberLink Corp.) Hidden
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.3622.02 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.3622.02 - CyberLink Corp.) Hidden
CyberLink PowerDVD Copy (HKLM-x32\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
CyberLink PowerDVD Copy (x32 Version: 1.5.1306 - CyberLink Corp.) Hidden
CyberLink WaveEditor (HKLM-x32\...\InstallShield_{324F76CC-D8DD-4D87-B77D-D4AF5E1AA7B3}) (Version: 1.0.1.3320 - CyberLink Corp.)
CyberLink WaveEditor (x32 Version: 1.0.1.3320 - CyberLink Corp.) Hidden
CyberLink YouCam 5 (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.2219 - CyberLink Corp.)
CyberLink YouCam 5 (x32 Version: 5.0.2219 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DarkWave Studio 4.0.9 (HKLM-x32\...\DarkWave Studio) (Version: 4.0.9 - ExperimentalScene)
Debut Video Capture Software (HKLM-x32\...\Debut) (Version: - NCH Software)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.372.000 - Hewlett-Packard) Hidden
DocMgr (x32 Version: 130.0.000.000 - Ihr Firmenname) Hidden
DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
EaseUS Data Recovery Wizard 7.0 (HKLM-x32\...\EaseUS Data Recovery Wizard 7.0_is1) (Version: - EaseUS)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 14.4.12044 - Landesfinanzdirektion Thüringen)
Express Burn (HKLM-x32\...\ExpressBurn) (Version: - NCH Software)
Express Dictate (HKLM-x32\...\Express) (Version: - NCH Software)
Express Rip (HKLM-x32\...\ExpressRip) (Version: - NCH Software)
f4 2012 (HKLM-x32\...\f42012) (Version: - audiotranskription.de)
Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden
FileViewPro (HKLM\...\FileViewPro_is1) (Version: 4.0 - stfx, Ath)
FileZilla Client 3.7.3 (HKLM-x32\...\FileZilla Client) (Version: 3.7.3 - Tim Kosse)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
FormatFactory 3.1.1 (HKLM-x32\...\FormatFactory) (Version: 3.1.1 - Free Time)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Foxtab (HKLM-x32\...\foxtab) (Version: - FoxTab) <==== ATTENTION
FRANZIS onlineTV 8 (HKLM-x32\...\{CBC88F0E-1960-4AC3-8C38-8BAD44E3F6E3}_is1) (Version: 8.5.0.10 - FRANZIS Verlag GmbH)
Free PDF to Word Converter 2.0 (HKLM-x32\...\Free PDF to Word Converter_is1) (Version: - Free-PDF-to-Word.com)
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free Screen Video Recorder version 2.5.30.725 (HKLM-x32\...\Free Screen Video Recorder_is1) (Version: 2.5.30.725 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Golden Records Schallplatten in CD Konverter (HKLM-x32\...\Golden) (Version: - NCH Software)
Google Chrome (HKCU\...\Google Chrome) (Version: 33.0.1750.146 - Google Inc.)
Google Drive (HKLM-x32\...\{E87022D3-C8C9-4C76-8E27-BC7F18F9B8FB}) (Version: 1.14.6059.644 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Talk Plugin (HKLM-x32\...\{F8B67DF7-B543-3DE0-BCEF-F844F891FD48}) (Version: 5.1.7.17873 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
GoToMeeting 5.5.0.1133 (HKCU\...\GoToMeeting) (Version: 5.5.0.1133 - CitrixOnline)
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HDR projects elements (64-Bit) (HKLM\...\HDR projects elements_is1) (Version: 1.22 - Franzis Verlag GmbH)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Document Manager 2.0 (HKLM\...\HP Document Manager) (Version: 2.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Officejet 4500 G510g-m (HKLM\...\{E5083D57-D93F-404C-A91F-1C50D67C2BEB}) (Version: 13.0 - HP)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
Incomedia WebSite X5 v10 - Home (HKLM-x32\...\{22B260EE-79AD-4F4C-9E06-349E8F1D958C}_is1) (Version: 10.1.0.39 - Incomedia s.r.l.)
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2618 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}) (Version: 15.0.0.0059 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{F0932859-AA60-459E-B843-0BDECA34E2C7}) (Version: 2.0.0.0086 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.1.209 - Intel Corporation)
Intel(R) WiDi (HKLM-x32\...\{93F34C5C-ACAA-48F3-9B26-70359A117F12}) (Version: 3.0.12.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel® PROSet/Wireless WiFi Software (HKLM\...\{DF7756DD-656A-45C3-BA71-74673E8259A9}) (Version: 15.00.0000.0642 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
iTunes (HKLM\...\{96B53CA8-5ABB-49D8-96F1-F6C0D73A76C6}) (Version: 11.1.4.62 - Apple Inc.)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kalender-Excel-8.10 (HKLM-x32\...\Kalender-Excel-8.10_is1) (Version: 8.10 - MSDatec)
Kastor - All Video Downloader V 5.2.0 (HKLM-x32\...\{CB84FEF5-C573-4328-B9AF-B28568A4E10E}_is1) (Version: 5.2.0.0 - KastorSoft)
Kastor - Stream Recorder V 1.0 (HKLM-x32\...\{CB84FEF6-C573-4328-B9A4-B29568A4E10E}_is1) (Version: 1.0.0.0 - KastorSoft)
KC Softwares K-ML (HKLM-x32\...\KC Softwares K-ML_is1) (Version: - KC Softwares)
K-Lite Codec Pack 5.2.0 (Full) (HKLM-x32\...\KLiteCodecPack_is1) (Version: 5.2.0 - )
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (HKLM-x32\...\{CA227A9D-09BE-4BFB-9764-48FED2DA5454}) (Version: 15.4.5722.2 - Microsoft Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Live Aquarium HD (HKLM-x32\...\Live Aquarium HD_is1) (Version: 3 - Ladislav Vojnic)
MAGIX Foto & Grafik Designer 7 SE (HKLM-x32\...\MAGIX_{305A1AC7-0B5C-457D-9B6F-2A889766E3A0}) (Version: 7.1.2.26041 - MAGIX AG)
MAGIX Foto & Grafik Designer 7 SE (Version: 7.1.2.26041 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Medion Home Cinema (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.3216 - CyberLink Corp.)
Medion Home Cinema (x32 Version: 8.0.3216 - CyberLink Corp.) Hidden
Memeo Instant Backup (HKLM-x32\...\{8E666407-AC41-46a2-9692-6C7BFCBFDD37}) (Version: 4.60.0.7943 - Memeo Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Mathematics (64-Bit) (HKLM\...\{E57B7E0A-8BE5-42E2-BE60-C07ED680A063}) (Version: 4.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Reader (HKLM-x32\...\{B6F7DBE7-2FE2-458F-A738-B10832746036}) (Version: - )
Microsoft Reader Text-to-Speech deutsch (HKLM-x32\...\{A06F5ACB-AF59-4DC0-B22E-1F6F47FC7004}) (Version: 01.00.0000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{D285FC5F-3021-32E9-9C59-24CA325BDC5C}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
MixPad Audiodatei-Mixer (HKLM-x32\...\MixPad) (Version: - NCH Software)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0.1 - Mozilla)
Mozilla Thunderbird 24.1.1 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.1.1 (x86 de)) (Version: 24.1.1 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
myMugle (HKLM-x32\...\myMugle3.0.0.0) (Version: 3.0.0.0 - Computer Business Solutions)
Network64 (Version: 130.0.550.000 - Hewlett-Packard) Hidden
Network64 (Version: 140.0.221.000 - Hewlett-Packard) Hidden
No23 Recorder (HKLM-x32\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
No23Live (HKLM-x32\...\{BE850443-DF4F-4B6F-9968-4F8F3125B964}) (Version: 1.0.4.19 - No23)
Nokia Connectivity Cable Driver (HKLM-x32\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.8.48.0 - Nokia)
Nokia Suite (x32 Version: 3.8.48.0 - Nokia) Hidden
Norton Internet Security CBE (HKLM-x32\...\NIS) (Version: 20.4.0.40 - Symantec Corporation)
oCam version 19.0.0.0 (HKLM-x32\...\oCam_is1) (Version: 19.0.0.0 - hxxp://ohsoft.net/)
OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP)
Ocster Backup Pro (HKLM\...\Ocster Backup) (Version: 7.10 - Ocster GmbH & Co. KG)
OfficeAdRemover (HKLM-x32\...\OfficeAdRemover_is1) (Version: - Ondrej Pokorny)
OpenOffice 4.0.1 (HKLM-x32\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
Orga-Nicer (HKLM-x32\...\Orga-Nicer_is1) (Version: 3.3.0.1 - ASCOMP Software GmbH)
PC Connectivity Solution (HKLM-x32\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PCSUITE SHREDDER (HKLM-x32\...\PCSUITE_SHREDDER_PRO_is1) (Version: - Markement GmbH)
PHotkey (HKLM-x32\...\{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}) (Version: 1.00.0055 - Pegatron Corporation)
Photomizer Retro (HKLM-x32\...\{41B5224D-7853-4EA5-0001-C8949A33B608}) (Version: 2.0.13.308 - Engelmann Media GmbH)
PhotoStage Slideshow Producer (HKLM-x32\...\PhotoStage) (Version: - NCH Software)
PhraseExpress v9.1.8 (HKLM-x32\...\PhraseExpress_is1) (Version: 9.1.8 - Bartels Media GmbH)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Prism Video File Converter (HKLM-x32\...\Prism) (Version: - NCH Software)
Protect Disc License Helper 1.0.118 (HKLM-x32\...\Protect Disc License Helper) (Version: 1.0.118 - Protect Disc)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.11 - ProtectDisc Software GmbH)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Rainbow Folders (HKLM-x32\...\{2AEA17BA-FAB3-49D2-BB85-0669D14DC9BC}_is1) (Version: 2.05 - Piotr Chodzinski)
RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6559 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
RecordPad Audiorekorder (HKLM-x32\...\Recordpad) (Version: - NCH Software)
Reg Organizer version 6.31 (HKLM-x32\...\Reg Organizer_is1) (Version: 6.31 - ChemTable Software)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SAMSUNG Intelli-studio (HKLM-x32\...\Intelli-studio) (Version: 3.1.32.1 - Samsung Electronics Co., Ltd.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
simplitec simplicheck (HKLM-x32\...\{183D780B-28F9-41BA-A2CB-605F324A5781}) (Version: 1.3.10.0 - simplitec GmbH)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
soft Xpansion Perfect Print 7 Express (HKLM-x32\...\{98AD196C-B3B6-48df-AB53-A711C822497C}) (Version: 7.2.1.7 - soft Xpansion)
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SoundTap Audiostream-Rekorder (HKLM-x32\...\SoundTap) (Version: - NCH Software)
Sparfuchs (HKLM-x32\...\Sparfuchs_is1) (Version: 2014 - Abelssoft)
SPCA1528 PC Driver (HKLM-x32\...\{570C2A84-A145-4DF0-AE9D-012584DF09DC}) (Version: 2.2.2.0 - sunplus)
Spelling Dictionaries Support For Adobe Reader X (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-A00000000004}) (Version: 10.0.0 - Adobe Systems Incorporated)
Spyware Terminator 2012 (HKLM-x32\...\{56736259-613E-4A3B-B428-6235F2E76F44}_is1) (Version: 3.0.0.82 - Crawler, LLC)
StarMoney (x32 Version: 3.0.6.28 - StarFinanz) Hidden
StarMoney 8.0 (HKLM-x32\...\{2E36EB70-A4D8-4CD0-915D-0ACAAED6A918}) (Version: 8.0 - Star Finanz GmbH)
Status (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Steganos Password Manager 14 (HKLM-x32\...\{C83404F0-D7FA-4069-94AB-2F34FDA22AA8}) (Version: 14.2 - Steganos Software GmbH)
Steganos Privacy Suite 14 (HKLM-x32\...\{9F07D3B6-3801-4C33-B20E-39CC29E63253}) (Version: 14.2.1 - Steganos Software GmbH)
Stickies 7.1d (HKLM-x32\...\ZhornStickies) (Version: - Zhorn Software)
StreamTransport version: 1.1.0.1 (HKLM-x32\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
StudioLine Photo Classic 3 SE (HKLM-x32\...\{53BDE9F4-79D1-4E2D-B7A4-4D3663419BAB}) (Version: 3.70.50.1 - H&M System Software)
SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.6.1020 - SUPERAntiSpyware.com)
SuperEasy Backup Pro (HKLM\...\SuperEasy Backup) (Version: 1.11 - SuperEasy Software GmbH & Co. KG)
SuperEasy Video Converter 2 v.2.1.3063 (HKLM-x32\...\{039BC111-5D42-BD22-5D57-C7073E40209A}_is1) (Version: 2.1.3063 - SuperEasy Software GmbH & Co. KG)
Switch Audiodatei-Konverter (HKLM-x32\...\Switch) (Version: - NCH Software)
Symantec Threat Monitor, Powered By DeepSight Screen Saver (HKLM-x32\...\Symantec Threat Monitor, Powered By DeepSight) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.0.3 - Synaptics Incorporated)
Telescope Driver (HKLM-x32\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
TreeSize Free V2.7 (HKLM-x32\...\TreeSize Free_is1) (Version: 2.7 - JAM Software)
Typograf 5.1f (HKLM-x32\...\Typograf) (Version: 5.1f - Neuber Software)
Verbose Text to Speech (HKLM-x32\...\Verbose) (Version: - NCH Software)
Video DVD Maker v3.30.0.75 (HKLM-x32\...\{1A3E23D7-7A1E-43EC-B35D-EB2A31BED943}) (Version: - )
VideoPad Video Editor (HKLM-x32\...\VideoPad) (Version: - NCH Software)
VirtualDJ Home FREE (HKLM-x32\...\{A6AC699F-8315-40CA-8F70-E917494978AB}) (Version: 7.4 - Atomix Productions)
VirusTotal Uploader 2.0 (HKLM-x32\...\VirusTotalUploader2.0) (Version: - )
watchmi (HKLM-x32\...\{F0559C5E-7912-4391-B1A0-6B975F0E5064}) (Version: 3.0.0 - Axel Springer Digital TV Guide GmbH)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (HKLM-x32\...\{57220148-3B2B-412A-A2E0-82B9DF423696}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (HKLM-x32\...\{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows Speech Recognition Macros (HKLM-x32\...\{8DC197D6-F4AB-44E0-ACF7-210355E6F389}) (Version: 1.0.6862.19 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows-Treiberpaket - Product Image (05/02/2002 1.0.1.1) (HKLM\...\F408A29B912DF89043C0C67FB04AE7CF4A67FF97) (Version: 05/02/2002 1.0.1.1 - Product)
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
Wise Care 365 Version 2.92 (HKLM-x32\...\{E864A1C8-EEE1-47D0-A7F8-00CC86D26D5E}_is1) (Version: 2.92 - WiseCleaner.com, Inc.)
WISE-FTP 7 (HKLM-x32\...\{3EAF3023-F780-46E5-8220-72F8DB87A7EB}_is1) (Version: - AceBIT GmbH)
Wondershare PDF Converter (Build 4.0.1) (HKLM-x32\...\{A888A8D1-ACCB-4EBE-AAA8-903D2B8FB6A4}_is1) (Version: 4.0.1 - Wondershare Software)
Wunderlist (HKLM-x32\...\{1cdbee75-ad10-47e7-b5c4-1f051f899978}) (Version: 2.3.0.30 - 6 Wunderkinder GmbH)
Wunderlist (x32 Version: 2.3.0.30 - 6 Wunderkinder GmbH) Hidden
ZDFmediathek Version 2.1.6 (HKLM\...\ZDFmediathek_is1) (Version: - ZDF)
==================== Restore Points =========================
18-02-2014 19:48:33 Geplanter Prüfpunkt
19-02-2014 13:19:00 Windows Update
22-02-2014 21:14:28 Installed iTunes
04-03-2014 14:22:08 Geplanter Prüfpunkt
04-03-2014 21:10:00 Windows Update
==================== Hosts content: ==========================
2009-07-14 03:34 - 2013-09-25 20:51 - 00000027 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {03094DBB-E3F2-4765-8557-51EB0230CDE0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {09710D90-1ACD-4C46-A9FA-2DEDE5D2A8E6} - \PC Performer_UPDATES No Task File
Task: {0D8F44A2-12F9-4D2D-810C-416C83F570A6} - System32\Tasks\{7F7E2F3B-EF44-43AA-9947-935E9B56B37C} => C:\Program Files (x86)\ColorPage-SF600\DigiScan.exe [2011-03-25] (PLUSTEK)
Task: {108CA268-9E3F-444E-940B-285A983F26EF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA => C:\Users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-21] (Google Inc.)
Task: {1253A9A4-F396-498A-8533-D5593CE77E41} - System32\Tasks\{86587C49-245F-4A8B-9A0A-486EB72072C1} => C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [2009-07-06] (AVM Berlin)
Task: {143E9C67-70DB-45A4-824C-F6F026A9BDD2} - System32\Tasks\{99E55DA8-7CB1-41BA-A0D1-C985A76C7213} => C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [2009-07-06] (AVM Berlin)
Task: {183F8C73-8574-4E3F-8D32-BDA5C03C02D1} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2012-10-29] (CyberLink Corp.)
Task: {1B03583D-7459-438E-9C4B-94427E564F6F} - System32\Tasks\RealCreateProcessScheduledTask160112530S-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\Real\RealPlayer\Update\RealOneMessageCenter.exe [2014-01-03] (RealNetworks, Inc.)
Task: {1B9BAE8E-8B76-4AC1-8D56-E9E0DC47238A} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {1CB02D47-A114-4C62-97DF-1D65A1922E38} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core => C:\Users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-21] (Google Inc.)
Task: {2606CB2B-19BF-4415-8EC1-2B0FC7C600B7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {347DB677-28B4-475A-91D5-030F4F7DAF3D} - System32\Tasks\Norton Internet Security CBE\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {34972354-32B6-4AA0-8B09-A11B6B59EC88} - System32\Tasks\{485E4FEF-32A1-4B05-8080-C4F815720167} => C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [2009-07-06] (AVM Berlin)
Task: {3AD1B4E5-F55E-41C2-AAA6-11129474AD39} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {557F0C11-B806-4D10-B325-CDAE6DEA71F4} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)
Task: {5B04776D-F2FC-4941-B435-DE63FB9B90BA} - System32\Tasks\{1D1A8A18-7950-41F2-BD97-5641FB750FB2} => C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [2009-07-06] (AVM Berlin)
Task: {5CABB6BD-B566-43A3-9C3D-B613061EFB03} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {5FAE9FF5-BC24-41EF-A40D-75730FA50529} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {64977427-E3EC-4FFB-A198-E75647183BA5} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {7235EFAA-2E9C-4F0C-8C4B-E2C291402287} - System32\Tasks\RegOrganizerQuickLaunch => C:\Program Files (x86)\Reg Organizer\RegOrganizer.exe [2013-11-29] (ChemTable Software)
Task: {7790F5CA-8F62-47E6-A91D-5E99D9D90CED} - System32\Tasks\{BB4D84AD-6D4A-4AE9-8BDD-6E099740DBD6} => C:\Program Files (x86)\ColorPage-SF600\DigiScan.exe [2011-03-25] (PLUSTEK)
Task: {82B8EC57-EBE3-44C0-9E69-B67E091D1FD6} - \DealPlyUpdate No Task File
Task: {931285BF-6214-464F-A5A4-C44F0B773B9C} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {96480441-EFC8-411C-8FA9-1D73D888B756} - System32\Tasks\{2DD33BBB-46F0-4858-A078-E254CE47E6B3} => C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [2009-07-06] (AVM Berlin)
Task: {A037188E-6F91-4AFD-84D8-97961F8C65D4} - System32\Tasks\AnVir Task Manager => C:\Program Files (x86)\AnVir Task Manager\anvir.exe [2013-12-04] (AnVir Software)
Task: {AB6EB7EA-CC34-42A8-AB2C-806E13212C6F} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\WSCStub.exe [2013-06-04] (Symantec Corporation)
Task: {AFCD851D-DBE8-4F3C-8654-A8E704EF6308} - \PC Performer_DEFAULT No Task File
Task: {B9C5450C-ADA4-4F8B-A70C-AA1EC55124AC} - \DealPlyLiveUpdateTaskMachineCore No Task File
Task: {BE3DD460-FECC-489E-AD28-B30A9B70A580} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {BFF44E6B-0E2B-40C4-87A7-48A8D337F257} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)
Task: {CBB5779C-CD71-4D3A-B6CC-565C1E5492AF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-11-23] (Piriform Ltd)
Task: {CDF3F9DD-47A6-4D1C-ACA3-4B69FEB88881} - System32\Tasks\{753244C6-DC45-427A-8BCE-FAF0BEDAC406} => C:\Program Files (x86)\ColorPage-SF600\DigiScan.exe [2011-03-25] (PLUSTEK)
Task: {DC3CED9C-938F-43F0-8C46-DF22E68F1BA1} - \PC Performer No Task File
Task: {DD9E7AF3-2FEC-4132-B34D-50DE9132323F} - System32\Tasks\Norton Internet Security CBE\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\SymErr.exe [2013-06-04] (Symantec Corporation)
Task: {E1904FFF-A3F8-4228-875A-C154A5B636C5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03] (Google Inc.)
Task: {FD471BF7-FFA8-4910-93CE-114A00866C72} - \DealPlyLiveUpdateTaskMachineUA No Task File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core.job => C:\Users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA.job => C:\Users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-02-22 17:36 - 2009-12-19 00:40 - 00104968 ____N () C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
2012-02-22 17:36 - 2011-10-13 23:38 - 00156672 ____N () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
2013-07-15 10:21 - 2011-08-22 12:44 - 01421216 _____ () C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO CORE TUNER 2\ACT2SERVICE.EXE
2013-08-21 06:22 - 2012-07-30 08:48 - 01518504 _____ () C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\AHDDC2_SERVICE.EXE
2012-12-05 19:36 - 2012-12-05 19:36 - 00022472 _____ () C:\PROGRAM FILES\OCSTER BACKUP\BIN\BACKUPSERVICE-OX.EXE
2012-12-05 19:36 - 2012-12-05 19:36 - 00103880 _____ () c:\Program Files\Ocster Backup\bin\backupServiceLib.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 10032584 _____ () c:\Program Files\Ocster Backup\bin\backupCore.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00051144 _____ () c:\Program Files\Ocster Backup\bin\lzmaUtil.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 03951560 _____ () c:\Program Files\Ocster Backup\bin\ox.dll
2012-06-12 16:15 - 2012-06-12 16:15 - 00049664 _____ () c:\Program Files\Ocster Backup\bin\lzma.dll
2012-06-12 16:15 - 2012-06-12 16:15 - 00285184 _____ () c:\Program Files\Ocster Backup\bin\party.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00111560 _____ () c:\Program Files\Ocster Backup\bin\scoolite.dll
2012-06-12 16:14 - 2012-06-12 16:14 - 00626688 _____ () c:\Program Files\Ocster Backup\bin\sqlite.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00486856 _____ () c:\Program Files\Ocster Backup\bin\veem.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00058824 _____ () c:\Program Files\Ocster Backup\bin\minizutil.dll
2012-06-12 16:14 - 2012-06-12 16:14 - 00020992 _____ () c:\Program Files\Ocster Backup\bin\zlibutil.dll
2012-06-11 20:41 - 2012-06-11 20:41 - 00076288 _____ () c:\Program Files\Ocster Backup\bin\zdll.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00155080 _____ () c:\Program Files\Ocster Backup\bin\deemon.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00203720 _____ () c:\Program Files\Ocster Backup\bin\netutil.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00467400 _____ () c:\Program Files\Ocster Backup\bin\twirl.dll
2012-06-11 21:17 - 2012-06-11 21:17 - 01266688 _____ () c:\Program Files\Ocster Backup\bin\LIBEAY32.dll
2012-06-11 21:17 - 2012-06-11 21:17 - 00236032 _____ () c:\Program Files\Ocster Backup\bin\SSLEAY32.dll
2012-12-05 19:36 - 2012-12-05 19:36 - 00335304 _____ () c:\Program Files\Ocster Backup\bin\tomb.dll
2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2012-02-22 19:09 - 2010-08-19 17:43 - 00386344 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2012-12-21 20:15 - 2010-09-30 14:00 - 00253264 ____N () C:\PROGRAM FILES (X86)\1&1 SURF-STICK\ASSISTANTSERVICES.EXE
2012-01-31 10:24 - 2012-01-31 10:24 - 00070144 ____N () C:\PROGRAM FILES (X86)\WATCHMI\TVDSERVICE.EXE
2012-05-03 08:55 - 2012-05-03 08:55 - 00059904 ____N () C:\Windows\assembly\GAC_MSIL\Tvd.Remote\3.0.0.8__f722db7bec59a14b\Tvd.Remote.dll
2012-05-03 08:55 - 2012-05-03 08:55 - 00034304 ____N () C:\Windows\assembly\GAC_MSIL\Tvd.Tools\3.0.0.8__f722db7bec59a14b\Tvd.Tools.dll
2012-05-03 08:55 - 2012-05-03 08:55 - 00009216 ____N () C:\Windows\assembly\GAC_MSIL\FingerPrint\1.0.0.0__a62e68e935d72fa6\FingerPrint.dll
2012-05-03 08:55 - 2012-05-03 08:55 - 00079360 ____N () C:\Windows\assembly\GAC_MSIL\Tvd.Reporting\3.0.0.8__f722db7bec59a14b\Tvd.Reporting.dll
2012-05-03 08:55 - 2012-05-03 08:55 - 00153088 ____N () C:\Windows\assembly\GAC_MSIL\Tvd.Aprico\3.0.0.8__f722db7bec59a14b\Tvd.Aprico.dll
2012-06-12 17:04 - 2012-06-12 17:04 - 00045056 _____ () c:\Program Files\Ocster Backup\bin\oxHelper.exe
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-02-22 17:36 - 2012-02-07 02:34 - 00823808 ____N () C:\PROGRAM FILES (X86)\PHOTKEY\PHOTKEY.EXE
2012-02-22 17:36 - 2010-01-13 02:36 - 00117256 ____N () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
2012-02-22 17:36 - 2010-01-13 02:36 - 00121864 ____N () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
2012-02-22 17:36 - 2010-12-17 23:04 - 00449032 ____N () C:\Program Files (x86)\PHotkey\ATouch64.exe
2012-02-22 17:36 - 2012-01-13 02:58 - 00552960 ____N () C:\Program Files (x86)\PHotkey\PVDesktop.exe
2012-02-22 17:36 - 2012-01-13 02:58 - 00477696 ____N () C:\PROGRAM FILES (X86)\PHOTKEY\PVDAGENT.EXE
2012-02-22 17:36 - 2011-12-21 00:08 - 03454464 ____N () C:\PROGRAM FILES (X86)\PHOTKEY\POSD.EXE
2012-02-21 23:09 - 2012-01-06 02:24 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-12-21 20:15 - 2010-09-30 14:00 - 00139088 ____N () C:\PROGRAM FILES (X86)\1&1 SURF-STICK\UIEXEC.EXE
2010-02-28 01:33 - 2010-02-28 01:33 - 00077664 ____N () C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\OFFICEVIRT.EXE
2013-07-15 10:21 - 2011-08-22 12:44 - 01421216 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe
2013-08-21 06:22 - 2012-07-30 08:48 - 01518504 _____ () C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-08-07 20:25 - 2013-08-07 20:25 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2013-09-04 14:30 - 2005-06-28 12:59 - 00053248 _____ () C:\Program Files (x86)\ArcSoft\PhotoImpression 5\share\pihook.dll
2012-12-21 20:15 - 2010-09-30 14:00 - 00253264 ____N () C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe
2013-06-09 09:07 - 2012-05-30 07:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY CBE\ENGINE\20.4.0.40\wincfi39.dll
2012-02-22 17:36 - 2012-02-07 02:34 - 00823808 ____N () C:\Program Files (x86)\PHotkey\PHotkey.exe
2012-02-22 17:36 - 2009-12-19 00:36 - 00973432 ____N () C:\Program Files (x86)\PHotkey\acAuth.dll
2012-02-22 17:36 - 2009-12-19 00:41 - 00129544 ____N () C:\Program Files (x86)\PHotkey\GFNEX.dll
2012-02-22 17:36 - 2011-12-21 00:08 - 03454464 ____N () C:\Program Files (x86)\PHotkey\POSD.exe
2010-08-04 00:39 - 2010-08-04 00:39 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-04 00:39 - 2010-08-04 00:39 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2012-12-21 20:15 - 2010-09-30 14:00 - 00139088 ____N () C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe
2014-02-19 14:42 - 2014-02-19 14:42 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\b162055347700182d96325676dd591c4\IsdiInterop.ni.dll
2012-02-21 23:36 - 2011-11-30 05:00 - 00059392 ____N () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-02-21 23:21 - 2011-12-16 10:39 - 01198872 ____N () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2010-02-28 01:33 - 2010-02-28 01:33 - 00077664 ____N () C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\Temp:AD022376
==================== Safe Mode (whitelisted) ===================
==================== Disabled items from MSCONFIG ==============
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orga-Nicer.lnk => C:\Windows\pss\Orga-Nicer.lnk.CommonStartup
==================== Faulty Device Manager Devices =============
Name: Apowersoft_AudioDevice
Description: Apowersoft_AudioDevice
Class Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}
Manufacturer: Apowersoft_AudioDevice
Service: Apowersoft_AudioDevice
Problem: : A driver (service) for this device has been disabled. An alternate driver may be providing this functionality (Code 32)
Resolution: The start type for this driver is set to disabled in the registry.
Uninstall the driver from Device Manager, and then scan for new hardware to install the driver again. If this does not work, you might have to change the device start type parameter in the registry.
==================== Event log errors: =========================
Application errors:
==================
Error: (03/06/2014 11:25:44 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/06/2014 11:25:05 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (03/06/2014 11:22:18 PM) (Source: AHDDC2_Service.exe) (User: )
Description: Cannot terminate an externally created thread
Error: (03/06/2014 10:00:20 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/06/2014 09:58:33 AM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24308590
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24308590
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (03/06/2014 07:07:42 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24307576
Error: (03/06/2014 07:07:42 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24307576
System errors:
=============
Error: (03/13/2014 06:43:36 AM) (Source: Service Control Manager) (User: )
Description: Dienst "Bluetooth Media Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (03/07/2014 07:41:45 AM) (Source: DCOM) (User: )
Description: {4EB61BAC-A3B6-4760-9581-655041EF4D69}
Error: (03/06/2014 11:24:46 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SPCA1528 Video Camera Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/06/2014 11:23:01 PM) (Source: Application Popup) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (03/06/2014 11:22:12 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst Steganos Volatile Disk konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (03/06/2014 09:58:20 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "SPCA1528 Video Camera Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/06/2014 09:57:56 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 06.03.2014 um 09:54:26 unerwartet heruntergefahren.
Error: (03/06/2014 09:56:05 AM) (Source: Application Popup) (User: )
Description: Treiber ACPI hat eine ungültige ID für das untergeordnete Gerät (1) zurückgegeben.
Error: (03/06/2014 09:55:05 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst EapHost erreicht.
Error: (03/06/2014 09:54:56 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst Steganos Volatile Disk konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Microsoft Office Sessions:
=========================
Error: (03/06/2014 11:25:44 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/06/2014 11:25:05 PM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (03/06/2014 11:22:18 PM) (Source: AHDDC2_Service.exe)(User: )
Description: Cannot terminate an externally created thread
Error: (03/06/2014 10:00:20 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/06/2014 09:58:33 AM) (Source: MemeoBackgroundService)(User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
--- Ende der internen Ausnahmestapelüberwachung ---
bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24308590
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24308590
Error: (03/06/2014 07:07:43 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (03/06/2014 07:07:42 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 24307576
Error: (03/06/2014 07:07:42 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 24307576
CodeIntegrity Errors:
===================================
Date: 2013-09-25 21:38:53.619
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-09-25 21:38:53.553
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Percentage of memory in use: 44%
Total physical RAM: 8086.48 MB
Available physical RAM: 4488.25 MB
Total Pagefile: 16171.15 MB
Available Pagefile: 13041.97 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Boot) (Fixed) (Total:414.66 GB) (Free:110.91 GB) NTFS
Drive d: (Recover) (Fixed) (Total:50 GB) (Free:19.74 GB) NTFS
Drive f: () (Removable) (Total:7.39 GB) (Free:7.39 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=415 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)
========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================
|
|
13.03.2014, 20:36
| #3 |
| /// the machine /// TB-Ausbilder    | chinesischer Dienst hi,
__________________Scan mit Combofix
__________________ |
|
14.03.2014, 07:32
| #4 |
| | chinesischer Dienst Hi, hier die Datei: Code:
ATTFilter ComboFix 14-03-13.01 - Bernhard 14.03.2014 0:44.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8086.5602 [GMT 1:00]
ausgeführt von:: c:\users\Bernhard\Desktop\PC\Trojanerboard\ComboFix.exe
AV: Norton Internet Security CBE *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security CBE *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security CBE *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-02-13 bis 2014-03-13 ))))))))))))))))))))))))))))))
.
.
2014-03-13 23:54 . 2014-03-13 23:54 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-03-13 23:54 . 2014-03-13 23:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-13 23:54 . 2014-03-13 23:54 -------- d-----w- c:\users\.wh..wh.plnk\AppData\Local\temp
2014-03-13 23:54 . 2014-03-13 23:54 -------- d-----w- c:\users\.wh..wh.orph\AppData\Local\temp
2014-03-13 04:46 . 2014-02-07 01:23 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-03-13 04:37 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-13 04:37 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-03-13 04:37 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-13 04:37 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-03-04 21:13 . 2014-03-04 21:13 -------- d-----w- c:\windows\Migration
2014-03-04 15:26 . 2014-03-04 15:26 -------- d-----w- c:\users\Bernhard\AppData\Roaming\NCH Software
2014-03-04 11:13 . 2014-03-04 11:13 -------- d-----w- c:\users\Bernhard\AppData\Roaming\SuperEasy Software
2014-03-04 11:13 . 2014-03-04 11:13 -------- d-----w- c:\programdata\SuperEasy Software
2014-03-04 11:13 . 2014-03-04 11:13 -------- d-----w- c:\programdata\Supereasy
2014-03-04 11:13 . 2014-03-04 11:13 -------- d-----w- c:\program files (x86)\SuperEasy Software
2014-03-04 06:31 . 2014-03-04 06:31 -------- d-----w- c:\program files (x86)\Common Files\Nokia
2014-03-04 06:29 . 2012-10-17 13:53 26112 ----a-w- c:\windows\system32\drivers\pccsmcfdx64.sys
2014-03-04 06:29 . 2014-03-04 06:29 -------- d-----w- c:\program files (x86)\PC Connectivity Solution
2014-02-23 16:08 . 2014-02-23 16:08 -------- d-----w- c:\users\Bernhard\AppData\Roaming\KC Softwares
2014-02-23 16:08 . 2013-03-20 21:36 151552 ----a-w- c:\windows\SysWow64\kmail.ocx
2014-02-23 16:08 . 2009-04-11 18:17 53248 ----a-w- c:\windows\SysWow64\kvblib.ocx
2014-02-23 16:08 . 2009-04-11 15:45 126976 ----a-w- c:\windows\SysWow64\kftp.ocx
2014-02-23 16:08 . 2008-04-14 03:31 128512 ----a-w- c:\windows\SysWow64\Dhtmled.ocx
2014-02-23 16:08 . 2003-04-01 06:36 94208 ----a-w- c:\windows\SysWow64\vbalIml6.ocx
2014-02-23 16:08 . 2003-01-26 14:41 40960 ----a-w- c:\windows\SysWow64\SSubTmr6.dll
2014-02-23 16:08 . 2002-06-08 18:09 204800 ----a-w- c:\windows\SysWow64\KTbar.ocx
2014-02-23 16:08 . 2001-04-05 18:43 94208 ----a-w- c:\windows\SysWow64\Msstkprp.dll
2014-02-23 16:08 . 2000-10-01 23:00 119568 ----a-w- c:\windows\SysWow64\VB6FR.dll
2014-02-23 16:08 . 2000-07-14 23:00 204907 ----a-w- c:\windows\SysWow64\TRIEDIT.DLL
2014-02-23 16:08 . 2014-02-23 16:08 -------- d-----w- c:\program files (x86)\KC Softwares
2014-02-22 21:18 . 2014-03-02 22:59 -------- d-----w- c:\users\Bernhard\AppData\Local\Apple Computer
2014-02-22 21:18 . 2012-08-21 12:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2014-02-22 21:16 . 2014-02-22 21:16 -------- d-----w- c:\program files\iPod
2014-02-22 21:16 . 2014-02-22 21:18 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-22 21:16 . 2014-02-22 21:18 -------- d-----w- c:\program files\iTunes
2014-02-22 21:16 . 2014-02-22 21:18 -------- d-----w- c:\program files (x86)\iTunes
2014-02-22 21:14 . 2014-02-22 21:14 -------- d-----w- c:\program files\Common Files\Apple
2014-02-22 21:13 . 2014-02-22 21:13 -------- d-----w- c:\program files\Bonjour
2014-02-22 21:13 . 2014-02-22 21:13 -------- d-----w- c:\program files (x86)\Bonjour
2014-02-19 13:23 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-19 13:23 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-12 07:32 . 2013-12-06 02:30 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-02-12 07:32 . 2013-12-06 02:02 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-13 23:25 . 2013-03-19 20:30 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-13 23:25 . 2013-03-19 20:30 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-04 18:09 . 2012-02-21 19:44 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-01-10 08:26 . 2012-05-27 13:28 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2014-01-10 08:26 . 2012-05-31 16:27 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2014-01-10 08:26 . 2012-05-27 13:27 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2014-01-09 09:58 . 2012-05-31 16:27 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2014-01-09 09:58 . 2012-05-27 13:27 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2014-01-08 08:18 . 2012-05-31 16:27 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2014-01-06 22:03 . 2014-01-06 22:03 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2014-01-03 18:27 . 2014-01-03 18:27 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2014-01-03 18:27 . 2014-01-03 18:27 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2013-12-23 07:00 . 2013-12-23 07:00 1948672 ----a-w- c:\windows\SysWow64\sx-csp.dll
2013-12-15 10:26 . 2013-12-15 10:26 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-15 10:26 . 2013-12-15 10:26 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-15 10:26 . 2013-12-15 10:26 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-15 10:26 . 2013-12-15 10:26 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-15 10:26 . 2013-12-15 10:26 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-15 10:26 . 2013-12-15 10:26 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-15 10:26 . 2013-12-15 10:26 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-15 10:26 . 2013-12-15 10:26 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-15 10:26 . 2013-12-15 10:26 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-15 10:26 . 2013-12-15 10:26 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-15 10:26 . 2013-12-15 10:26 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-15 10:26 . 2013-12-15 10:26 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-15 10:26 . 2013-12-15 10:26 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-15 10:26 . 2013-12-15 10:26 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-15 10:26 . 2013-12-15 10:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-15 10:26 . 2013-12-15 10:26 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-15 10:26 . 2013-12-15 10:26 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-15 10:26 . 2013-12-15 10:26 413696 ----a-w- c:\windows\system32\html.iec
2013-12-15 10:26 . 2013-12-15 10:26 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-15 10:26 . 2013-12-15 10:26 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-15 10:26 . 2013-12-15 10:26 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-15 10:26 . 2013-12-15 10:26 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-15 10:26 . 2013-12-15 10:26 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-15 10:26 . 2013-12-15 10:26 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-15 10:26 . 2013-12-15 10:26 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-15 10:26 . 2013-12-15 10:26 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-15 10:26 . 2013-12-15 10:26 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-15 10:26 . 2013-12-15 10:26 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-15 10:26 . 2013-12-15 10:26 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-15 10:26 . 2013-12-15 10:26 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-15 10:26 . 2013-12-15 10:26 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-15 10:26 . 2013-12-15 10:26 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-15 10:26 . 2013-12-15 10:26 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-15 10:26 . 2013-12-15 10:26 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-15 10:26 . 2013-12-15 10:26 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-15 10:26 . 2013-12-15 10:26 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-15 10:26 . 2013-12-15 10:26 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-15 10:26 . 2013-12-15 10:26 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-15 10:26 . 2013-12-15 10:26 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-15 10:26 . 2013-12-15 10:26 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-15 10:26 . 2013-12-15 10:26 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-15 10:26 . 2013-12-15 10:26 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-15 10:26 . 2013-12-15 10:26 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-15 10:26 . 2013-12-15 10:26 235520 ----a-w- c:\windows\system32\url.dll
2013-12-15 10:26 . 2013-12-15 10:26 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-15 10:26 . 2013-12-15 10:26 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-15 10:26 . 2013-12-15 10:26 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-15 10:26 . 2013-12-15 10:26 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-15 10:26 . 2013-12-15 10:26 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-15 10:26 . 2013-12-15 10:26 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-15 10:26 . 2013-12-15 10:26 101376 ----a-w- c:\windows\system32\inseng.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{F723BF1C-C826-44B0-A8E2-28BBA1C5D201}"= "c:\program files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent32.dll" [2013-12-23 384624]
.
[HKEY_CLASSES_ROOT\clsid\{f723bf1c-c826-44b0-a8e2-28bba1c5d201}]
[HKEY_CLASSES_ROOT\SX_PP7_PRO.IEBarBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{89C25FC3-6FFF-43E1-9A5A-DC2035FC2985}]
[HKEY_CLASSES_ROOT\SX_PP7_PRO.IEBarBand]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-05-03 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"SUPERAntiSpyware"="c:\program files\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE" [2014-01-21 6563608]
"SSS14 Browser Monitor"="c:\program files (x86)\Steganos Privacy Suite 14\SteganosBrowserMonitor.exe" [2013-12-18 70656]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-05 291608]
"Dolby Advanced Audio v2"="c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2011-12-21 507744]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2010-08-03 107816]
"UIExec"="c:\program files (x86)\1&1 Surf-Stick\UIExec.exe" [2010-09-30 139088]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848]
"AVMFBoxMonitor"="c:\program files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe" [2009-07-06 1503232]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Steganos HotKeys"="c:\program files (x86)\Steganos Privacy Suite 14\SteganosHotKeyService.exe" [2013-12-18 100864]
"SSS14 File Redirection Starter"="c:\program files (x86)\Steganos Privacy Suite 14\fredirstarter.exe" [2013-12-18 17920]
"TkBellExe"="c:\program files (x86)\Real\RealPlayer\update\realsched.exe" [2014-01-03 295512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
OfficeAdRemover.lnk - c:\program files (x86)\OfficeAdRemover\OfficeAdRemover.exe [2013-9-27 1321472]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled\
DigiScan.lnk - c:\program files (x86)\ColorPage-SF600\DigiScan.exe [2013-10-19 323584]
PhraseExpress.lnk - c:\program files (x86)\PhraseExpress\phraseexpress.exe [2013-3-16 14129360]
watchmi tray.lnk - c:\windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe [2012-5-3 300928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 Ca1528av;SPCA1528 Video Camera Service;c:\windows\system32\Drivers\Ca1528av.sys;c:\windows\SYSNATIVE\Drivers\Ca1528av.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 updatesvca;Update service for installed software;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 Bulk1528;SPCA1528 Still Camera Service;c:\windows\system32\Drivers\Bulk1528.sys;c:\windows\SYSNATIVE\Drivers\Bulk1528.sys [x]
R3 DfSdkS;Defragmentation-Service;c:\program files (x86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\DFSDKS64.EXE;c:\program files (x86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\DFSDKS64.EXE [x]
R3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 leawo_vad;Leawo Audio;c:\windows\system32\drivers\leawo_vad.sys;c:\windows\SYSNATIVE\drivers\leawo_vad.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
R3 supereasy_backup;SuperEasy Backup;c:\program files\SuperEasy Software\Backup Pro\bin\backupService-sezbp.exe;c:\program files\SuperEasy Software\Backup Pro\bin\backupService-sezbp.exe [x]
R3 SXDS10;soft Xpansion Dispatch Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 UI Assistant Service;UI Assistant Service;c:\program files (x86)\1&1 Surf-Stick\AssistantServices.exe;c:\program files (x86)\1&1 Surf-Stick\AssistantServices.exe [x]
R3 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe;c:\program files (x86)\watchmi\TvdService.exe [x]
R4 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
R4 CyberLink PowerDVD 10 MS Monitor Service;CyberLink PowerDVD 10 MS Monitor Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [x]
R4 CyberLink PowerDVD 10 MS Service;CyberLink PowerDVD 10 MS Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [x]
R4 DBService;DATA BECKER Update Service;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe;c:\program files (x86)\Common Files\DATA BECKER Shared\DBService.exe [x]
R4 FreemakeVideoCapture;FreemakeVideoCapture;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe;c:\program files (x86)\Freemake\CaptureLib\CaptureLibService.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20140214.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [x]
S1 ccSet_NIS;Norton Internet Security CBE Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20140312.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20140312.001\IDSvia64.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x]
S1 SLEE_18_DRIVER;Steganos Live Encryption Engine 18 [Driver];c:\windows\Sleen1864.sys;c:\windows\Sleen1864.sys [x]
S1 STGMFEngine64;Steganos RAM Disk Engine 64 Bit [Driver];c:\windows\system32\drivers\STGMFEngine64.sys;c:\windows\SYSNATIVE\drivers\STGMFEngine64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\NISx64\1404000.028\SYMNETS.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERANTISPYWARE\SASCORE64.EXE;c:\program files\SUPERANTISPYWARE\SASCORE64.EXE [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 ACT2_Service;Ashampoo Core Tuner 2 Service;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [x]
S2 ACT2PM;Ashampoo CoreTuner 2 ProcessMonitor Driver;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys;c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [x]
S2 AHDDC2;Ashampoo HDD Control 2 Service;c:\program files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe;c:\program files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe;c:\program files (x86)\PHotkey\GFNEXSrv.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]
S2 NIS;Norton Internet Security CBE;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [x]
S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys;c:\program files (x86)\PHotkey\PEGAGFN.sys [x]
S2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe;c:\windows\SYSNATIVE\PrintCtrl.exe [x]
S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 Steganos Volatile Disk;Steganos Volatile Disk;c:\windows\system32\STGRAMDiskHandler64.exe;c:\windows\SYSNATIVE\STGRAMDiskHandler64.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\drivers\iwdbus.sys;c:\windows\SYSNATIVE\drivers\iwdbus.sys [x]
S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys;c:\windows\SYSNATIVE\DRIVERS\rrnetcap.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 stdriver;SoundTap Filter Driver v6.05.00;c:\windows\system32\DRIVERS\stdriverx64.sys;c:\windows\SYSNATIVE\DRIVERS\stdriverx64.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Inhalt des "geplante Tasks" Ordners
.
2014-03-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-19 23:25]
.
2014-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03 07:55]
.
2014-03-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-03 07:55]
.
2014-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core.job
- c:\users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24 12:11]
.
2014-03-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA.job
- c:\users\Bernhard\AppData\Local\Google\Update\GoogleUpdate.exe [2012-10-24 12:11]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F723BF1C-C826-44B0-A8E2-28BBA1C5D201}"= "c:\program files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent64.dll" [2013-12-23 465520]
.
[HKEY_CLASSES_ROOT\CLSID\{F723BF1C-C826-44B0-A8E2-28BBA1C5D201}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-01-30 14:05 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-12 398104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-12 440600]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-01-31 12446824]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 1156712]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-12-20 11406608]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"Ashampoo Core Tuner 2"="c:\program files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2.exe" [2011-08-22 5220768]
"Ashampoo HDD-Control 2 Guard"="c:\program files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Guard.exe" [2012-07-30 3783592]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-10-22 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-10-22 3684488]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-ALDI SÜD Mah Jong - c:\windows\system32\Uninstall ALDI SÜD Mah Jong.exe
AddRemove-BroadCam - c:\program files (x86)\NCH Software\BroadCam\broadcam.exe
AddRemove-Debut - c:\program files (x86)\NCH Software\Debut\uninst.exe
AddRemove-Express - c:\program files (x86)\NCH Software\Express\express.exe
AddRemove-ExpressBurn - c:\program files (x86)\NCH Software\ExpressBurn\expressburn.exe
AddRemove-ExpressRip - c:\program files (x86)\NCH Software\ExpressRip\uninst.exe
AddRemove-Golden - c:\program files (x86)\NCH Software\Golden\golden.exe
AddRemove-MixPad - c:\program files (x86)\NCH Software\MixPad\uninst.exe
AddRemove-PhotoStage - c:\program files (x86)\NCH Software\PhotoStage\photostage.exe
AddRemove-Prism - c:\program files (x86)\NCH Software\Prism\uninst.exe
AddRemove-RealPlayer 16.0 - c:\program files (x86)\Real\RealPlayer\Update\r1puninst.exe
AddRemove-Recordpad - c:\program files (x86)\NCH Software\Recordpad\recordpad.exe
AddRemove-SoundTap - c:\program files (x86)\NCH Software\SoundTap\soundtap.exe
AddRemove-Switch - c:\program files (x86)\NCH Software\Switch\switch.exe
AddRemove-Symantec Threat Monitor, Powered By DeepSight - c:\windows\system32\Symantec Threat Monitor
AddRemove-Verbose - c:\program files (x86)\NCH Software\Verbose\verbose.exe
AddRemove-VideoPad - c:\program files (x86)\NCH Software\VideoPad\uninst.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\diMaster.dll\" /prefetch:1"
Binary file temp00 matches
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WiseBootAssistant ì#" ]
"ImagePath"="???????????????????????????"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.12"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_77.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WiseBootAssistant*ì#"*]
"Type"=dword:00000110
"Start"=dword:00000004
"ErrorControl"=dword:00000001
"ImagePath"=expand:"???????????????????????????"
"DisplayName"="????4????t\1a"
"WOW64"=dword:00000001
"ObjectName"="LocalSystem"
.
Zeit der Fertigstellung: 2014-03-14 00:58:30
ComboFix-quarantined-files.txt 2014-03-13 23:58
ComboFix2.txt 2013-09-25 19:58
.
Vor Suchlauf: 21 Verzeichnis(se), 115.460.341.760 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 116.575.813.632 Bytes frei
.
- - End Of File - - 871F6EFD5113FFAB5BE56A2AC5A0C1DC
|
|
15.03.2014, 11:27
| #5 |
| /// the machine /// TB-Ausbilder | chinesischer Dienst Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
16.03.2014, 00:33
| #6 |
| | chinesischer Dienst Hi, den unerwünschten Chinesen habe ich leider immer noch. Hier die Scans: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.15.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 11.0.9600.16521 Bernhard :: BERNHARD-PC [Administrator] 16.03.2014 00:09:44 mbam-log-2014-03-16 (00-09-44).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 315547 Laufzeit: 6 Minute(n), 37 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.022 - Bericht erstellt am 15/03/2014 um 19:04:35
# Aktualisiert 13/03/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Bernhard - BERNHARD-PC
# Gestartet von : C:\Users\Bernhard\Desktop\PC\Trojanerboard\März 2014\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Program Files (x86)\FoxTab
Ordner Gelöscht : C:\Users\Bernhard\AppData\Local\genienext
Ordner Gelöscht : C:\Users\Bernhard\AppData\Roaming\FoxTab
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\Solvusoft
Datei Gelöscht : C:\Users\Bernhard\Desktop\Search.lnk
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\supWPM
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.16521
-\\ Mozilla Firefox v27.0.1 (de)
[ Datei : C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\prefs.js ]
[ Datei : C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\ozs4r6mi.default-1390601509810\prefs.js ]
[ Datei : C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\uz4grcvl.default\prefs.js ]
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bgo8r7wn.default\prefs.js ]
-\\ Google Chrome v
[ Datei : C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\preferences ]
[ Datei : C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [23284 octets] - [27/09/2013 06:55:44]
AdwCleaner[R1].txt - [5349 octets] - [17/12/2013 12:19:34]
AdwCleaner[R2].txt - [1534 octets] - [17/12/2013 12:35:15]
AdwCleaner[R3].txt - [1594 octets] - [19/12/2013 15:26:13]
AdwCleaner[R4].txt - [2994 octets] - [02/02/2014 16:40:43]
AdwCleaner[R5].txt - [1775 octets] - [02/02/2014 17:59:06]
AdwCleaner[R6].txt - [1895 octets] - [02/02/2014 18:10:50]
AdwCleaner[R7].txt - [2906 octets] - [15/03/2014 14:14:02]
AdwCleaner[S0].txt - [21390 octets] - [27/09/2013 06:57:12]
AdwCleaner[S1].txt - [5053 octets] - [17/12/2013 12:21:12]
AdwCleaner[S2].txt - [3055 octets] - [02/02/2014 17:39:42]
AdwCleaner[S3].txt - [1836 octets] - [02/02/2014 18:01:41]
AdwCleaner[S4].txt - [1956 octets] - [02/02/2014 18:13:31]
AdwCleaner[S5].txt - [2829 octets] - [15/03/2014 19:04:35]
########## EOF - C:\AdwCleaner\AdwCleaner[S5].txt - [2889 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Bernhard on 15.03.2014 at 19:26:10,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\Bernhard\appdata\local\{268BE695-C3FF-48E8-BB4A-47F25503E168}
Successfully deleted: [Empty Folder] C:\Users\Bernhard\appdata\local\{2F7B114F-CCBB-4B27-B15F-F24BF329AA9E}
Successfully deleted: [Empty Folder] C:\Users\Bernhard\appdata\local\{5E869B9F-EB0E-4EAB-91D3-7523469DB4E8}
Successfully deleted: [Empty Folder] C:\Users\Bernhard\appdata\local\{6E47742B-600A-41F9-8690-6C77EE9FB975}
Successfully deleted: [Empty Folder] C:\Users\Bernhard\appdata\local\{C441B55B-0987-47FE-953B-174D02DFCF24}
~~~ FireFox
Emptied folder: C:\Users\Bernhard\AppData\Roaming\mozilla\firefox\profiles\kr8smgr0.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.03.2014 at 19:34:20,95
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Bernhard (administrator) on BERNHARD-PC on 15-03-2014 23:45:09
Running from C:\Users\Bernhard\Desktop\PC\Trojanerboard\März 2014
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
==================== Processes (Whitelisted) =================
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(SUPERAntiSpyware.com) C:\PROGRAM FILES\SUPERANTISPYWARE\SASCORE64.EXE
() C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO CORE TUNER 2\ACT2SERVICE.EXE
() C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\AHDDC2_SERVICE.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\WINDOWS\SYSWOW64\SVCHOST.EXE
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY CBE\ENGINE\20.4.0.40\CCSVCHST.EXE
(ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) C:\Windows\system32\PrintCtrl.exe
(ActMask Co.,Ltd - hxxp://www.all2pdf.com) C:\Windows\system32\PrintDisp.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(Softwareentwicklung Remus - ArchiCrypt) C:\Windows\SysWOW64\STGRAMDiskHandler64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\PROGRAM FILES\INTEL\WIFI\BIN\ZEROCONFIGSERVICE.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\PROGRAM FILES (X86)\MICROSOFT APPLICATION VIRTUALIZATION CLIENT\SFTLIST.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Program Files (x86)\PHotkey\ATouch64.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\PROGRAM FILES (X86)\PHOTKEY\PVDAGENT.EXE
() C:\PROGRAM FILES (X86)\PHOTKEY\POSD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(CyberLink Corp.) C:\PROGRAM FILES (X86)\CYBERLINK\YOUCAM\YOUCAMSERVICE.EXE
(Intel Corporation) C:\WINDOWS\SYSTEM32\HKCMD.EXE
(Intel Corporation) C:\WINDOWS\SYSTEM32\IGFXPERS.EXE
(Realtek Semiconductor) C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVCPL64.EXE
(Realtek Semiconductor) C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVBG64.EXE
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE
(Ashampoo Development GmbH & Co. KG) C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO CORE TUNER 2\ACT2.EXE
(Ashampoo Development GmbH & Co. KG) C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\AHDDC2_GUARD.EXE
(TODO: <Company name>) C:\PROGRAM FILES (X86)\PHOTKEY\HCSYNAPI.EXE
(Microsoft Corporation) C:\PROGRAM FILES\WINDOWS SIDEBAR\SIDEBAR.EXE
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\STEGANOSBROWSERMONITOR.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) USB 3.0 EXTENSIBLE HOST CONTROLLER DRIVER\APPLICATION\IUSB3MON.EXE
(CyberLink) C:\PROGRAM FILES (X86)\CYBERLINK\POWER2GO\CLMLSVC.EXE
() C:\PROGRAM FILES (X86)\1&1 SURF-STICK\UIEXEC.EXE
(Symantec Corporation) C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY CBE\ENGINE\20.4.0.40\CCSVCHST.EXE
(Hewlett-Packard) C:\PROGRAM FILES (X86)\HP\HP SOFTWARE UPDATE\HPWUSCHD2.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\STEGANOSHOTKEYSERVICE.EXE
(Steganos Software GmbH) C:\PROGRAM FILES (X86)\STEGANOS PRIVACY SUITE 14\FREDIRSTARTER.EXE
(RealNetworks, Inc.) C:\PROGRAM FILES (X86)\REAL\REALPLAYER\UPDATE\REALSCHED.EXE
(Intel(R) Corporation) C:\PROGRAM FILES\INTEL\BLUETOOTHHS\BTHSSECURITYMGR.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) RAPID STORAGE TECHNOLOGY\IASTORDATAMGRSVC.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) MANAGEMENT ENGINE COMPONENTS\LMS\LMS.EXE
(Intel Corporation) C:\PROGRAM FILES (X86)\INTEL\INTEL(R) MANAGEMENT ENGINE COMPONENTS\UNS\UNS.EXE
(Microsoft Corporation) C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\CVH.EXE
() C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VIRTUALIZATION HANDLER\OFFICEVIRT.EXE
(Microsoft Corporation) C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICESOFTWAREPROTECTIONPLATFORM\OSPPSVC.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-01-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1156712 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [11406608 2011-12-20] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-02-23] (Synaptics Incorporated)
HKLM\...\Run: [Ashampoo Core Tuner 2] - C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2.exe [5220768 2011-08-22] (Ashampoo Development GmbH & Co. KG)
HKLM\...\Run: [Ashampoo HDD-Control 2 Guard] - C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Guard.exe [3783592 2012-07-30] (Ashampoo Development GmbH & Co. KG)
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-10-22] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-10-22] (Crawler.com)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe [139088 2010-09-30] ()
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AVMFBoxMonitor] - C:\Program Files (x86)\FRITZ!Box Monitor\FRITZBoxMonitor.exe [1503232 2009-07-06] (AVM Berlin)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)
HKLM-x32\...\Run: [Steganos HotKeys] - C:\Program Files (x86)\Steganos Privacy Suite 14\SteganosHotKeyService.exe [100864 2013-12-18] (Steganos Software GmbH)
HKLM-x32\...\Run: [SSS14 File Redirection Starter] - C:\Program Files (x86)\Steganos Privacy Suite 14\fredirstarter.exe [17920 2013-12-18] (Steganos Software GmbH)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2014-01-03] (RealNetworks, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-05-03] (Google Inc.)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [SUPERAntiSpyware] - C:\PROGRAM FILES\SUPERANTISPYWARE\SUPERANTISPYWARE.EXE [6563608 2014-01-21] (SUPERAntiSpyware)
HKU\S-1-5-21-4070342091-3793343965-3738386277-1000\...\Run: [SSS14 Browser Monitor] - C:\Program Files (x86)\Steganos Privacy Suite 14\SteganosBrowserMonitor.exe [70656 2013-12-18] (Steganos Software GmbH)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No File
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - C:\Program Files (x86)\Steganos Privacy Suite 14\SPMIEToolbar64.dll (Steganos Software GmbH)
Toolbar: HKLM - Perfect Print 7 - {F723BF1C-C826-44B0-A8E2-28BBA1C5D201} - C:\Program Files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent64.dll (soft Xpansion)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Steganos Password Manager Toolbar - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - C:\Program Files (x86)\Steganos Privacy Suite 14\SPMIEToolbar.dll (Steganos Software GmbH)
Toolbar: HKLM-x32 - Perfect Print 7 - {F723BF1C-C826-44B0-A8E2-28BBA1C5D201} - C:\Program Files (x86)\soft Xpansion\Perfect Print 7 Express\ieagent32.dll (soft Xpansion)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default
FF Homepage: hxxp://www.gmx.net/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @protectdisc.com/NPPDLicenseHelper - C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft-Xpansion)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Bernhard\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Bernhard\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin ProgramFiles/Appdata: C:\Users\Bernhard\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Firefox Synchronisation Extension - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\synchronize@nokia.suite [2014-03-04]
FF Extension: DownloadHelper - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-02-12]
FF Extension: Ghostery - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\firefox@ghostery.com.xpi [2014-02-12]
FF Extension: NoScript - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-02-12]
FF Extension: Adblock Plus - C:\Users\Bernhard\AppData\Roaming\Mozilla\Firefox\Profiles\kr8smgr0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-12]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afext@anchorfree.com [2014-02-16]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-29]
FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-01-03]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\IPSFF [2013-10-09]
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] - C:\Program Files (x86)\Steganos Privacy Suite 14\spmplugin3
FF Extension: Steganos Password Manager - C:\Program Files (x86)\Steganos Privacy Suite 14\spmplugin3 [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{704E31A6-E680-48D0-BDEA-B0FE737AEB4D}] - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb
FF Extension: soft Xpansion Perfect Print 7 Express - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb [2013-12-23]
FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []
FF HKLM-x32\...\Thunderbird\Extensions: [{704E31A6-E680-48D0-BDEA-B0FE737AEB4D}] - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb
FF Extension: soft Xpansion Perfect Print 7 Express - C:\ProgramData\soft Xpansion\Perfect Print 7 Express\Data\fftb [2013-12-23]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-11-29]
Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Bernhard\AppData\Local\Google\Chrome\Application\29.0.1547.76\pdf.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (DealPlyLive Update) - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U25) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (Protect Disc License Acquisition Plugin) - C:\Program Files (x86)\ProtectDisc\License Helper\NPPDLicenseHelper.dll ()
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Plugin: (Citrix Online Web Deployment Plugin 1.0.0.104) - C:\Users\Bernhard\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
CHR Plugin: (Google Update) - C:\Users\Bernhard\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Users\Bernhard\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Extension: (Google Docs) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-05-10]
CHR Extension: (Google Drive) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-10]
CHR Extension: (YouTube) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-10]
CHR Extension: (Adblock Plus) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-09-27]
CHR Extension: (Google-Suche) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-10]
CHR Extension: (SpeedTao Download Helper) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\eifpflhplblejfpibogcnnepoldboioh [2013-09-27]
CHR Extension: (RealDownloader) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-09-26]
CHR Extension: (Norton Identity Protection) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-05-10]
CHR Extension: (Ghostery) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2014-03-02]
CHR Extension: (Chrome In-App Payments service) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (Google Mail) - C:\Users\Bernhard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-10]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\Exts\Chrome.crx [2014-02-02]
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\PROGRAM FILES\SUPERANTISPYWARE\SASCORE64.EXE [143088 2013-05-07] (SUPERAntiSpyware.com)
R2 ACT2_Service; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2Service.exe [1421216 2011-08-22] ()
R2 AHDDC2; C:\Program Files (x86)\Ashampoo\Ashampoo HDD Control 2\AHDDC2_Service.exe [1518504 2012-07-30] ()
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
S4 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
S4 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
S4 DBService; C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe [187456 2013-05-02] (DATA BECKER GmbH & Co KG)
S3 DfSdkS; C:\PROGRAM FILES (X86)\ASHAMPOO\ASHAMPOO HDD CONTROL 2\DFSDKS64.EXE [544768 2009-08-24] (mst software GmbH, Germany)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-13] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2011-12-08] ()
R2 NIS; C:\Program Files (x86)\Norton Internet Security CBE\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-10-22] (Crawler.com)
R2 Steganos Volatile Disk; C:\Windows\SysWOW64\STGRAMDiskHandler64.exe [450560 2013-07-17] (Softwareentwicklung Remus - ArchiCrypt)
S3 supereasy_backup; c:\Program Files\SuperEasy Software\Backup Pro\bin\backupService-sezbp.exe [24664 2013-11-21] ()
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-12-23] (soft Xpansion)
S3 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [253264 2010-09-30] ()
S2 updatesvca; C:\Windows\system32\updatesvca.dll [209920 2013-03-04] (Digital Dynamic)
S3 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [594704 2011-12-08] (Intel® Corporation)
S4 FreemakeVideoCapture; "C:\Program Files (x86)\Freemake\CaptureLib\CaptureLibService.exe" [X]
S4 楗敳潂瑯獁楳瑳湡tǬ"; 㩃停潲牧浡䘠汩獥⠠㡸⤶坜獩履楗敳䌠牡㘳尵潂瑯楔敭攮數 [X]
==================== Drivers (Whitelisted) ====================
R2 ACT2PM; C:\Program Files (x86)\Ashampoo\Ashampoo Core Tuner 2\ACT2ProcessMonitor64.sys [15160 2011-06-10] ()
S4 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2014-01-01] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [46792 2013-04-24] (AnchorFree Inc.)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\IPSDefs\20140313.001\IDSvia64.sys [524504 2014-03-06] (Symantec Corporation)
S3 leawo_vad; C:\Windows\System32\drivers\leawo_vad.sys [33048 2013-05-21] (Shenzhen Moyea Software)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140314.016\ENG64.SYS [126040 2014-03-14] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\Definitions\VirusDefs\20140314.016\EX64.SYS [2099288 2014-03-14] (Symantec Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527872 2007-11-08] (PixArt Imaging Inc.)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RRNetCap; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R3 RRNetCapMP; C:\Windows\System32\DRIVERS\rrnetcap.sys [37480 2013-04-24] (RapidSolution Software AG)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [109144 2013-11-18] (Softwareentwicklung Remus - ArchiCrypt - )
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-06] (Windows (R) Win 7 DDK provider)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R3 stdriver; C:\Windows\System32\DRIVERS\stdriverx64.sys [32536 2013-01-28] ()
R1 STGMFEngine64; C:\Windows\system32\drivers\STGMFEngine64.sys [28576 2013-07-17] (Softwareentwicklung Remus - ArchiCrypt.com)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-20] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [12400 1999-10-13] (Microsoft Corporation)
S3 Bulk1528; System32\Drivers\Bulk1528.sys [X]
S2 Ca1528av; System32\Drivers\Ca1528av.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-15 19:34 - 2014-03-15 19:34 - 00001309 _____ () C:\Users\Bernhard\Desktop\JRT.txt
2014-03-15 19:08 - 2014-03-15 19:08 - 00000056 _____ () C:\Windows\setupact.log
2014-03-15 19:08 - 2014-03-15 19:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-15 08:05 - 2014-03-15 08:05 - 00000588 _____ () C:\Users\Public\Desktop\Wondershare Data Recovery.lnk
2014-03-15 08:05 - 2014-03-15 08:05 - 00000000 ____D () C:\Users\Bernhard\Documents\My Data Files
2014-03-15 08:05 - 2014-03-15 08:05 - 00000000 ____D () C:\ProgramData\Wondershare
2014-03-15 07:32 - 2014-03-15 07:31 - 00001015 _____ () C:\Users\Bernhard\Documents\Linkliste (Automatisch gespeichert) (Automatisch gespeichert).xlsx.lnk
2014-03-14 00:58 - 2014-03-14 01:22 - 00000000 ____D () C:\Users\_ocster_backup_
2014-03-14 00:58 - 2014-03-14 00:58 - 00042138 _____ () C:\ComboFix.txt
2014-03-14 00:43 - 2014-03-14 00:58 - 00000000 ____D () C:\ComboFix
2014-03-13 05:47 - 2014-03-01 07:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-13 05:47 - 2014-03-01 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-13 05:47 - 2014-03-01 06:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-13 05:47 - 2014-03-01 05:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-13 05:47 - 2014-03-01 05:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-13 05:47 - 2014-03-01 05:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-13 05:47 - 2014-03-01 05:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-13 05:47 - 2014-03-01 05:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-13 05:47 - 2014-03-01 05:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-13 05:47 - 2014-03-01 05:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-13 05:47 - 2014-03-01 05:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-13 05:47 - 2014-03-01 05:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-13 05:47 - 2014-03-01 05:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-13 05:47 - 2014-03-01 05:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-13 05:47 - 2014-03-01 05:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-13 05:47 - 2014-03-01 05:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-13 05:47 - 2014-03-01 05:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-13 05:47 - 2014-03-01 04:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-13 05:47 - 2014-03-01 04:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-13 05:47 - 2014-03-01 04:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-13 05:47 - 2014-03-01 04:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-13 05:47 - 2014-03-01 04:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-13 05:47 - 2014-03-01 04:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-13 05:47 - 2014-03-01 04:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-13 05:47 - 2014-03-01 04:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-13 05:47 - 2014-03-01 04:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-13 05:47 - 2014-03-01 04:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-13 05:47 - 2014-03-01 04:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-13 05:47 - 2014-03-01 04:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-13 05:47 - 2014-03-01 04:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-13 05:47 - 2014-03-01 04:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-13 05:47 - 2014-03-01 04:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-13 05:47 - 2014-03-01 04:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-13 05:47 - 2014-03-01 04:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-13 05:47 - 2014-03-01 03:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-13 05:47 - 2014-03-01 03:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-13 05:47 - 2014-03-01 03:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-13 05:47 - 2014-03-01 03:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-13 05:47 - 2014-03-01 03:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-13 05:47 - 2014-03-01 03:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-03-13 05:47 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-13 05:47 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-13 05:47 - 2014-01-28 03:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-03-13 05:46 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-13 05:37 - 2014-02-04 03:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-03-13 05:37 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-13 05:37 - 2014-02-04 03:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-03-13 05:37 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-04 16:26 - 2014-03-04 16:26 - 00176128 _____ () C:\Users\Bernhard\Downloads\aacdec.exe
2014-03-04 16:26 - 2014-03-04 16:26 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\NCH Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00001359 _____ () C:\Users\Public\Desktop\Video Converter 2.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\Supereasy
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Program Files (x86)\SuperEasy Software
2014-03-04 07:32 - 2014-03-04 07:32 - 00002093 _____ () C:\Users\Public\Desktop\Nokia Suite.lnk
2014-03-04 07:29 - 2014-03-04 07:29 - 00000000 ____D () C:\Program Files (x86)\PC Connectivity Solution
2014-03-04 07:29 - 2012-10-17 14:53 - 00026112 _____ (Nokia) C:\Windows\system32\Drivers\pccsmcfdx64.sys
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\SanDisc
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\Neuer Ordner (2)
2014-02-23 17:08 - 2014-02-23 17:08 - 00001997 _____ () C:\Users\Bernhard\Desktop\K-ML.lnk
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\KC Softwares
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Program Files (x86)\KC Softwares
2014-02-23 17:08 - 2013-03-20 22:36 - 00151552 _____ (KC Softwares) C:\Windows\SysWOW64\kmail.ocx
2014-02-23 17:08 - 2009-04-11 19:17 - 00053248 _____ (Katarn Corp.) C:\Windows\SysWOW64\kvblib.ocx
2014-02-23 17:08 - 2009-04-11 16:45 - 00126976 _____ (KC Softwares) C:\Windows\SysWOW64\kftp.ocx
2014-02-23 17:08 - 2008-04-14 04:31 - 00128512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dhtmled.ocx
2014-02-23 17:08 - 2003-04-01 07:36 - 00094208 _____ (vbAccelerator) C:\Windows\SysWOW64\vbalIml6.ocx
2014-02-23 17:08 - 2003-01-26 15:41 - 00040960 _____ (vbAccelerator) C:\Windows\SysWOW64\SSubTmr6.dll
2014-02-23 17:08 - 2002-06-08 19:09 - 00204800 _____ (vbAccelerator) C:\Windows\SysWOW64\KTbar.ocx
2014-02-23 17:08 - 2001-04-05 19:43 - 00094208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Msstkprp.dll
2014-02-23 17:08 - 2000-10-02 00:00 - 00119568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6FR.dll
2014-02-23 17:08 - 2000-07-15 00:00 - 00204907 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TRIEDIT.DLL
2014-02-22 22:18 - 2014-03-02 23:59 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Apple Computer
2014-02-22 22:18 - 2014-02-22 22:18 - 00001787 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-22 22:18 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\Program Files\iTunes
2014-02-22 22:16 - 2014-02-22 22:18 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-22 22:16 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iPod
2014-02-22 22:14 - 2014-02-22 22:14 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-22 22:03 - 2014-02-22 22:10 - 148896080 _____ (Apple Inc.) C:\Users\Bernhard\Downloads\iTunes64Setup.exe
2014-02-19 14:37 - 2014-03-06 23:26 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-02-19 14:37 - 2014-03-06 23:26 - 00003246 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-02-19 14:23 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-19 14:23 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-16 13:38 - 2014-02-16 13:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
==================== One Month Modified Files and Folders =======
2014-03-15 23:45 - 2013-09-25 08:44 - 00000000 ____D () C:\FRST
2014-03-15 23:43 - 2012-05-03 08:49 - 02069753 _____ () C:\Windows\WindowsUpdate.log
2014-03-15 23:34 - 2012-05-03 08:55 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-15 23:33 - 2012-10-24 10:53 - 00001132 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA.job
2014-03-15 23:32 - 2013-06-04 06:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-15 23:32 - 2012-05-03 08:55 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-15 19:34 - 2014-03-15 19:34 - 00001309 _____ () C:\Users\Bernhard\Desktop\JRT.txt
2014-03-15 19:22 - 2013-09-27 06:55 - 00000000 ____D () C:\AdwCleaner
2014-03-15 19:17 - 2009-07-14 05:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-15 19:17 - 2009-07-14 05:45 - 00017264 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-15 19:13 - 2012-05-03 09:09 - 00000000 ____D () C:\Users\Bernhard\Documents\Youcam
2014-03-15 19:09 - 2014-01-06 23:03 - 00000000 ____D () C:\ProgramData\Spyware Terminator
2014-03-15 19:08 - 2014-03-15 19:08 - 00000056 _____ () C:\Windows\setupact.log
2014-03-15 19:08 - 2014-03-15 19:08 - 00000000 _____ () C:\Windows\setuperr.log
2014-03-15 19:08 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-15 19:06 - 2012-05-03 09:21 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SoftGrid Client
2014-03-15 14:12 - 2013-03-16 08:11 - 00000000 ____D () C:\Users\Bernhard\Documents\PhraseExpress
2014-03-15 09:14 - 2013-01-07 22:01 - 00000000 ____D () C:\Users\Bernhard\Desktop\Linklisten
2014-03-15 08:28 - 2012-10-24 10:53 - 00001080 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core.job
2014-03-15 08:05 - 2014-03-15 08:05 - 00000588 _____ () C:\Users\Public\Desktop\Wondershare Data Recovery.lnk
2014-03-15 08:05 - 2014-03-15 08:05 - 00000000 ____D () C:\Users\Bernhard\Documents\My Data Files
2014-03-15 08:05 - 2014-03-15 08:05 - 00000000 ____D () C:\ProgramData\Wondershare
2014-03-15 07:54 - 2012-05-24 18:46 - 00000000 ____D () C:\Users\Bernhard\Desktop\Exceldokumente
2014-03-15 07:44 - 2012-10-04 11:09 - 00000000 ____D () C:\Users\Bernhard\Desktop\Löschen
2014-03-15 07:41 - 2013-07-07 13:47 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Media Player Classic
2014-03-15 07:41 - 2013-01-28 14:33 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\FileZilla
2014-03-15 07:40 - 2013-05-10 14:06 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\CrashDumps
2014-03-15 07:40 - 2012-02-21 19:26 - 00000000 ____D () C:\Windows\Panther
2014-03-15 07:34 - 2013-03-16 06:09 - 00000000 ____D () C:\Users\Public\Documents\PhraseExpress
2014-03-15 07:31 - 2014-03-15 07:32 - 00001015 _____ () C:\Users\Bernhard\Documents\Linkliste (Automatisch gespeichert) (Automatisch gespeichert).xlsx.lnk
2014-03-15 06:11 - 2013-01-06 11:57 - 00000000 ____D () C:\Users\Bernhard\.freemind
2014-03-15 05:36 - 2012-08-27 00:20 - 00000000 ____D () C:\Users\Bernhard\Desktop\Coaches
2014-03-14 10:05 - 2012-02-21 19:50 - 00700134 _____ () C:\Windows\system32\perfh007.dat
2014-03-14 10:05 - 2012-02-21 19:50 - 00149984 _____ () C:\Windows\system32\perfc007.dat
2014-03-14 10:05 - 2009-07-14 06:13 - 01622236 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-14 07:40 - 2012-05-23 23:30 - 00000000 ____D () C:\Users\Bernhard\dwhelper
2014-03-14 01:22 - 2014-03-14 00:58 - 00000000 ____D () C:\Users\_ocster_backup_
2014-03-14 00:58 - 2014-03-14 00:58 - 00042138 _____ () C:\ComboFix.txt
2014-03-14 00:58 - 2014-03-14 00:43 - 00000000 ____D () C:\ComboFix
2014-03-14 00:58 - 2013-09-25 20:25 - 00000000 ____D () C:\Qoobox
2014-03-14 00:54 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-14 00:25 - 2013-06-04 06:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-14 00:25 - 2013-03-19 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-14 00:25 - 2013-03-19 21:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-13 08:09 - 2009-07-14 05:45 - 00408120 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-13 08:08 - 2013-03-19 06:11 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-13 08:08 - 2013-03-19 06:11 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-13 08:02 - 2012-05-03 09:20 - 01596516 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-03-13 07:45 - 2009-07-14 06:08 - 00032584 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-13 07:37 - 2013-05-06 14:27 - 00000000 ____D () C:\Program Files (x86)\Cobian Backup 11
2014-03-13 07:35 - 2013-05-11 14:01 - 00002180 _____ () C:\Windows\system32\log.xml
2014-03-13 07:35 - 2013-05-11 14:01 - 00000008 _____ () C:\Windows\system32\log-suffix.xml
2014-03-13 07:35 - 2013-05-11 13:59 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Ocster Backup
2014-03-13 07:28 - 2012-09-23 13:16 - 00000000 ____D () C:\Users\Bernhard\Desktop\TA
2014-03-13 07:27 - 2013-02-22 19:29 - 00000000 ____D () C:\Users\Bernhard\Desktop\WordPress Homepageerstellung
2014-03-13 07:22 - 2013-06-25 08:09 - 00000000 ____D () C:\Users\Bernhard\Desktop\Aktenschrank
2014-03-13 07:17 - 2012-06-04 22:21 - 00000000 ____D () C:\Users\Bernhard\Documents\Gesundheit
2014-03-13 06:22 - 2012-09-24 18:37 - 00000000 ____D () C:\Users\Bernhard\Desktop\PC
2014-03-13 06:20 - 2012-05-03 09:04 - 00103200 _____ () C:\Users\Bernhard\AppData\Local\GDIPFONTCACHEV1.DAT
2014-03-13 05:48 - 2013-09-02 15:34 - 00000000 ____D () C:\Program Files (x86)\Wondershare
2014-03-11 20:28 - 2012-10-18 09:48 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Mozilla
2014-03-06 23:26 - 2014-02-19 14:37 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-03-06 23:26 - 2014-02-19 14:37 - 00003246 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-4070342091-3793343965-3738386277-1000
2014-03-06 09:35 - 2013-01-11 09:46 - 00000000 ____D () C:\Users\Bernhard\Desktop\1
2014-03-04 22:11 - 2013-05-29 14:02 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-04 22:11 - 2013-05-29 14:02 - 00000000 ____D () C:\ProgramData\Skype
2014-03-04 16:26 - 2014-03-04 16:26 - 00176128 _____ () C:\Users\Bernhard\Downloads\aacdec.exe
2014-03-04 16:26 - 2014-03-04 16:26 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\NCH Software
2014-03-04 12:35 - 2013-01-17 18:47 - 00002382 _____ () C:\Users\Bernhard\Desktop\Google Chrome.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00001359 _____ () C:\Users\Public\Desktop\Video Converter 2.lnk
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\SuperEasy Software
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\ProgramData\Supereasy
2014-03-04 12:13 - 2014-03-04 12:13 - 00000000 ____D () C:\Program Files (x86)\SuperEasy Software
2014-03-04 10:55 - 2012-12-04 23:32 - 00000000 ____D () C:\Users\Bernhard\Documents\My Received Files
2014-03-04 07:44 - 2012-11-12 11:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Nokia Suite
2014-03-04 07:32 - 2014-03-04 07:32 - 00002093 _____ () C:\Users\Public\Desktop\Nokia Suite.lnk
2014-03-04 07:29 - 2014-03-04 07:29 - 00000000 ____D () C:\Program Files (x86)\PC Connectivity Solution
2014-03-04 07:29 - 2012-09-03 11:10 - 00000000 ____D () C:\Program Files (x86)\Nokia
2014-03-03 18:06 - 2013-04-19 08:55 - 00000000 ____D () C:\Users\Bernhard\Desktop\Lotuscafe
2014-03-03 18:00 - 2012-09-11 19:34 - 00000000 ____D () C:\Users\Bernhard\Desktop\Maria
2014-03-03 17:58 - 2012-06-04 22:18 - 00000000 ____D () C:\Users\Bernhard\Documents\Ulla
2014-03-03 01:19 - 2012-12-01 10:31 - 00000000 ____D () C:\Users\Bernhard\Desktop\P
2014-03-02 23:59 - 2014-02-22 22:18 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\Apple Computer
2014-03-02 21:09 - 2013-03-13 23:29 - 00003394 _____ () C:\Users\Bernhard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Apps deinstallieren - Chrome Web Store-Hilfe.lnk
2014-03-02 21:09 - 2013-03-13 23:29 - 00003386 _____ () C:\Users\Bernhard\Desktop\Apps deinstallieren - Chrome Web Store-Hilfe.lnk
2014-03-01 07:05 - 2014-03-13 05:47 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-01 06:17 - 2014-03-13 05:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-01 06:16 - 2014-03-13 05:47 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-03-01 05:58 - 2014-03-13 05:47 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-01 05:52 - 2014-03-13 05:47 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-03-01 05:51 - 2014-03-13 05:47 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-03-01 05:42 - 2014-03-13 05:47 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-01 05:40 - 2014-03-13 05:47 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-03-01 05:37 - 2014-03-13 05:47 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-01 05:33 - 2014-03-13 05:47 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-01 05:33 - 2014-03-13 05:47 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-03-01 05:32 - 2014-03-13 05:47 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-03-01 05:30 - 2014-03-13 05:47 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-03-01 05:23 - 2014-03-13 05:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-03-01 05:17 - 2014-03-13 05:47 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-03-01 05:11 - 2014-03-13 05:47 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-03-01 05:02 - 2014-03-13 05:47 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-03-01 04:54 - 2014-03-13 05:47 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-01 04:52 - 2014-03-13 05:47 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-03-01 04:51 - 2014-03-13 05:47 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-03-01 04:47 - 2014-03-13 05:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-03-01 04:43 - 2014-03-13 05:47 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-03-01 04:43 - 2014-03-13 05:47 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-03-01 04:42 - 2014-03-13 05:47 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-01 04:40 - 2014-03-13 05:47 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-03-01 04:38 - 2014-03-13 05:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-03-01 04:37 - 2014-03-13 05:47 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-03-01 04:35 - 2014-03-13 05:47 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-01 04:18 - 2014-03-13 05:47 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-01 04:16 - 2014-03-13 05:47 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-03-01 04:14 - 2014-03-13 05:47 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-03-01 04:10 - 2014-03-13 05:47 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-01 04:03 - 2014-03-13 05:47 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-03-01 04:00 - 2014-03-13 05:47 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-03-01 03:57 - 2014-03-13 05:47 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-03-01 03:38 - 2014-03-13 05:47 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-01 03:32 - 2014-03-13 05:47 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-03-01 03:27 - 2014-03-13 05:47 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-03-01 03:25 - 2014-03-13 05:47 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-03-01 03:25 - 2014-03-13 05:47 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-25 10:36 - 2014-01-09 11:35 - 00000959 _____ () C:\Users\Bernhard\Desktop\oCam.lnk
2014-02-25 10:36 - 2014-01-09 11:35 - 00000000 ____D () C:\Program Files (x86)\oCam
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\SanDisc
2014-02-24 15:05 - 2014-02-24 15:05 - 00000000 ____D () C:\Users\Bernhard\Desktop\Neuer Ordner (2)
2014-02-23 17:08 - 2014-02-23 17:08 - 00001997 _____ () C:\Users\Bernhard\Desktop\K-ML.lnk
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\KC Softwares
2014-02-23 17:08 - 2014-02-23 17:08 - 00000000 ____D () C:\Program Files (x86)\KC Softwares
2014-02-23 17:06 - 2014-02-09 12:06 - 00000000 ____D () C:\Users\Bernhard\AppData\Local\SuperEasy Backup
2014-02-22 22:19 - 2013-01-05 00:31 - 00000000 ____D () C:\Users\Bernhard\AppData\Roaming\Apple Computer
2014-02-22 22:18 - 2014-02-22 22:18 - 00001787 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iTunes
2014-02-22 22:18 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-22 22:16 - 2014-02-22 22:16 - 00000000 ____D () C:\Program Files\iPod
2014-02-22 22:16 - 2013-09-01 17:03 - 00000000 ____D () C:\ProgramData\Apple Computer
2014-02-22 22:14 - 2014-02-22 22:14 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-22 22:14 - 2013-01-04 22:14 - 00000000 ____D () C:\ProgramData\Apple
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files\Bonjour
2014-02-22 22:13 - 2014-02-22 22:13 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-02-22 22:10 - 2014-02-22 22:03 - 148896080 _____ (Apple Inc.) C:\Users\Bernhard\Downloads\iTunes64Setup.exe
2014-02-19 22:19 - 2012-05-03 08:55 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-19 22:19 - 2012-05-03 08:55 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-19 15:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-19 14:33 - 2014-02-09 12:06 - 00000000 ____D () C:\Users\_supereasy_backup_
2014-02-19 14:31 - 2013-03-19 16:39 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-18 17:08 - 2012-06-04 23:39 - 00000000 ____D () C:\Users\Bernhard\Documents\L
2014-02-16 13:39 - 2014-02-16 13:38 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 08:23 - 2012-10-24 10:53 - 00004108 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000UA
2014-02-16 08:23 - 2012-10-24 10:53 - 00003712 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4070342091-3793343965-3738386277-1000Core
Files to move or delete:
====================
C:\Users\Bernhard\AppData\Roaming\CamLayout.ini
C:\Users\Bernhard\AppData\Roaming\CamShapes.ini
C:\Users\Bernhard\AppData\Roaming\CamStudio.Producer.Data.ini
Some content of TEMP:
====================
C:\Users\Bernhard\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-10 12:04
==================== End Of Log ============================
--- --- --- |
|
16.03.2014, 17:53
| #7 |
| /// the machine /// TB-Ausbilder | chinesischer Dienst Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S4 楗敳潂瑯獁楳瑳湡tǬ"; 㩃停潲牧浡䘠汩獥⠠㡸⤶坜獩履楗敳䌠牡㘳尵潂瑯楔敭攮數 [X]
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.03.2014, 08:38
| #8 |
| | chinesischer Dienst Spielt es eine Rolle in welcher Codierung ich die Fixlist.txt speichere? Mit der Standardkodierung ANSI werden die chinesischen Buchstaben nur als Fragezeichen dargestellt. Code:
ATTFilter S4 ????????tO"; ??????????????????????????? [X]
|
|
18.03.2014, 09:58
| #9 |
| /// the machine /// TB-Ausbilder | chinesischer Dienst Möglich, nimm die andere Codierung oder versuch es mal mit Notepad++
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu chinesischer Dienst |
| administrator, adobe, adobe flash player, chinesischer dienst, combofix, converter, desktop, download, entfernen, explorer, flash player, google, home, hotspot, iexplore.exe, mozilla, ordner, realtek, registry, scan, security, symantec, system, taskmanager, temp, usb, winlogon.exe |
WARNUNG an die MITLESER: 
