| |
| |||||||
Log-Analyse und Auswertung: TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
07.04.2015, 20:47
| #1 |
 |  TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, schon seit mehreren Tagen meldet Avira Free Antivirus "TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden" Ein Verschieben in Quarantäne bringt nichts, am nächsten Tag kommt die gleiche Meldung wieder. Daher habe mich entschlossen, dieses Problem intensiver anzugehen. Meine Logfiles: Antivir: Code:
ATTFilter Exportierte Ereignisse:
07.04.2015 20:41 [System-Scanner] Malware gefunden
Die Datei
'C:\ProgramData\Packercc56729e-9fc2-4c79-a5a8-77edc7087390\Files\Product\Product
.exe'
enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '489faac3.qua'
verschoben!
07.04.2015 20:41 [System-Scanner] Malware gefunden
Die Datei
'C:\$Recycle.Bin\S-1-5-21-1291533527-3129815193-1259002340-1002\$RH4LF23.log'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1a3ff04c.qua'
verschoben!
07.04.2015 20:41 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50038516.qua'
verschoben!
07.04.2015 16:06 [System-Scanner] Malware gefunden
Die Datei 'C:\Program Files (x86)\ProductUI\Startup.exe'
enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3ada0548.qua'
verschoben!
07.04.2015 16:05 [System-Scanner] Malware gefunden
Die Datei 'C:\Program Files (x86)\ProductUI\chrm.dll'
enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5fa22e30.qua'
verschoben!
07.04.2015 16:05 [System-Scanner] Malware gefunden
Die Datei 'C:\Users\Jana\AppData\Local\RGMService\umowi.dll'
enthielt einen Virus oder unerwünschtes Programm 'TR/Agent.6225408.2' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5033490f.qua'
verschoben!
07.04.2015 16:05 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Jana\AppData\Local\RGMService\umowi.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Agent.6225408.2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\ProductUI\chrm.dll'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\ProductUI\Startup.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Program Files (x86)\ProductUI\Startup.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Jana\AppData\Local\RGMService\umowi.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Agent.6225408.2' [trojan]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Users\Jana\AppData\Local\RGMService\umowi.dll'
wurde ein Virus oder unerwünschtes Programm 'TR/Agent.6225408.2' [trojan]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:03 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:02 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\13078.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:01 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
07.04.2015 16:01 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
04.04.2015 19:37 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde erfolgreich überschrieben!
Die Datei wurde gelöscht.
04.04.2015 19:35 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\27636.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
04.04.2015 19:35 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
04.04.2015 19:34 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
02.04.2015 17:17 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5062c894.qua'
verschoben!
02.04.2015 17:09 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\24515.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
02.04.2015 17:09 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\24515.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
02.04.2015 17:09 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
02.04.2015 17:08 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
31.03.2015 19:45 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4_virus.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Übergeben an Scanner
31.03.2015 19:45 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4_virus.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
31.03.2015 19:43 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\14718.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
31.03.2015 19:43 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
31.03.2015 19:42 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.03.2015 19:32 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50382a2a.qua'
verschoben!
30.03.2015 19:30 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\25057.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.03.2015 19:30 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
30.03.2015 19:30 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
29.03.2015 16:10 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '56289963.qua'
verschoben!
29.03.2015 16:06 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Übergeben an Scanner
29.03.2015 16:06 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
26.03.2015 19:37 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\23602.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
26.03.2015 19:37 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
26.03.2015 19:36 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
25.03.2015 19:42 [System-Scanner] Malware gefunden
Die Datei 'C:\Windows\Temp\Setup_4.exe'
enthielt einen Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '501b9695.qua'
verschoben!
25.03.2015 19:16 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\32371.exe'
wurde ein Virus oder unerwünschtes Programm 'PUA/Linkury.Gen' [riskware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
25.03.2015 19:16 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
25.03.2015 19:16 [Echtzeit-Scanner] Malware gefunden
In der Datei 'C:\Windows\Temp\Setup_4.exe'
wurde ein Virus oder unerwünschtes Programm 'TR/Dropper.Gen' [trojan] gefunden.
Ausgeführte Aktion: Zugriff verweigern
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:49 on 07/04/2015 (Jana)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Jana (administrator) on JANA-PC on 07-04-2015 20:51:26
Running from C:\Users\Jana\Desktop
Loaded Profiles: Jana (Available profiles: Jana)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe
(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
() C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\taxaktuell.exe
(Dropbox, Inc.) C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Cherry GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avshadow.exe
(Cherry, Auerbach Germany, www.cherry.de) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Users\Jana\AppData\Local\RGMService\RGMUpdater.exe
() C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-02-12] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
HKLM-x32\...\Run: [avgnt] => C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [UVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341488 2007-03-03] (InterVideo Digital Technology Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [282624 2006-09-01] (Apple Computer, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [CherryKeyMan] => C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [237620 2006-08-02] (Cherry GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [Browser Infrastructure Helper] => C:\Users\Jana\AppData\Local\Smartbar\Application\Smartbar.exe startup
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-10-03] (TomTom)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc0rwAxCjgf3DIUGojBAsN65_RTFqL10pczrtWJFei_2s9e_cbNdMEkk49TUrc3z29-wU5wThob0LmNkgNhAfZMD50V1KRK9w,,
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-07-31] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
BHO-x32: Avira SearchFree Toolbar plus Web Protection -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-07-31] (Oracle Corporation)
BHO-x32: Web Check -> {E155F23C-9931-47c6-A619-20E6FCA86D75} -> C:\Program Files (x86)\Web Check\WebCheck.dll [2013-08-12] (Web Check)
Toolbar: HKLM - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\PDF Creater\Free PDF Perfect\ieagent64.dll [2013-08-27] (soft Xpansion)
Toolbar: HKLM - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll No File
Toolbar: HKLM-x32 - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\PDF Creater\Free PDF Perfect\ieagent32.dll [2013-08-27] (soft Xpansion)
Toolbar: HKLM-x32 - Yahoo Community Smartbar (by Linkury) - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058
FF SelectedSearchEngine: WEB.DE Suche
FF Homepage: www.google.de
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 5);
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll [2013-08-02] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll [2013-08-02] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-07-31] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\Freemium\np-sxpdf.dll [2013-08-27] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-02-16] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\11-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\avira-safesearch.xml [2015-03-01]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\englische-ergebnisse.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\gmx-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\lastminute.xml [2014-05-23]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\webde-suche.xml [2014-06-04]
FF Extension: Avira Browser Safety - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\abs@avira.com [2015-03-31]
FF Extension: DKB-Cashback - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\crossriderapp16150@crossrider.com [2015-03-02]
FF Extension: Avira SafeSearch - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\safesearch@avira.com [2015-03-01]
FF Extension: NoScript - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-03]
FF Extension: Adblock Plus - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-03]
FF HKLM-x32\...\Firefox\Extensions: [{52b0f3db-f988-4788-b9dc-861d016f4487}] - C:\Program Files (x86)\Web Check\WebCheck.xpi
FF Extension: Web Check - C:\Program Files (x86)\Web Check\WebCheck.xpi [2013-08-12]
FF HKLM-x32\...\Firefox\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF Extension: Free PDF Perfect - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013-08-27]
FF HKLM-x32\...\Thunderbird\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [573486 2006-06-27] (Cherry, Auerbach Germany, www.cherry.de) [File not signed]
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
R2 RGMUpdater; C:\Users\Jana\AppData\Local\RGMService\RGMUpdater.exe [85504 2015-03-26] () [File not signed]
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-27] (soft Xpansion)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-04] (Avira Operations GmbH & Co. KG)
S3 Ch64USBM; C:\Windows\System32\drivers\Ch64USBM.sys [91008 2006-06-02] (Cherry GmbH)
S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [8192 2005-03-28] ()
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-07 20:51 - 2015-04-07 20:51 - 00023763 _____ () C:\Users\Jana\Desktop\FRST.txt
2015-04-07 20:51 - 2015-04-07 20:51 - 00000000 ____D () C:\FRST
2015-04-07 20:50 - 2015-04-07 20:50 - 02095616 _____ (Farbar) C:\Users\Jana\Desktop\FRST64.exe
2015-04-07 20:49 - 2015-04-07 20:49 - 00000470 _____ () C:\Users\Jana\Desktop\defogger_disable.log
2015-04-07 20:49 - 2015-04-07 20:49 - 00000000 _____ () C:\Users\Jana\defogger_reenable
2015-04-07 20:44 - 2015-04-07 20:44 - 00050477 _____ () C:\Users\Jana\Desktop\Defogger.exe
2015-04-07 16:03 - 2015-04-07 16:06 - 00000000 ____D () C:\Program Files (x86)\ProductUI
2015-04-07 16:03 - 2015-04-07 16:03 - 00000000 ____D () C:\ProgramData\Packercc56729e-9fc2-4c79-a5a8-77edc7087390
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-04 19:55 - 2015-04-07 16:02 - 00000000 ____D () C:\Program Files\Thunderbird
2015-03-30 19:42 - 2015-03-30 19:42 - 00001706 _____ () C:\Users\Jana\Desktop\avcenter.exe - Verknüpfung.lnk
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Users\Jana\AppData\Local\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V
2015-03-25 20:52 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\MyDrive Connect
2015-03-25 20:51 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\TomTom
2015-03-25 20:24 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 20:24 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-21 21:42 - 2015-03-21 21:42 - 00000000 ____D () C:\Program Files\Firefox
2015-03-11 20:01 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 20:01 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 20:01 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 20:01 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 20:01 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 20:01 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 20:01 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 20:01 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 20:01 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 02644992 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 20:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 20:01 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 20:01 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 20:01 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 20:01 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 20:01 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 20:01 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 20:01 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 20:01 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 20:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 20:01 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 20:01 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 20:01 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 20:01 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 20:01 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 20:01 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 20:01 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 20:01 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 20:01 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 20:00 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 20:00 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 20:00 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 20:00 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 20:00 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 20:00 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 20:00 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 20:00 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 20:00 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 20:00 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 20:00 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 20:00 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 20:00 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 20:00 - 2015-02-21 21:17 - 17882624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 20:00 - 2015-02-21 21:07 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-11 20:00 - 2015-02-21 21:02 - 10931200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 20:00 - 2015-02-21 21:00 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 20:00 - 2015-02-21 20:54 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 20:00 - 2015-02-21 20:54 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 20:00 - 2015-02-21 20:53 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 20:00 - 2015-02-21 20:52 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-11 20:00 - 2015-02-21 20:52 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 20:00 - 2015-02-21 20:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 02157568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00598528 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-11 20:00 - 2015-02-21 20:50 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 20:00 - 2015-02-21 20:50 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 20:00 - 2015-02-21 20:50 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 20:00 - 2015-02-21 20:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-11 20:00 - 2015-02-21 19:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 20:00 - 2015-02-21 19:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-03-11 20:00 - 2015-02-21 19:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 20:00 - 2015-02-21 19:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-11 20:00 - 2015-02-21 19:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 20:00 - 2015-02-21 19:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 20:00 - 2015-02-21 19:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 20:00 - 2015-02-21 19:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-03-11 20:00 - 2015-02-21 19:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 20:00 - 2015-02-21 19:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 20:00 - 2015-02-21 19:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-03-11 20:00 - 2015-02-21 19:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-03-11 20:00 - 2015-02-21 19:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 20:00 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 20:00 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 20:00 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 20:00 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 20:00 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 19:59 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 19:59 - 2015-02-04 05:16 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 19:59 - 2015-02-04 04:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 19:59 - 2015-02-03 05:31 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 19:59 - 2015-02-03 05:12 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 19:59 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 19:59 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-10 20:57 - 2015-03-25 20:46 - 00000000 ____D () C:\Program Files\Firefox.bak
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-07 20:49 - 2013-03-01 17:59 - 00000000 ____D () C:\Users\Jana
2015-04-07 20:16 - 2013-03-01 17:54 - 01723432 _____ () C:\Windows\WindowsUpdate.log
2015-04-07 20:03 - 2014-12-09 20:19 - 00000000 ____D () C:\Users\Jana\AppData\Local\RGMService
2015-04-07 16:08 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-07 16:08 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-07 16:05 - 2010-11-21 08:50 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-04-07 16:05 - 2010-11-21 08:50 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-04-07 16:05 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-07 16:02 - 2014-10-05 20:32 - 00000000 ___RD () C:\Users\Jana\Dropbox
2015-04-07 16:02 - 2014-10-05 20:24 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Dropbox
2015-04-07 16:02 - 2013-03-01 20:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 15:59 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-07 15:58 - 2009-07-14 06:51 - 00144753 _____ () C:\Windows\setupact.log
2015-04-04 20:49 - 2013-11-19 20:30 - 05842220 _____ () C:\Windows\IE11_main.log
2015-04-04 20:47 - 2013-03-01 22:54 - 00000000 ____D () C:\Users\Jana\Excel
2015-04-02 17:05 - 2010-11-21 05:47 - 00466476 _____ () C:\Windows\PFRO.log
2015-04-01 14:02 - 2013-03-02 21:20 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Avira
2015-04-01 14:02 - 2013-03-02 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-04-01 14:01 - 2014-08-07 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-26 15:17 - 2014-12-11 20:22 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 15:17 - 2014-04-30 14:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-21 21:21 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-19 20:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 21:28 - 2013-03-20 14:36 - 00000000 ____D () C:\Program Files (x86)\Media Markt Fotoservice
2015-03-17 20:45 - 2013-03-01 22:52 - 00000000 ____D () C:\Users\Jana\Baby
2015-03-17 20:11 - 2014-10-05 20:32 - 00001021 _____ () C:\Users\Jana\Desktop\Dropbox.lnk
2015-03-17 20:11 - 2014-10-05 20:31 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-12 20:16 - 2009-07-14 06:45 - 00459640 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 20:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 20:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-11 21:02 - 2013-03-02 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 21:02 - 2009-07-14 04:34 - 00000627 _____ () C:\Windows\win.ini
2015-03-11 20:56 - 2013-08-15 20:08 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 20:50 - 2011-04-27 13:44 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2013-08-20 22:07 - 2013-08-20 22:07 - 0007597 _____ () C:\Users\Jana\AppData\Local\Resmon.ResmonCfg
Some content of TEMP:
====================
C:\Users\Jana\AppData\Local\Temp\avgnt.exe
C:\Users\Jana\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuasurx.dll
C:\Users\Jana\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Jana\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Jana\AppData\Local\Temp\ertvwl00.dll
C:\Users\Jana\AppData\Local\Temp\Execute2App.exe
C:\Users\Jana\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Jana\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Jana\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Jana\AppData\Local\Temp\lvid_lvid.exe
C:\Users\Jana\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Jana\AppData\Local\Temp\msvcp90.dll
C:\Users\Jana\AppData\Local\Temp\msvcr90.dll
C:\Users\Jana\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Jana\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Jana\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Jana\AppData\Local\Temp\w9neuawj.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-07 18:24
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Jana at 2015-04-07 20:52:03
Running from C:\Users\Jana\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 5.0 Sprint Plus (HKLM-x32\...\{D1696920-9794-4BBC-8A30-7A88763DE5A2}) (Version: 5.0.0.3501 - ABBYY Software House)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.02) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.02 - Adobe Systems Incorporated)
Adobe SVG Viewer (HKLM-x32\...\Adobe SVG Viewer) (Version: 1.0 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.18.0 - Ask.com) <==== ATTENTION
Avira (HKLM-x32\...\{df495620-2ba9-412d-828d-b27f020d9fc8}) (Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Avira SearchFree Toolbar plus Web Protection Updater (HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.4.37268 - Ask.com) <==== ATTENTION
Bing Bar (HKLM-x32\...\{16793295-2366-40F7-A045-A3E42A81365E}) (Version: 7.1.362.0 - Microsoft Corporation)
CameraHelperMsi (x32 Version: 13.31.1038.0 - Logitech) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
Cherry Keyboard Manager V3.0 Build 16 (HKLM-x32\...\{DC627AE5-A2B1-4D16-AF56-178D10EC3E81}) (Version: 3.0.0.16 - Cherry GmbH)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
EPSON Copy Utility (HKLM-x32\...\{B69CC1A5-0404-11D6-ABCB-005004C21D30}) (Version: - )
EPSON Photo Print (HKLM-x32\...\{1349B2BD-3B1E-4D25-BF6E-1BBAE2DD2F67}) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON Smart Panel (HKLM-x32\...\{6C11D561-620B-47DA-A693-4C597F3CDF40}) (Version: - )
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evrsoft First Page 2006 (HKLM-x32\...\Evrsoft First Page 2006_is1) (Version: - Evrsoft)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Free Pdf Perfect Prereq (HKLM-x32\...\{8a8f0ec0-a24b-4eb8-b811-2cf05c4d1c85}) (Version: 1.1.0.80 - Covus Freemium GmbH)
Free Pdf Perfect Prereq (x32 Version: 1.1.0.80 - Covus Freemium GmbH) Hidden
Free Video to DVD Converter version 5.0.45.806 (HKLM-x32\...\Free Video to DVD Converter_is1) (Version: 5.0.45.806 - DVDVideoSoft Ltd.)
Freemium Free PDF Perfect (HKLM-x32\...\{88265079-D6F4-4292-86BE-D2053E80BFE4}) (Version: 1.0 - Freemium)
Galería de fotos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Hessen 3D (HKLM-x32\...\Hessen 3D) (Version: - )
InterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)
Java 7 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.250 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}) (Version: 12.0.1.340 - Kaspersky Lab)
Kaspersky Security Scan (x32 Version: 12.0.1.340 - Kaspersky Lab) Hidden
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version: - )
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)
LPT System Updater Service (x32 Version: 1.0.0.0 - LPT) Hidden <==== ATTENTION
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Media Markt Fotoservice 4.4 (HKLM-x32\...\Media Markt Fotoservice_is1) (Version: - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Nero 6 Demo (HKLM-x32\...\Nero - Burning Rom!UninstallKey) (Version: - )
Perf4870 Referenzhandbuch (HKLM-x32\...\Perf4870 Referenzhandbuch) (Version: - )
QuickTime (HKLM-x32\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
RGMUpdater Monetization Control (HKLM-x32\...\RGMUpdater Monetization Controlcc56729e-9fc2-4c79-a5a8-77edc7087390) (Version: 2.2.0322.1140 - )
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden
ScanToWeb (HKLM-x32\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)
SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) Hidden
System Checkup 3.5 (HKLM-x32\...\{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1) (Version: 3.5.1.17 - iolo technologies, LLC)
t@x 2014 (HKLM-x32\...\{2547CF96-DBB7-4EDD-9327-0EFDD0D1FA8A}) (Version: 21.00.8480 - Buhl Data Service GmbH)
tax 2015 (HKLM-x32\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH)
TL-WN751ND Driver (HKLM-x32\...\{14770694-6C1C-4137-95F9-6F934D8491B4}) (Version: 1.00.0000 - TP-LINK)
Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)
VideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Web Check (HKLM-x32\...\Web Check) (Version: - )
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Yahoo Community Smartbar (HKLM-x32\...\{3BC7022B-CDE0-4664-9AB6-E3EC25CE644A}) (Version: 11.63.66.17714 - Linkury Inc.) <==== ATTENTION
Yahoo Community Smartbar Engine (HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\{cd9bd505-38ef-4dcb-a40a-20ec126d708d}) (Version: 11.63.66.17714 - Linkury Inc.) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
25-03-2015 23:20:08 Windows Update
26-03-2015 15:50:23 Windows Update
26-03-2015 20:58:40 Windows Update
29-03-2015 16:24:38 Windows Update
30-03-2015 14:46:43 Windows Update
30-03-2015 21:42:05 Windows Update
31-03-2015 20:22:10 Windows Update
01-04-2015 14:12:24 Windows Update
02-04-2015 17:21:12 Windows Update
04-04-2015 20:47:46 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0393A789-BABA-4CE8-83C5-A9A3F5108839} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {14B369BE-2BDB-4D35-8F88-AE20A3086585} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {16430D74-66AE-48FE-B39A-F7F0A9B084D7} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {48CC9294-5632-4961-8D3B-B4D075B55699} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {82530C68-DA05-4407-BBE1-ECDDD4215D31} - System32\Tasks\{034EF818-35FD-4225-9FE1-F399BE423749} => pcalua.exe -a D:\NERO\NERO6303.EXE -d D:\NERO
Task: {828CC646-5F43-4A26-A0F7-1E8B28CA2C8E} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {9C7BEEF5-DB1B-4AC2-B453-AC3D88CB11F8} - System32\Tasks\iolo System Checkup => C:\ProgramData\iolo\scustask.lnk [2014-06-14] ()
Task: {F6657653-8F0A-47E5-AD56-3601E830E103} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
==================== Loaded Modules (whitelisted) ==============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-12-19 16:32 - 2012-12-19 16:32 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-02-26 22:26 - 2014-03-25 15:25 - 00590640 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\taxaktuell.exe
2015-03-26 15:38 - 2015-03-26 15:38 - 00085504 _____ () C:\Users\Jana\AppData\Local\RGMService\RGMUpdater.exe
2015-03-26 15:38 - 2015-03-26 15:38 - 01051136 _____ () C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe
2012-12-07 15:15 - 2012-12-07 15:15 - 02126264 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtCore4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 07422392 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtGui4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 02453944 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtDeclarative4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 01270200 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtScript4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 00192952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtSql4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 00795064 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtNetwork4.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll
2014-02-26 22:24 - 2014-03-25 15:26 - 09741104 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wgui14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 00035120 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\rsdcom48.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 00309040 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\rscorewinapi48.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 00321840 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\rsguiwinapi48.dll
2014-02-26 22:24 - 2014-03-25 15:26 - 03799344 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wcore14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 00136496 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\rsodbc48.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 02691888 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wfvie14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01993008 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wsteu14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01915184 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wreli14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 04330800 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wauff14.dll
2014-02-26 22:24 - 2014-02-11 12:53 - 01043456 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\clucene-core.dll
2014-02-26 22:24 - 2014-02-11 12:53 - 00094720 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\clucene-shared.dll
2014-02-26 22:24 - 2014-02-11 12:53 - 00250368 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\clucene-contribs-lib.dll
2014-02-26 22:24 - 2014-03-26 11:59 - 01548592 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wmain14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 05127984 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wbae114.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01690416 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wbae214.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01806128 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wbae314.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01626928 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wbae414.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01115440 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\whau114.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01326384 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\whau214.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01245488 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wwerb14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 07324464 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wkont14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01283376 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wimp14.dll
2014-02-26 22:24 - 2014-03-25 15:25 - 01330480 _____ () C:\Program Files (x86)\Buhl finance\tax Steuersoftware 2014\wfabu14.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2015-03-05 00:08 - 2015-03-05 00:08 - 00750080 _____ () C:\Users\Jana\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-04-07 16:00 - 2015-04-07 16:00 - 00043008 _____ () c:\users\jana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuasurx.dll
2015-03-05 00:08 - 2015-03-05 00:08 - 00047616 _____ () C:\Users\Jana\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-05 00:08 - 2015-03-05 00:08 - 00865280 _____ () C:\Users\Jana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-05 00:07 - 2015-03-05 00:07 - 00200704 _____ () C:\Users\Jana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2014-08-07 14:23 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Jana\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2006-02-22 15:47 - 2006-02-22 15:47 - 00073728 _____ () C:\Program Files (x86)\Cherry\KeyMan\zlib1.dll
2006-02-22 15:47 - 2006-02-22 15:47 - 00114688 _____ () C:\Program Files (x86)\Cherry\KeyMan\libpng13.dll
2015-03-26 15:38 - 2015-03-26 15:38 - 02199552 _____ () C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.dll
2015-03-26 15:38 - 2015-03-26 15:38 - 01819136 _____ () C:\Users\Jana\AppData\Local\RGMService\xqioiewg.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1291533527-3129815193-1259002340-500 - Administrator - Disabled)
Gast (S-1-5-21-1291533527-3129815193-1259002340-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1291533527-3129815193-1259002340-1004 - Limited - Enabled)
Jana (S-1-5-21-1291533527-3129815193-1259002340-1002 - Administrator - Enabled) => C:\Users\Jana
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/07/2015 06:26:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 06:26:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 06:26:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 06:25:38 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 06:25:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 04:03:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 04:02:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/07/2015 04:02:44 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ComponentModel.Composition.CompositionException
Stack:
at System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore()
at System.ComponentModel.Composition.Primitives.Export.get_Value()
at System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export)
at System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValuesCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String)
at Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/07/2015 04:02:31 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ComponentModel.Composition.CompositionException
Stack:
at System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore()
at System.ComponentModel.Composition.Primitives.Export.get_Value()
at System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export)
at System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValuesCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String)
at Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/07/2015 04:02:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Error: (04/07/2015 04:17:03 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/07/2015 04:09:04 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/07/2015 04:02:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (04/07/2015 04:02:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/07/2015 04:02:17 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/07/2015 03:59:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "LPT System Updater Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (04/07/2015 03:59:59 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst LPT System Updater Service erreicht.
Error: (04/07/2015 03:58:43 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (04/07/2015 03:58:43 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter
Error: (04/04/2015 08:49:11 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Microsoft Office Sessions:
=========================
Error: (04/07/2015 06:26:36 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\uvdetecthw.exe
Error: (04/07/2015 06:26:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\BatchDL.exe
Error: (04/07/2015 06:26:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\APLoading.exe
Error: (04/07/2015 06:25:38 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
Error: (04/07/2015 06:25:34 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/07/2015 04:03:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/07/2015 04:02:54 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/07/2015 04:02:44 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ComponentModel.Composition.CompositionException
Stack:
at System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore()
at System.ComponentModel.Composition.Primitives.Export.get_Value()
at System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export)
at System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValuesCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String)
at Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/07/2015 04:02:31 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.ServiceHost.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.ComponentModel.Composition.CompositionException
Stack:
at System.ComponentModel.Composition.Hosting.CompositionServices.GetExportedValueFromComposedPart(System.ComponentModel.Composition.Hosting.ImportEngine, System.ComponentModel.Composition.Primitives.ComposablePart, System.ComponentModel.Composition.Primitives.ExportDefinition)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider.GetExportedValue(CatalogPart, System.ComponentModel.Composition.Primitives.ExportDefinition, Boolean)
at System.ComponentModel.Composition.Hosting.CatalogExportProvider+CatalogExport.GetExportedValueCore()
at System.ComponentModel.Composition.Primitives.Export.get_Value()
at System.ComponentModel.Composition.ExportServices.GetCastedExportedValue[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.ComponentModel.Composition.Primitives.Export)
at System.ComponentModel.Composition.Hosting.ExportProvider.GetExportedValuesCore[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]](System.String)
at Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
at System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/07/2015 04:02:15 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 945 Processor
Percentage of memory in use: 35%
Total physical RAM: 7934.12 MB
Available physical RAM: 5106.11 MB
Total Pagefile: 15866.42 MB
Available Pagefile: 12996.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (Win7HPx64) (Fixed) (Total:931.51 GB) (Free:768.74 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive i: (DATA) (Fixed) (Total:298.02 GB) (Free:239.04 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E05430EB)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 0E207A27)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=0C)
==================== End Of Log ============================
|
|
07.04.2015, 20:49
| #2 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hier kommt noch GMER:
__________________Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-04-07 21:07:19
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005f Hitachi_ rev.JP4O 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Jana\AppData\Local\Temp\pwtdypow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000743811a8 2 bytes [38, 74]
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 248 000000007438127d 2 bytes CALL 74a414b9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 395 0000000074381310 2 bytes CALL 74a414b9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000743813a8 2 bytes [38, 74]
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000074381422 2 bytes [38, 74]
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000074381498 2 bytes [38, 74]
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextCreate + 4 0000000073431825 2 bytes JMP 76696125 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroy + 4 0000000073431830 2 bytes JMP 76696145 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroyAll + 4 000000007343183b 2 bytes JMP 76696165 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dDrawPrimitives2 + 4 0000000073431846 2 bytes JMP 76695a05 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dValidateTextureStageState + 4 0000000073431851 2 bytes JMP 76696185 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAddAttachedSurface + 4 000000007343185c 2 bytes JMP 76696265 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAlphaBlt + 4 0000000073431867 2 bytes JMP 76696285 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAttachSurface + 4 0000000073431872 2 bytes JMP 766962a5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBeginMoCompFrame + 4 000000007343187d 2 bytes JMP 766962c5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBlt + 4 0000000073431888 2 bytes JMP 76695a25 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateD3DBuffer + 4 0000000073431893 2 bytes JMP 766962e5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateSurface + 4 000000007343189e 2 bytes JMP 76695aa5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdColorControl + 4 00000000734318a9 2 bytes JMP 76696305 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateD3DBuffer + 4 00000000734318b4 2 bytes JMP 76696325 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateDirectDrawObject + 4 00000000734318bf 2 bytes JMP 76661fcb C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateMoComp + 4 00000000734318ca 2 bytes JMP 76696365 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurface + 4 00000000734318d5 2 bytes JMP 76695ac5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceEx + 4 00000000734318e0 2 bytes JMP 76695b45 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceObject + 4 00000000734318eb 2 bytes JMP 76695b65 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteDirectDrawObject + 4 00000000734318f6 2 bytes JMP 766968c5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteSurfaceObject + 4 0000000073431901 2 bytes JMP 76695a85 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyD3DBuffer + 4 000000007343190c 2 bytes JMP 766968e5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyMoComp + 4 0000000073431917 2 bytes JMP 76696925 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroySurface + 4 0000000073431922 2 bytes JMP 76695ae5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdEndMoCompFrame + 4 000000007343192d 2 bytes JMP 76696945 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlip + 4 0000000073431938 2 bytes JMP 76696965 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlipToGDISurface + 4 0000000073431943 2 bytes JMP 76696985 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetAvailDriverMemory + 4 000000007343194e 2 bytes JMP 766969a5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetBltStatus + 4 0000000073431959 2 bytes JMP 766969c5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDC + 4 0000000073431964 2 bytes JMP 766969e5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverInfo + 4 000000007343196f 2 bytes JMP 76696a05 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverState + 4 000000007343197a 2 bytes JMP 76696a25 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDxHandle + 4 0000000073431985 2 bytes JMP 76696a45 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetFlipStatus + 4 0000000073431990 2 bytes JMP 76696a65 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetInternalMoCompInfo + 4 000000007343199b 2 bytes JMP 76696a85 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompBuffInfo + 4 00000000734319a6 2 bytes JMP 76696aa5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompFormats + 4 00000000734319b1 2 bytes JMP 76696ac5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompGuids + 4 00000000734319bc 2 bytes JMP 76696ae5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetScanLine + 4 00000000734319c7 2 bytes JMP 76696b05 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLock + 4 00000000734319d2 2 bytes JMP 76696b25 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLockD3D + 4 00000000734319dd 2 bytes JMP 76695b85 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryDirectDrawObject + 4 00000000734319e8 2 bytes JMP 76696b65 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryMoCompStatus + 4 00000000734319f3 2 bytes JMP 76696b85 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReenableDirectDrawObject + 4 00000000734319fe 2 bytes JMP 76696bc3 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReleaseDC + 4 0000000073431a09 2 bytes JMP 76696be3 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdRenderMoComp + 4 0000000073431a14 2 bytes JMP 76696c03 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdResetVisrgn + 4 0000000073431a1f 2 bytes JMP 76695b05 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetColorKey + 4 0000000073431a2a 2 bytes JMP 76696c23 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetExclusiveMode + 4 0000000073431a35 2 bytes JMP 76696c43 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetGammaRamp + 4 0000000073431a40 2 bytes JMP 76696c63 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetOverlayPosition + 4 0000000073431a4b 2 bytes JMP 76696c83 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnattachSurface + 4 0000000073431a56 2 bytes JMP 76696ca3 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlock + 4 0000000073431a61 2 bytes JMP 76696cc3 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlockD3D + 4 0000000073431a6c 2 bytes JMP 76695ba5 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUpdateOverlay + 4 0000000073431a77 2 bytes JMP 76696ce3 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 4 0000000073431a82 2 bytes JMP 76696d03 C:\Windows\syswow64\GDI32.dll
.text C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe[2052] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 52 0000000073431ab2 2 bytes JMP 74b6dc75 C:\Windows\syswow64\msvcrt.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe[2436] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe[2708] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[2816] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[2916] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[2952] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\KERNEL32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ac1401 2 bytes JMP 74a6b21b C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ac1419 2 bytes JMP 74a6b346 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ac1431 2 bytes JMP 74ae8ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ac144a 2 bytes CALL 74a448ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ac14dd 2 bytes JMP 74ae87a2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ac14f5 2 bytes JMP 74ae8978 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ac150d 2 bytes JMP 74ae8698 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ac1525 2 bytes JMP 74ae8a62 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ac153d 2 bytes JMP 74a5fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ac1555 2 bytes JMP 74a668ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ac156d 2 bytes JMP 74ae8f61 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ac1585 2 bytes JMP 74ae8ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ac159d 2 bytes JMP 74ae865c C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ac15b5 2 bytes JMP 74a5fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ac15cd 2 bytes JMP 74a6b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ac16b2 2 bytes JMP 74ae8e24 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe[916] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ac16bd 2 bytes JMP 74ae85f1 C:\Windows\syswow64\kernel32.dll
---- Threads - GMER 2.1 ----
Thread C:\Windows\SysWOW64\ntdll.dll [2452:2456] 0000000000418f7a
---- Processes - GMER 2.1 ----
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 0000000067ae0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 00000000677a0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708](2015-03-04 22:08:06) 00000000676e0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 00000000667d0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (ICU I18N DLL/The ICU Project)(2015-03-04 22:08:06) 000000004a900000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (ICU Common DLL/The ICU Project)(2015-03-04 22:08:06) 0000000004480000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (ICU Data DLL/The ICU Project)(2015-03-04 22:08:06) 000000004ad00000
Library c:\users\jana\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuasurx.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708](2015-04-07 14:00:31) 0000000004710000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005ecc0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 000000005dc60000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005d9b0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005d750000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005d720000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708](2015-03-04 22:08:06) 0000000060cc0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 000000005d6f0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005d6b0000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 000000005d660000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708](2015-03-04 22:08:06) 000000006ee60000
Library C:\Users\Jana\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe [2708](2015-03-04 22:07:48) 000000006eab0000
Process C:\Users\Jana\AppData\Local\RGMService\RGMUpdater.exe (*** suspicious ***) @ C:\Users\Jana\AppData\Local\RGMService\RGMUpdater.exe [5544](2015-03-26 13:38:52) 0000000000190000
Process C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe (*** suspicious ***) @ C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe [916](2015-03-26 13:38:52) 0000000000810000
Library C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe [916](2015-03-26 13:38:52) 00000000610b0000
Library C:\Users\Jana\AppData\Local\RGMService\xqioiewg.dll (*** suspicious ***) @ C:\Users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe [916](2015-03-26 13:38:54) 0000000053c90000
---- Registry - GMER 2.1 ----
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\Jana\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe 1
---- EOF - GMER 2.1 ----
Vielen Dank, Jana |
|
08.04.2015, 19:44
| #3 |
| /// the machine /// TB-Ausbilder    | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden hi,
__________________Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ |
|
08.04.2015, 21:24
| #4 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, schon mal danke für die Hilfe. Die oben genannten Programme habe ich bis auf LPT System Updater Service deinstalliert, dieses konnte ich nicht finden. Combofix habe ich laufenlassen, allerdings wurde kein Logfile erzeugt. Was nun? Viele Grüße, chancex |
|
09.04.2015, 12:09
| #5 |
| /// the machine /// TB-Ausbilder | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden CF nochmal laufen lassen, LPT versuchen über Windows normal zu deinstallieren.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
09.04.2015, 20:10
| #6 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, LPT habe ich irgendwie nicht finden können. Aber dafür ging das Logfile jetzt: Code:
ATTFilter ComboFix 15-04-09.01 - Jana 09.04.2015 19:44:58.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.7934.5031 [GMT 2:00]
ausgeführt von:: c:\users\Jana\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jana\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
---- Vorheriger Suchlauf -------
.
c:\users\Jana\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-09 bis 2015-04-09 ))))))))))))))))))))))))))))))
.
.
2015-04-09 17:53 . 2015-04-09 17:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-04-09 17:40 . 2015-03-14 10:02 12002392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{AD0E0063-C98C-4C8C-A213-8B5BB5E2EC8B}\mpengine.dll
2015-04-08 20:25 . 2015-03-14 10:02 12002392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-04-08 19:21 . 2015-04-08 19:21 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-04-08 18:26 . 2015-04-08 18:26 -------- d-----w- c:\program files\Firefox
2015-04-07 19:53 . 2013-07-31 18:10 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2015-04-07 19:53 . 2013-07-31 18:10 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2015-04-07 19:52 . 2015-04-07 19:52 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-04-07 19:52 . 2015-04-07 19:53 -------- d-----w- c:\programdata\Oracle
2015-04-07 19:15 . 2015-04-07 19:15 -------- d-----w- c:\users\Jana\AppData\Local\ElevatedDiagnostics
2015-04-07 18:51 . 2015-04-07 18:52 -------- d-----w- C:\FRST
2015-04-07 14:03 . 2015-04-07 14:03 -------- d-----w- c:\programdata\Packercc56729e-9fc2-4c79-a5a8-77edc7087390
2015-04-07 14:03 . 2015-04-07 14:06 -------- d-----w- c:\program files (x86)\ProductUI
2015-04-04 18:48 . 2015-04-04 18:48 -------- d-s---w- c:\windows\system32\GWX
2015-04-04 18:48 . 2015-04-04 18:48 -------- d-s---w- c:\windows\SysWow64\GWX
2015-04-04 17:55 . 2015-04-07 14:02 -------- d-----w- c:\program files\Thunderbird
2015-03-31 17:51 . 2015-03-26 18:45 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2AA094E4-F58D-4C4C-8D98-ED5AA49D5E1B}\gapaengine.dll
2015-03-25 18:53 . 2015-03-25 18:53 -------- d-----w- c:\users\Jana\AppData\Local\TomTom
2015-03-25 18:53 . 2015-03-25 18:53 -------- d-----w- c:\program files (x86)\TomTom International B.V
2015-03-25 18:52 . 2015-03-25 18:52 -------- d-----w- c:\program files (x86)\MyDrive Connect
2015-03-25 18:51 . 2015-03-25 18:52 -------- d-----w- c:\program files (x86)\TomTom
2015-03-25 18:24 . 2015-03-11 04:06 677888 ----a-w- c:\windows\system32\generaltel.dll
2015-03-25 18:24 . 2015-03-11 04:06 760832 ----a-w- c:\windows\system32\invagent.dll
2015-03-25 18:24 . 2015-03-11 04:06 414720 ----a-w- c:\windows\system32\devinv.dll
2015-03-25 18:24 . 2015-03-11 04:06 943616 ----a-w- c:\windows\system32\appraiser.dll
2015-03-25 18:24 . 2015-03-11 04:05 30720 ----a-w- c:\windows\system32\acmigration.dll
2015-03-25 18:24 . 2015-03-11 04:05 227328 ----a-w- c:\windows\system32\aepdu.dll
2015-03-25 18:24 . 2015-03-11 04:05 192000 ----a-w- c:\windows\system32\aepic.dll
2015-03-25 18:24 . 2015-03-11 04:02 1107456 ----a-w- c:\windows\system32\aeinv.dll
2015-03-11 18:00 . 2015-02-03 03:31 215552 ----a-w- c:\windows\system32\ubpm.dll
2015-03-11 17:59 . 2015-01-17 02:48 1067520 ----a-w- c:\windows\system32\msctf.dll
2015-03-11 17:59 . 2015-02-03 03:31 1190400 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-03-11 17:59 . 2015-02-03 03:12 1011200 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-03-11 17:59 . 2015-01-17 02:30 828928 ----a-w- c:\windows\SysWow64\msctf.dll
2015-03-11 17:59 . 2015-02-26 03:25 3204096 ----a-w- c:\windows\system32\win32k.sys
2015-03-11 17:59 . 2015-02-04 03:16 392192 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-11 17:59 . 2015-02-04 02:54 318464 ----a-w- c:\windows\SysWow64\WMPhoto.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-07 19:52 . 2013-07-31 18:10 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-03-26 18:45 . 2013-07-17 17:45 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2015-03-11 18:50 . 2011-04-27 11:44 122905848 ----a-w- c:\windows\system32\MRT.exe
2015-03-04 13:05 . 2013-05-06 10:15 44088 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-03-04 13:05 . 2013-03-29 21:03 132120 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-03-04 13:05 . 2013-03-29 21:03 128536 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-03-03 13:17 . 2010-11-21 03:27 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-17 14:26 . 2015-02-17 14:26 1217184 ----a-w- c:\windows\SysWow64\FM20.DLL
2015-01-27 23:36 . 2015-02-11 13:33 1239720 ----a-w- c:\windows\system32\aitstatic.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{E155F23C-9931-47c6-A619-20E6FCA86D75}]
2013-08-12 17:52 196096 ----a-w- c:\program files (x86)\Web Check\WebCheck.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917}"= "c:\program files (x86)\PDF Creater\Free PDF Perfect\ieagent32.dll" [2013-08-27 620504]
.
[HKEY_CLASSES_ROOT\clsid\{efc2b9be-ab2b-47f1-a47d-9eb28e58c917}]
[HKEY_CLASSES_ROOT\SX_PDF8_PROSIEBEN.IEBarBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{2534E391-6D4F-4AD4-A250-D79152E4B741}]
[HKEY_CLASSES_ROOT\SX_PDF8_PROSIEBEN.IEBarBand]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"KSS"="c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2012-12-07 202328]
"Browser Infrastructure Helper"="c:\users\Jana\AppData\Local\Smartbar\Application\Smartbar.exe" [BU]
"MyDriveConnect.exe"="c:\program files (x86)\MyDrive Connect\MyDriveConnect.exe" [2014-10-03 1792376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-12-19 642808]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
"avgnt"="c:\program files\Avira\Avira\AntiVir Desktop\avgnt.exe" [2015-04-01 726320]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"UVS11 Preload"="c:\program files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-03-03 341488]
"QuickTime Task"="c:\program files (x86)\QuickTime\qttask.exe" [2006-09-01 282624]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"CherryKeyMan"="c:\program files (x86)\Cherry\KeyMan\KeyMan.exe" [2006-08-02 237620]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-14 190032]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.8.150\SSScheduler.exe [2014-4-9 332016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files\Avira\Avira\AntiVir Desktop\avmailc7.exe;c:\program files\Avira\Avira\AntiVir Desktop\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files\Avira\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\SeaPort.exe [x]
R3 Ch64USBM;Cherry USB Maus Treiber für CDI;c:\windows\system32\drivers\Ch64USBM.sys;c:\windows\SYSNATIVE\drivers\Ch64USBM.sys [x]
R3 Cherry Device Interface;Cherry Device Interface;c:\program files (x86)\Cherry\CDI\cdi.exe;c:\program files (x86)\Cherry\CDI\cdi.exe [x]
R3 lvpopf64;Logitech POP Suppression Filter;c:\windows\system32\DRIVERS\lvpopf64.sys;c:\windows\SYSNATIVE\DRIVERS\lvpopf64.sys [x]
R3 LVPr2M64;Logitech LVPr2M64 Driver;c:\windows\system32\DRIVERS\LVPr2M64.sys;c:\windows\SYSNATIVE\DRIVERS\LVPr2M64.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 PNPMEM;Microsoft Speichermodultreiber;c:\windows\system32\DRIVERS\pnpmem.sys;c:\windows\SYSNATIVE\DRIVERS\pnpmem.sys [x]
R3 SXDS10;soft Xpansion Dispatch Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\Avira\AntiVir Desktop\sched.exe;c:\program files\Avira\Avira\AntiVir Desktop\sched.exe [x]
S2 AODDriver4.2;AODDriver4.2;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.1.362.0\BBSvc.exe [x]
S2 KSS;Kaspersky Security Scan Service;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [x]
S2 RGMUpdater;RG Manage Updater;c:\users\Jana\AppData\Local\RGMService\RGMUpdater.exe;c:\users\Jana\AppData\Local\RGMService\RGMUpdater.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech Webcam C210(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]
@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]
@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]
@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]
@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]
2015-02-11 01:12 185824 ----a-w- c:\users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2012-06-12 6548112]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-02-12 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-04-03 3684488]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-01-30 1332296]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc0rwAxCjgf3DIUGojBAsN65_RTFqL10pczrtWJFei_2s9e_cbNdMEkk49TUrc3z29-wU5wThob0LmNkgNhAfZMD50V1KRK9w,,
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.helperbar.com/?p=mKO_AwFzXIpYRbkHo3StMBGUhCtXlT7G1muS_BRDXuH_N6QVFdlkuDDcdAasL4D_XjXDdIHUAmfoSG9SZOrtlGrjw6FxMgc1BUVuvkbNfpbs29ZKTqDtGv6MdTc4QWD8U22284Qay8WjKCXnlt-uA5x0DSTBR8zAf4O2ms5nUBWmf57mkLs7NCZpoUtGkd6Hd3scnnikg4SXjsclTTGwGPWUyA,,&q={searchTerms}
IE: An OneNote s&enden - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\
FF - prefs.js: browser.search.selectedEngine - WEB.DE Suche
FF - prefs.js: browser.startup.homepage - www.google.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
AddRemove-Adobe Photoshop 6.0 - c:\windows\ISUN0407.EXE
AddRemove-Adobe SVG Viewer - c:\windows\IsUn0407.exe
AddRemove-Hessen 3D - c:\windows\IsUn0407.exe
AddRemove-RGMUpdater Monetization Controlcc56729e-9fc2-4c79-a5a8-77edc7087390 - c:\programdata\Packercc56729e-9fc2-4c79-a5a8-77edc7087390\13078.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
c:\users\Jana\AppData\Local\RGMService\RGMUpdater_run.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-09 20:18:20 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-09 18:18
.
Vor Suchlauf: 19 Verzeichnis(se), 836.162.064.384 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 835.925.704.704 Bytes frei
.
- - End Of File - - 2FBA5819E29B6411957A17AE5CF2A667
A36C5E4F47E84449FF07ED3517B43A31
Viele Grüße, chancex |
|
10.04.2015, 10:35
| #7 |
| /// the machine /// TB-Ausbilder | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
10.04.2015, 19:51
| #8 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, hier sind die Logs: MBAM und JRT als Zip wegen Dateigröße AWDCleaner: Code:
ATTFilter # AdwCleaner v4.201 - Bericht erstellt 10/04/2015 um 20:06:52
# Aktualisiert 08/04/2015 von Xplode
# Datenbank : 2015-04-08.1 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Jana - JANA-PC
# Gestarted von : C:\Users\Jana\Desktop\AdwCleaner_4.201.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\ProductUI
Ordner Gelöscht : C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}
Ordner Gelöscht : C:\Users\Jana\AppData\Local\RGMService
Ordner Gelöscht : C:\Users\Jana\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Jana\AppData\LocalLow\GutscheinCodes
Datei Gelöscht : C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\11-suche.xml
***** [ Geplante Tasks ] *****
Task Gelöscht : Scheduled Update for Ask Toolbar
***** [ Verknüpfungen ] *****
Verknüpfung Desinfiziert : C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GutscheinCodes.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{59279625-EFF0-4F55-98F0-51EDDD800DD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{061F450C-37B9-4330-9235-0F25D9F75B33}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{22FEB0F5-0BA0-4D4B-8A66-55A21667BC31}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2B79F7D-2D7D-4420-B2A9-ECE52C7C83A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1D55DAA5-04AC-4036-B0BE-DA81EE9676CD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{58CBF821-A0C7-4AE8-9430-77DD1AF38E99}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{72BCBFF7-2837-4CA0-B3B5-3DAED7F54601}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{824125FD-7732-4DA2-9277-3A7D0A0A0813}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C17DC5CF-54FF-4E63-8AC7-94335D6DA231}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D14D0EE2-2DD1-4230-BE70-3F3AD6172C40}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\covus freemium gmbh
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
***** [ Internetbrowser ] *****
-\\ Internet Explorer v9.0.8112.16633
-\\ Mozilla Firefox v37.0.1 (x86 de)
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("avira.safe_search.installed", "[\"safesearch\"]");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("browser.uiCustomization.state", "{\"placements\":{\"PanelUI-contents\":[\"edit-controls\",\"zoom-controls\",\"new-window-button\",\"privatebrowsing-button\",\"save-page-button\",\"print-but[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossrider.bic", "1423e6ab15d580c5dcece0099e79b272");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.InstallationThankYouPage", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.InstallationTime", 1384026649);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.active", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.addressbar", "NA");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.addressbarenhanced", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncdb.was_copied", "true");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncdb_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncdb_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncinternaldb.was_copied", "true");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncinternaldb_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.asyncinternaldb_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.backgroundjs", "\n\n/************************************************************************************\n This is your background code.\n For more in[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.backgroundver", 7);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.can_run_bg_code", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.certdomaininstaller", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.changeprevious", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.cookie.CrossriderNotifier_channels.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.cookie.CrossriderNotifier_channels.value", "%7B%22app0%22%3A%22app0%22%2C%22app16150%22%3A%22app16150%22%2C%22DE%22%3A%22DE%22%7D");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.cookie.InstallationTime.value", "1384026649");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comasyncdb_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comasyncdb_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comasyncinternaldb_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comasyncinternaldb_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comcrossriderapp16150_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150@crossrider.comcrossriderapp16150_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150_dbWasSet", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.crossriderapp16150_dbWasSet_FF25_FIX", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.description", "Mit der DKB-Cashback Erweiterung finden Sie schnell und einfach alle Online-Cashbacks. Somit verpassen Sie keinen Vorteil mehr.");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.domain", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.enablesearch", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.homepage", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.iframe", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3Anull%2C%22installer_verifier%22%3Anull%7D");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.InstallerParamsCache.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.InstallerParamsCache.value", "%7B%22source_id%22%3A%220%22%2C%22sub_id%22%3A%220%22%2C%22uzid%22%3A%220%22%7D");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_appVer.value", "45");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_lastVersion.value", "45");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_meta.value", "%7B%22jquery.js%22%3A%7B%22id%22%3A210832%2C%22ver%22%3A45%2C%22status%22%3A1%2C%22name%22%3A%22jquery.js%22%2C%22url%[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_queue.value", "%7B%7D");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_resource_210832.expiration", "Tue Apr 21 2015 15:24:55 GMT+0200");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_resource_210832.value", "%22/*%21%20jQuery%20v1.8.2%20jquery.com%20%7C%20jquery.org/license%20*/%5Cr%5Cn%28function%28a%2Cb%29%7Bfun[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_resource_210834.expiration", "Tue Apr 21 2015 15:24:55 GMT+0200");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.Resources_resource_210834.value", "%22/*%21%5Cr%5Cn%20*%20jQuery%20blockUI%20plugin%5Cr%5Cn%20*%20Version%202.45%20%2813-SEP-2012%29%5Cr%5Cn%2[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.installer.expiration", "Fri Feb 01 2030 00:00:00 GMT+0100");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.internaldb.installer.value", "%7B%22InstallerIdentifiers%22%3A%7B%22installer_bic%22%3Anull%2C%22installer_verifier%22%3Anull%7D%2C%22version%22%3Anull%7[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.js", "\n\n /************************************************************************************\n This is your Page Code. The appAPI.ready() code bloc[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.lastDailyReport", "1428513529159");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.lastUpdate", "1428513528884");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.manifesturl", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.name", "DKB-Cashback");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.newtab", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.opensearch", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.ex[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_1.name", "base");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_1.ver", 8);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_13.code", "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.g[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_13.name", "CrossriderAppUtils");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_13.ver", 5);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined\"&&typeof window.navigat[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_14.name", "CrossriderUtils");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_14.ver", 9);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"&&_firefoxVersion>14)&&ty[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_16.name", "FFAppAPIWrapper");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_16.ver", 12);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_17.code", "if(typeof window!==\"undefined\"){\n/*!\n * jQuery JavaScript Library v1.4.2\n * hxxp://jquery.com/\n *\n * Copyright 2010, Joh[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_17.name", "jQuery");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_17.ver", 4);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_21.name", "debug");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_21.ver", 5);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(n[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_22.name", "resources");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_22.ver", 5);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.exte[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_28.name", "initializer");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_28.ver", 4);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"undefined\") {\n\n/*! jQuery [...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_4.name", "jquery_1_7_1");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_4.ver", 4);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_47.name", "resources_background");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_47.ver", 3);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_5.code", "(function(f){f.ui=f.ui{};var e=/leftcenterright/,d=/topcenterbottom/,b=f.fn.position,a=f.fn.offset;f.fn.position=function([...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_5.name", "notifications");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_5.ver", 5);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_64.code", "(function(){var j=\"__CR_EMPTY_CHANNEL__\";var d=function(e){return(typeof e===\"object\"&&e!==null);};var b=function(e){return[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_64.name", "appApiMessage");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_64.ver", 3);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_7.code", "appAPI.hooks={$:$jquery_171,hooks:{},addHook:function(a,b){this.hooks[a]=b;},removeHook:function(a){delete this.hooks[a];},regis[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_7.name", "hooks");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_7.ver", 2);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_72.code", "if(appAPI.__should_activate_validation__===true){(function(){var d={WRONG_STRICT_VALUE:\"Parameter %PARAM_NAME% value is not su[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_72.name", "appApiValidation");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_72.ver", 3);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof window.navigator!==\"undefined\"&&typeof window.navigator.userAgent!==\"unde[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_78.name", "CrossriderInfo");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_78.ver", 5);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_9.code", "appAPI.hooks.addHook(\"searchEngine\",(function(a){return function(){var f={keyDelay:1000},e,h;return{init:function(i){e=this;th[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_9.name", "search_engine_hook");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_9.ver", 3);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_98.code", "(function(){var b={DUMMY_PAGE_URL:\"hxxp://page.our-app.net/blank/resource.html\"};var c=\"cr_\"+appAPI.appID+\"internalMessage[...]
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_98.name", "omniCommands");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins.plugin_98.ver", 3);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,72,7,98,9,5,28");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.pluginsurl", "hxxps://w9u6a2p6.ssl.hwcdn.net/plugin/apps/16150/plugins/na/ff/plugins.json");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.pluginsversion", 33);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.publisher", "dkbbrowserextension");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.searchstatus", 0);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.setnewtab", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.thankyou", "");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.updateinterval", 360);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.16150.ver", 49);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.FilesValidatorDueTime", "1405147911922");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.apps", "16150");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.bic", "1423e6ab15d580c5dcece0099e79b272");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.cid", 16150);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.firstrun", false);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.hadappinstalled", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.installationdate", 1384026649);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.lastcheck", 23071358);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.lastcheckitem", 23071365);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.modetype", "production");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.reportInstall", true);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.crossriderapp16150.statsDailyCounter", 620);
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.MP_DISTINCT_ID", "\"14914ce6ebf24d-015f57498cea54-41534136-0-14914ce6ec02d0\"");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_expires_at", "1428592581");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_rndsnr", "\"db1e17e590d32f6c2edd1ed4a18a6aaaf6a8cd89\"");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_userid", "5628249748");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.SAUTH_utoken", "\"56234429bf77b96c60009eab94aa5c4b21d6ed65\"");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.install", "1413393313476");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.safesearch.search_offer_disabled", "true");
[yqzpld84.default-1365012383058\prefs.js] - Zeile Gelöscht : user_pref("extensions.xpiState", "{\"app-profile\":{\"abs@avira.com\":{\"d\":\"C:\\\\Users\\\\Jana\\\\AppData\\\\Roaming\\\\Mozilla\\\\Firefox\\\\Profiles\\\\yqzpld84.default-1365012383058\\\\extensio[...]
*************************
AdwCleaner[R0].txt - [33275 Bytes] - [10/04/2015 20:04:39]
AdwCleaner[S0].txt - [34173 Bytes] - [10/04/2015 20:06:52]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [34233 Bytes] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Jana (administrator) on JANA-PC on 10-04-2015 20:37:35
Running from C:\Users\Jana\Desktop
Loaded Profiles: Jana (Available profiles: Jana)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-02-12] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [UVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341488 2007-03-03] (InterVideo Digital Technology Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [282624 2006-09-01] (Apple Computer, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [CherryKeyMan] => C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [237620 2006-08-02] (Cherry GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-10-03] (TomTom)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-07] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-07] (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\PDF Creater\Free PDF Perfect\ieagent32.dll [2013-08-27] (soft Xpansion)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058
FF SelectedSearchEngine: WEB.DE Suche
FF Homepage: www.google.de
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 5);
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll [2013-08-02] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll [2013-08-02] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-07] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\Freemium\np-sxpdf.dll [2013-08-27] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-02-16] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\avira-safesearch.xml [2015-03-01]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\englische-ergebnisse.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\gmx-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\lastminute.xml [2014-05-23]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\webde-suche.xml [2014-06-04]
FF Extension: Avira Browser Safety - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\abs@avira.com [2015-03-31]
FF Extension: Avira SafeSearch - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\safesearch@avira.com [2015-03-01]
FF Extension: NoScript - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-03]
FF Extension: Adblock Plus - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-03]
FF HKLM-x32\...\Firefox\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF Extension: Free PDF Perfect - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013-08-27]
FF HKLM-x32\...\Thunderbird\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
S2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)
S3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [573486 2006-06-27] (Cherry, Auerbach Germany, www.cherry.de) [File not signed]
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-27] (soft Xpansion)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-04] (Avira Operations GmbH & Co. KG)
S3 Ch64USBM; C:\Windows\System32\drivers\Ch64USBM.sys [91008 2006-06-02] (Cherry GmbH)
S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [8192 2005-03-28] ()
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-10 20:15 - 2015-04-10 20:15 - 00000787 _____ () C:\Users\Jana\Desktop\JRT.txt
2015-04-10 20:13 - 2015-04-10 20:13 - 02686959 _____ (Thisisu) C:\Users\Jana\Desktop\JRT.exe
2015-04-10 20:13 - 2015-04-10 20:13 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-JANA-PC-Windows-7-Home-Premium-(64-bit).dat
2015-04-10 20:13 - 2015-04-10 20:13 - 00000000 ____D () C:\RegBackup
2015-04-10 20:11 - 2015-04-10 20:11 - 00034458 _____ () C:\Users\Jana\Desktop\AdwCleaner.txt
2015-04-10 20:04 - 2015-04-10 20:07 - 00000000 ____D () C:\AdwCleaner
2015-04-10 20:03 - 2015-04-10 20:03 - 02217984 _____ () C:\Users\Jana\Desktop\AdwCleaner_4.201.exe
2015-04-10 20:02 - 2015-04-10 20:02 - 00819604 _____ () C:\Users\Jana\Desktop\mbam.txt
2015-04-10 19:40 - 2015-04-10 20:01 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-10 19:40 - 2015-04-10 19:40 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-10 19:40 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-10 19:40 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-10 19:40 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-10 19:37 - 2015-04-10 19:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Jana\Desktop\mbam-setup-2.1.4.1018.exe
2015-04-09 20:18 - 2015-04-09 20:18 - 00019613 _____ () C:\ComboFix.txt
2015-04-08 21:36 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-08 21:36 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-08 21:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-08 21:32 - 2015-04-09 20:18 - 00000000 ____D () C:\Qoobox
2015-04-08 21:32 - 2015-04-08 21:51 - 00000000 ____D () C:\Windows\erdnt
2015-04-08 21:31 - 2015-04-08 21:31 - 05617275 ____R (Swearware) C:\Users\Jana\Desktop\ComboFix.exe
2015-04-08 21:21 - 2015-04-08 21:21 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jana\Desktop\revosetup95.exe
2015-04-08 21:21 - 2015-04-08 21:21 - 00001277 _____ () C:\Users\Jana\Desktop\Revo Uninstaller.lnk
2015-04-08 21:21 - 2015-04-08 21:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-08 20:26 - 2015-04-08 20:26 - 00000000 ____D () C:\Program Files\Firefox
2015-04-07 21:53 - 2013-07-31 20:10 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2015-04-07 21:53 - 2013-07-31 20:10 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2015-04-07 21:52 - 2015-04-07 21:53 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-07 21:52 - 2015-04-07 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-07 21:39 - 2015-04-07 21:39 - 00030186 _____ () C:\Users\Jana\Desktop\Antivir_Ereignisse.txt
2015-04-07 21:07 - 2015-04-07 21:07 - 00074555 _____ () C:\Users\Jana\Desktop\gmer.txt
2015-04-07 20:55 - 2015-04-07 20:55 - 00380416 _____ () C:\Users\Jana\Desktop\Gmer-19357.exe
2015-04-07 20:52 - 2015-04-07 20:52 - 00041613 _____ () C:\Users\Jana\Desktop\Addition.txt
2015-04-07 20:51 - 2015-04-10 20:37 - 00018090 _____ () C:\Users\Jana\Desktop\FRST.txt
2015-04-07 20:51 - 2015-04-10 20:37 - 00000000 ____D () C:\FRST
2015-04-07 20:50 - 2015-04-07 20:50 - 02095616 _____ (Farbar) C:\Users\Jana\Desktop\FRST64.exe
2015-04-07 20:49 - 2015-04-07 20:49 - 00000470 _____ () C:\Users\Jana\Desktop\defogger_disable.log
2015-04-07 20:49 - 2015-04-07 20:49 - 00000000 _____ () C:\Users\Jana\defogger_reenable
2015-04-07 20:44 - 2015-04-07 20:44 - 00050477 _____ () C:\Users\Jana\Desktop\Defogger.exe
2015-04-07 16:03 - 2015-04-07 16:03 - 00000000 ____D () C:\ProgramData\Packercc56729e-9fc2-4c79-a5a8-77edc7087390
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-04 19:55 - 2015-04-07 16:02 - 00000000 ____D () C:\Program Files\Thunderbird
2015-03-30 19:42 - 2015-03-30 19:42 - 00001706 _____ () C:\Users\Jana\Desktop\avcenter.exe - Verknüpfung.lnk
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Users\Jana\AppData\Local\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V
2015-03-25 20:52 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\MyDrive Connect
2015-03-25 20:51 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\TomTom
2015-03-25 20:24 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 20:24 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-21 21:42 - 2015-04-08 21:18 - 00000000 ____D () C:\Program Files\Firefox.bak
2015-03-11 20:01 - 2015-02-20 06:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 20:01 - 2015-02-20 06:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 20:01 - 2015-02-20 06:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 20:01 - 2015-02-20 06:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 20:01 - 2015-02-20 05:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 20:01 - 2015-02-20 05:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 20:01 - 2015-02-03 05:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 20:01 - 2015-02-03 05:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 20:01 - 2015-02-03 05:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 20:01 - 2015-02-03 05:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 20:01 - 2015-02-03 05:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 02644992 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 20:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 20:01 - 2015-02-03 05:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 20:01 - 2015-02-03 05:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 20:01 - 2015-02-03 05:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 20:01 - 2015-02-03 05:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 20:01 - 2015-02-03 05:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 20:01 - 2015-02-03 05:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 20:01 - 2015-02-03 05:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 20:01 - 2015-02-03 05:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 20:01 - 2015-02-03 05:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 20:01 - 2015-02-03 05:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 20:01 - 2015-02-03 05:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 02135040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 20:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 20:01 - 2015-02-03 05:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 20:01 - 2015-02-03 05:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 20:01 - 2015-02-03 05:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 20:01 - 2015-02-03 05:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 20:01 - 2015-02-03 05:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 20:01 - 2015-02-03 05:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 20:01 - 2015-02-03 04:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 20:01 - 2014-11-01 00:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 20:01 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2015-03-11 20:01 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\Windows\system32\ci.dll
2015-03-11 20:00 - 2015-03-06 07:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 20:00 - 2015-03-06 07:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 20:00 - 2015-03-06 07:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 20:00 - 2015-03-06 07:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 20:00 - 2015-03-06 07:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 20:00 - 2015-03-06 07:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 20:00 - 2015-03-06 07:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 20:00 - 2015-03-06 07:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 20:00 - 2015-03-06 07:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 20:00 - 2015-03-06 07:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 20:00 - 2015-03-06 07:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 20:00 - 2015-03-06 07:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 20:00 - 2015-03-06 07:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 20:00 - 2015-03-06 07:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 20:00 - 2015-03-06 07:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 20:00 - 2015-02-21 21:17 - 17882624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 20:00 - 2015-02-21 21:07 - 00448512 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-11 20:00 - 2015-02-21 21:02 - 10931200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 20:00 - 2015-02-21 21:00 - 02339840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 20:00 - 2015-02-21 20:54 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 20:00 - 2015-02-21 20:54 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 20:00 - 2015-02-21 20:53 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 20:00 - 2015-02-21 20:52 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-11 20:00 - 2015-02-21 20:52 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 20:00 - 2015-02-21 20:52 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 02157568 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00598528 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-11 20:00 - 2015-02-21 20:51 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-11 20:00 - 2015-02-21 20:50 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 20:00 - 2015-02-21 20:50 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 20:00 - 2015-02-21 20:50 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 20:00 - 2015-02-21 20:50 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-11 20:00 - 2015-02-21 19:37 - 12375040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 20:00 - 2015-02-21 19:34 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-03-11 20:00 - 2015-02-21 19:29 - 09747968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 20:00 - 2015-02-21 19:28 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-11 20:00 - 2015-02-21 19:22 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 20:00 - 2015-02-21 19:21 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 20:00 - 2015-02-21 19:21 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 20:00 - 2015-02-21 19:20 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2015-03-11 20:00 - 2015-02-21 19:20 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 01803264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 20:00 - 2015-02-21 19:19 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 20:00 - 2015-02-21 19:18 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 20:00 - 2015-02-21 19:18 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2015-03-11 20:00 - 2015-02-21 19:18 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2015-03-11 20:00 - 2015-02-21 19:18 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2015-03-11 20:00 - 2015-02-21 19:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 20:00 - 2015-02-13 07:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 20:00 - 2015-02-13 07:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 20:00 - 2015-02-03 05:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 20:00 - 2015-02-03 05:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 20:00 - 2015-01-31 01:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 19:59 - 2015-02-26 05:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 19:59 - 2015-02-04 05:16 - 00392192 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 19:59 - 2015-02-04 04:54 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-11 19:59 - 2015-02-03 05:31 - 01190400 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 19:59 - 2015-02-03 05:12 - 01011200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 19:59 - 2015-01-17 04:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 19:59 - 2015-01-17 04:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-10 20:21 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-10 20:21 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-10 20:20 - 2013-03-01 17:54 - 01071472 _____ () C:\Windows\WindowsUpdate.log
2015-04-10 20:13 - 2010-11-21 08:50 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-04-10 20:13 - 2010-11-21 08:50 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-04-10 20:13 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-10 20:08 - 2010-11-21 05:47 - 00474280 _____ () C:\Windows\PFRO.log
2015-04-10 20:08 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-10 20:08 - 2009-07-14 06:51 - 00145369 _____ () C:\Windows\setupact.log
2015-04-10 20:06 - 2014-08-09 21:36 - 00000866 _____ () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-04-10 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-10 19:56 - 2013-09-08 19:19 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2015-04-09 21:12 - 2013-11-19 20:30 - 05869844 _____ () C:\Windows\IE11_main.log
2015-04-09 20:18 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-04-09 19:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-04-08 21:45 - 2013-03-01 20:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-08 20:16 - 2013-03-01 22:54 - 00000000 ____D () C:\Users\Jana\Excel
2015-04-07 21:53 - 2013-07-31 20:10 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-07 21:52 - 2013-07-31 20:10 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-07 21:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-07 20:49 - 2013-03-01 17:59 - 00000000 ____D () C:\Users\Jana
2015-04-07 16:02 - 2014-10-05 20:32 - 00000000 ___RD () C:\Users\Jana\Dropbox
2015-04-07 16:02 - 2014-10-05 20:24 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Dropbox
2015-04-01 14:02 - 2013-03-02 21:20 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Avira
2015-04-01 14:02 - 2013-03-02 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-04-01 14:01 - 2014-08-07 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-26 15:17 - 2014-12-11 20:22 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 15:17 - 2014-04-30 14:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-21 21:21 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-19 20:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 21:28 - 2013-03-20 14:36 - 00000000 ____D () C:\Program Files (x86)\Media Markt Fotoservice
2015-03-17 20:45 - 2013-03-01 22:52 - 00000000 ____D () C:\Users\Jana\Baby
2015-03-17 20:11 - 2014-10-05 20:32 - 00001021 _____ () C:\Users\Jana\Desktop\Dropbox.lnk
2015-03-17 20:11 - 2014-10-05 20:31 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-03-12 20:16 - 2009-07-14 06:45 - 00459640 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 20:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 20:14 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-11 21:02 - 2013-03-02 21:35 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 21:02 - 2009-07-14 04:34 - 00000627 _____ () C:\Windows\win.ini
2015-03-11 20:56 - 2013-08-15 20:08 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 20:50 - 2011-04-27 13:44 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2013-08-20 22:07 - 2013-08-20 22:07 - 0007597 _____ () C:\Users\Jana\AppData\Local\Resmon.ResmonCfg
Some content of TEMP:
====================
C:\Users\Jana\AppData\Local\Temp\avgnt.exe
C:\Users\Jana\AppData\Local\Temp\Quarantine.exe
C:\Users\Jana\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-07 18:24
==================== End Of Log ============================
--- --- --- Wie geht es jetzt weiter? Viele Grüße, chancex |
|
10.04.2015, 19:55
| #9 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Addition FRST fehlt noch: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Jana at 2015-04-10 20:54:25
Running from C:\Users\Jana\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 5.0 Sprint Plus (HKLM-x32\...\{D1696920-9794-4BBC-8A30-7A88763DE5A2}) (Version: 5.0.0.3501 - ABBYY Software House)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.02) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.02 - Adobe Systems Incorporated)
Adobe SVG Viewer (HKLM-x32\...\Adobe SVG Viewer) (Version: 1.0 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
Avira (HKLM-x32\...\{df495620-2ba9-412d-828d-b27f020d9fc8}) (Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing Bar (HKLM-x32\...\{16793295-2366-40F7-A045-A3E42A81365E}) (Version: 7.1.362.0 - Microsoft Corporation)
CameraHelperMsi (x32 Version: 13.31.1038.0 - Logitech) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
Cherry Keyboard Manager V3.0 Build 16 (HKLM-x32\...\{DC627AE5-A2B1-4D16-AF56-178D10EC3E81}) (Version: 3.0.0.16 - Cherry GmbH)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
EPSON Copy Utility (HKLM-x32\...\{B69CC1A5-0404-11D6-ABCB-005004C21D30}) (Version: - )
EPSON Photo Print (HKLM-x32\...\{1349B2BD-3B1E-4D25-BF6E-1BBAE2DD2F67}) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON Smart Panel (HKLM-x32\...\{6C11D561-620B-47DA-A693-4C597F3CDF40}) (Version: - )
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evrsoft First Page 2006 (HKLM-x32\...\Evrsoft First Page 2006_is1) (Version: - Evrsoft)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Free Pdf Perfect Prereq (HKLM-x32\...\{8a8f0ec0-a24b-4eb8-b811-2cf05c4d1c85}) (Version: 1.1.0.80 - Covus Freemium GmbH)
Free Pdf Perfect Prereq (x32 Version: 1.1.0.80 - Covus Freemium GmbH) Hidden
Free Video to DVD Converter version 5.0.45.806 (HKLM-x32\...\Free Video to DVD Converter_is1) (Version: 5.0.45.806 - DVDVideoSoft Ltd.)
Freemium Free PDF Perfect (HKLM-x32\...\{88265079-D6F4-4292-86BE-D2053E80BFE4}) (Version: 1.0 - Freemium)
Galería de fotos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Hessen 3D (HKLM-x32\...\Hessen 3D) (Version: - )
InterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}) (Version: 12.0.1.340 - Kaspersky Lab)
Kaspersky Security Scan (x32 Version: 12.0.1.340 - Kaspersky Lab) Hidden
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version: - )
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Media Markt Fotoservice 4.4 (HKLM-x32\...\Media Markt Fotoservice_is1) (Version: - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Nero 6 Demo (HKLM-x32\...\Nero - Burning Rom!UninstallKey) (Version: - )
Perf4870 Referenzhandbuch (HKLM-x32\...\Perf4870 Referenzhandbuch) (Version: - )
QuickTime (HKLM-x32\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RGMUpdater Monetization Control (HKLM-x32\...\RGMUpdater Monetization Controlcc56729e-9fc2-4c79-a5a8-77edc7087390) (Version: 2.2.0322.1140 - )
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden
ScanToWeb (HKLM-x32\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)
SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) Hidden
System Checkup 3.5 (HKLM-x32\...\{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1) (Version: 3.5.1.17 - iolo technologies, LLC)
t@x 2014 (HKLM-x32\...\{2547CF96-DBB7-4EDD-9327-0EFDD0D1FA8A}) (Version: 21.00.8480 - Buhl Data Service GmbH)
tax 2015 (HKLM-x32\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH)
TL-WN751ND Driver (HKLM-x32\...\{14770694-6C1C-4137-95F9-6F934D8491B4}) (Version: 1.00.0000 - TP-LINK)
Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)
VideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
07-04-2015 21:55:53 Windows Update
08-04-2015 21:23:16 Revo Uninstaller's restore point - Yahoo Community Smartbar Engine
08-04-2015 21:25:59 Revo Uninstaller's restore point - Yahoo Community Smartbar
08-04-2015 21:28:00 Revo Uninstaller's restore point - Ask Toolbar
08-04-2015 21:29:28 Revo Uninstaller's restore point - Avira SearchFree Toolbar plus Web Protection Updater
08-04-2015 22:28:45 Windows Update
09-04-2015 21:11:13 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2015-04-09 19:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0393A789-BABA-4CE8-83C5-A9A3F5108839} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {14B369BE-2BDB-4D35-8F88-AE20A3086585} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {48CC9294-5632-4961-8D3B-B4D075B55699} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {82530C68-DA05-4407-BBE1-ECDDD4215D31} - System32\Tasks\{034EF818-35FD-4225-9FE1-F399BE423749} => pcalua.exe -a D:\NERO\NERO6303.EXE -d D:\NERO
Task: {828CC646-5F43-4A26-A0F7-1E8B28CA2C8E} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {9C7BEEF5-DB1B-4AC2-B453-AC3D88CB11F8} - System32\Tasks\iolo System Checkup => C:\ProgramData\iolo\scustask.lnk [2014-06-14] ()
Task: {F6657653-8F0A-47E5-AD56-3601E830E103} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
==================== Loaded Modules (whitelisted) ==============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2015-04-10 19:29 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Jana\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1291533527-3129815193-1259002340-500 - Administrator - Disabled)
Gast (S-1-5-21-1291533527-3129815193-1259002340-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1291533527-3129815193-1259002340-1004 - Limited - Enabled)
Jana (S-1-5-21-1291533527-3129815193-1259002340-1002 - Administrator - Enabled) => C:\Users\Jana
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/10/2015 08:46:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:46:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:33:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:33:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:33:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:32:43 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/10/2015 08:32:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
System errors:
=============
Microsoft Office Sessions:
=========================
Error: (04/10/2015 08:46:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/10/2015 08:46:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/10/2015 08:33:14 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\uvdetecthw.exe
Error: (04/10/2015 08:33:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\BatchDL.exe
Error: (04/10/2015 08:33:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\APLoading.exe
Error: (04/10/2015 08:32:43 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
Error: (04/10/2015 08:32:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 945 Processor
Percentage of memory in use: 24%
Total physical RAM: 7934.12 MB
Available physical RAM: 5989.27 MB
Total Pagefile: 15866.42 MB
Available Pagefile: 13512.84 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Win7HPx64) (Fixed) (Total:931.51 GB) (Free:778.44 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive i: (DATA) (Fixed) (Total:298.02 GB) (Free:243.4 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E05430EB)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 0E207A27)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=0C)
==================== End Of Log ============================
|
|
11.04.2015, 07:35
| #10 |
| /// the machine /// TB-Ausbilder | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefundenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.04.2015, 20:52
| #11 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, nach einem verlängerten Wochenende komme ich endlich zu den Scans: ESET: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8e7c50565ca8554fad4847f54e715b54
# engine=23381
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-14 07:01:06
# local_time=2015-04-14 09:01:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 5379683 70351382 0 0
# scanned=273692
# found=6
# cleaned=0
# scan_time=4992
sh=342863BE9123C02A798C7D8D6B2FEF4DF9832165 ft=1 fh=1790baf10fb16e60 vn="Win32/Toolbar.Linkury.I evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\ProductUI\uninstall.exe.vir"
sh=DEF493B414D196E9819ED83C771DCB9F292B3D20 ft=1 fh=6bafd9f7d982dd86 vn="Variante von MSIL/Toolbar.Linkury.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Jana\AppData\Local\RGMService\RBS\ResetBrowserSettings.exe.vir"
sh=3D8FEB274B1F910633E0EE3966A82AE9DCBD406A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\extensions\crossriderapp16150@crossrider.com\extensionData\plugins\21.js.vir"
sh=A61F2AB2BDA3DF4EA26FB96BFA4BAA4BEFA99E6A ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\extensions\crossriderapp16150@crossrider.com\extensionData\plugins\28.js.vir"
sh=5C2768D332364C22EF01000B00C9F9A9FF875260 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Jana\AppData\Local\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\cache2\entries\058FAD19FD57514BA47257E301D3C4A8D4860956"
sh=44341AC3075A630346D44C97F22FE3B8DB90A2C8 ft=1 fh=03026ae03c5e9bfc vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll"
Code:
ATTFilter Results of screen317's Security Check version 1.00
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus
Microsoft Security Essentials
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 40
Adobe Flash Player 11.8.800.94 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (37.0.1)
Mozilla Thunderbird (31.6.0)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
Kaspersky Lab Kaspersky Security Scan 2.0 kss.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-04-2015
Ran by Jana (administrator) on JANA-PC on 14-04-2015 21:43:52
Running from C:\Users\Jana\Desktop
Loaded Profiles: Jana (Available profiles: Jana)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe
(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(TomTom) C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Cherry GmbH) C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Cherry, Auerbach Germany, www.cherry.de) C:\Program Files (x86)\Cherry\CDI\cdi.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Mozilla Corporation) C:\Program Files\Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [SpywareTerminatorShield] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-02-12] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] => C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [avgnt] => C:\Program Files\Avira\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-01] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [UVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341488 2007-03-03] (InterVideo Digital Technology Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\qttask.exe [282624 2006-09-01] (Apple Computer, Inc.)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [CherryKeyMan] => C:\Program Files (x86)\Cherry\KeyMan\KeyMan.exe [237620 2006-08-02] (Cherry GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-14] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Run: [MyDriveConnect.exe] => C:\Program Files (x86)\MyDrive Connect\MyDriveConnect.exe [1792376 2014-10-03] (TomTom)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-04-07] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-07] (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.362.0\BingExt.dll [2012-02-13] (Microsoft Corporation.)
Toolbar: HKLM-x32 - Free PDF Perfect - {EFC2B9BE-AB2B-47F1-A47D-9EB28E58C917} - C:\Program Files (x86)\PDF Creater\Free PDF Perfect\ieagent32.dll [2013-08-27] (soft Xpansion)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058
FF SelectedSearchEngine: WEB.DE Suche
FF Homepage: www.google.de
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.autoconfig_url", "");
FF NetworkProxy: "user_pref("extension.gacela.network.proxy.type", 5);
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll [2013-08-02] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll [2013-08-02] ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-31] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-07] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-07-28] (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf -> C:\Program Files (x86)\Common Files\Freemium\np-sxpdf.dll [2013-08-27] (soft-Xpansion)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-02-16] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\avira-safesearch.xml [2015-03-01]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\englische-ergebnisse.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\gmx-suche.xml [2014-06-04]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\lastminute.xml [2014-05-23]
FF SearchPlugin: C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\searchplugins\webde-suche.xml [2014-06-04]
FF Extension: Avira Browser Safety - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\abs@avira.com [2015-03-31]
FF Extension: Avira SafeSearch - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\safesearch@avira.com [2015-03-01]
FF Extension: NoScript - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-09-03]
FF Extension: Adblock Plus - C:\Users\Jana\AppData\Roaming\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-09-03]
FF HKLM-x32\...\Firefox\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF Extension: Free PDF Perfect - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb [2013-08-27]
FF HKLM-x32\...\Thunderbird\Extensions: [{B45418F9-6406-4828-9D1A-35313FB1E2D6}] - C:\ProgramData\Freemium\Free PDF Perfect\Data\fftb
FF HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Firefox\firefox.exe
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files\Avira\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\Avira\AntiVir Desktop\sched.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files\Avira\Avira\AntiVir Desktop\AVWEBGRD.EXE [1004032 2015-04-01] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-14] (Avira Operations GmbH & Co. KG)
R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)
R3 Cherry Device Interface; C:\Program Files (x86)\Cherry\CDI\cdi.exe [573486 2006-06-27] (Cherry, Auerbach Germany, www.cherry.de) [File not signed]
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 SXDS10; C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [234096 2013-08-27] (soft Xpansion)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-04] (Avira Operations GmbH & Co. KG)
S3 Ch64USBM; C:\Windows\System32\drivers\Ch64USBM.sys [91008 2006-06-02] (Cherry GmbH)
S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [8192 2005-03-28] ()
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-14 21:43 - 2015-04-14 21:43 - 00000000 ____D () C:\Users\Jana\Desktop\FRST-OlderVersion
2015-04-14 21:42 - 2015-04-14 21:42 - 00001037 _____ () C:\Users\Jana\Desktop\checkup.txt
2015-04-14 21:40 - 2015-04-14 21:40 - 00852616 _____ () C:\Users\Jana\Desktop\SecurityCheck.exe
2015-04-14 19:34 - 2015-04-14 19:34 - 02347384 _____ (ESET) C:\Users\Jana\Desktop\esetsmartinstaller_deu.exe
2015-04-10 20:54 - 2015-04-10 20:54 - 00023477 _____ () C:\Users\Jana\Desktop\Addition2.txt
2015-04-10 20:47 - 2015-04-10 20:47 - 00121707 _____ () C:\Users\Jana\Desktop\MBAM_JRT.zip
2015-04-10 20:41 - 2015-04-10 20:41 - 00051092 _____ () C:\Users\Jana\Desktop\FRST2.txt
2015-04-10 20:15 - 2015-04-10 20:15 - 00000787 _____ () C:\Users\Jana\Desktop\JRT.txt
2015-04-10 20:13 - 2015-04-10 20:13 - 02686959 _____ (Thisisu) C:\Users\Jana\Desktop\JRT.exe
2015-04-10 20:13 - 2015-04-10 20:13 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-JANA-PC-Windows-7-Home-Premium-(64-bit).dat
2015-04-10 20:13 - 2015-04-10 20:13 - 00000000 ____D () C:\RegBackup
2015-04-10 20:11 - 2015-04-10 20:11 - 00034458 _____ () C:\Users\Jana\Desktop\AdwCleaner.txt
2015-04-10 20:04 - 2015-04-10 20:07 - 00000000 ____D () C:\AdwCleaner
2015-04-10 20:03 - 2015-04-10 20:03 - 02217984 _____ () C:\Users\Jana\Desktop\AdwCleaner_4.201.exe
2015-04-10 20:02 - 2015-04-10 20:02 - 00819604 _____ () C:\Users\Jana\Desktop\mbam.txt
2015-04-10 19:40 - 2015-04-10 20:01 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-10 19:40 - 2015-04-10 19:40 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-04-10 19:40 - 2015-04-10 19:40 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-04-10 19:40 - 2015-03-17 06:15 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-10 19:40 - 2015-03-17 06:15 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-10 19:40 - 2015-03-17 06:15 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-10 19:37 - 2015-04-10 19:37 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Jana\Desktop\mbam-setup-2.1.4.1018.exe
2015-04-09 20:18 - 2015-04-09 20:18 - 00019613 _____ () C:\ComboFix.txt
2015-04-08 21:36 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-08 21:36 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-08 21:36 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-08 21:36 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-08 21:32 - 2015-04-09 20:18 - 00000000 ____D () C:\Qoobox
2015-04-08 21:32 - 2015-04-08 21:51 - 00000000 ____D () C:\Windows\erdnt
2015-04-08 21:31 - 2015-04-08 21:31 - 05617275 ____R (Swearware) C:\Users\Jana\Desktop\ComboFix.exe
2015-04-08 21:21 - 2015-04-08 21:21 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Jana\Desktop\revosetup95.exe
2015-04-08 21:21 - 2015-04-08 21:21 - 00001277 _____ () C:\Users\Jana\Desktop\Revo Uninstaller.lnk
2015-04-08 21:21 - 2015-04-08 21:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-04-08 20:26 - 2015-04-08 20:26 - 00000000 ____D () C:\Program Files\Firefox
2015-04-07 21:53 - 2013-07-31 20:10 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2015-04-07 21:53 - 2013-07-31 20:10 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2015-04-07 21:52 - 2015-04-07 21:53 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-07 21:52 - 2015-04-07 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-07 21:39 - 2015-04-07 21:39 - 00030186 _____ () C:\Users\Jana\Desktop\Antivir_Ereignisse.txt
2015-04-07 21:07 - 2015-04-07 21:07 - 00074555 _____ () C:\Users\Jana\Desktop\gmer.txt
2015-04-07 20:55 - 2015-04-07 20:55 - 00380416 _____ () C:\Users\Jana\Desktop\Gmer-19357.exe
2015-04-07 20:52 - 2015-04-10 20:54 - 00023477 _____ () C:\Users\Jana\Desktop\Addition.txt
2015-04-07 20:51 - 2015-04-14 21:43 - 00019266 _____ () C:\Users\Jana\Desktop\FRST.txt
2015-04-07 20:51 - 2015-04-14 21:43 - 00000000 ____D () C:\FRST
2015-04-07 20:50 - 2015-04-14 21:43 - 02096640 _____ (Farbar) C:\Users\Jana\Desktop\FRST64.exe
2015-04-07 20:49 - 2015-04-07 20:49 - 00000470 _____ () C:\Users\Jana\Desktop\defogger_disable.log
2015-04-07 20:49 - 2015-04-07 20:49 - 00000000 _____ () C:\Users\Jana\defogger_reenable
2015-04-07 20:44 - 2015-04-07 20:44 - 00050477 _____ () C:\Users\Jana\Desktop\Defogger.exe
2015-04-07 16:03 - 2015-04-07 16:03 - 00000000 ____D () C:\ProgramData\Packercc56729e-9fc2-4c79-a5a8-77edc7087390
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 20:48 - 2015-04-04 20:48 - 00000000 ___SD () C:\Windows\system32\GWX
2015-04-04 19:55 - 2015-04-07 16:02 - 00000000 ____D () C:\Program Files\Thunderbird
2015-03-30 19:42 - 2015-03-30 19:42 - 00001706 _____ () C:\Users\Jana\Desktop\avcenter.exe - Verknüpfung.lnk
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Users\Jana\AppData\Local\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TomTom
2015-03-25 20:53 - 2015-03-25 20:53 - 00000000 ____D () C:\Program Files (x86)\TomTom International B.V
2015-03-25 20:52 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\MyDrive Connect
2015-03-25 20:51 - 2015-03-25 20:52 - 00000000 ____D () C:\Program Files (x86)\TomTom
2015-03-25 20:24 - 2015-03-11 06:06 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-03-25 20:24 - 2015-03-11 06:06 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-03-25 20:24 - 2015-03-11 06:05 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-03-25 20:24 - 2015-03-11 06:02 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-03-21 21:42 - 2015-04-08 21:18 - 00000000 ____D () C:\Program Files\Firefox.bak
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-14 21:39 - 2013-03-01 17:54 - 02024661 _____ () C:\Windows\WindowsUpdate.log
2015-04-14 19:34 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-14 19:34 - 2009-07-14 06:45 - 00031856 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-14 19:32 - 2010-11-21 08:50 - 00699432 _____ () C:\Windows\system32\perfh007.dat
2015-04-14 19:32 - 2010-11-21 08:50 - 00149572 _____ () C:\Windows\system32\perfc007.dat
2015-04-14 19:32 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-14 19:27 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-14 19:27 - 2009-07-14 06:51 - 00145481 _____ () C:\Windows\setupact.log
2015-04-12 22:13 - 2013-11-19 20:30 - 05888260 _____ () C:\Windows\IE11_main.log
2015-04-10 20:08 - 2010-11-21 05:47 - 00474280 _____ () C:\Windows\PFRO.log
2015-04-10 20:06 - 2014-08-09 21:36 - 00000866 _____ () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-04-10 19:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-10 19:56 - 2013-09-08 19:19 - 00000000 ____D () C:\Program Files (x86)\CDBurnerXP
2015-04-09 20:18 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2015-04-09 19:55 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2015-04-08 21:45 - 2013-03-01 20:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-08 20:16 - 2013-03-01 22:54 - 00000000 ____D () C:\Users\Jana\Excel
2015-04-07 21:53 - 2013-07-31 20:10 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-07 21:52 - 2013-07-31 20:10 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-07 21:13 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-07 20:49 - 2013-03-01 17:59 - 00000000 ____D () C:\Users\Jana
2015-04-07 16:02 - 2014-10-05 20:32 - 00000000 ___RD () C:\Users\Jana\Dropbox
2015-04-07 16:02 - 2014-10-05 20:24 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Dropbox
2015-04-01 14:02 - 2013-03-02 21:20 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Avira
2015-04-01 14:02 - 2013-03-02 21:14 - 00000000 ____D () C:\ProgramData\Avira
2015-04-01 14:01 - 2014-08-07 14:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-26 15:17 - 2014-12-11 20:22 - 00000000 ____D () C:\Windows\system32\appraiser
2015-03-26 15:17 - 2014-04-30 14:43 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-03-21 21:21 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-19 20:41 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 21:28 - 2013-03-20 14:36 - 00000000 ____D () C:\Program Files (x86)\Media Markt Fotoservice
2015-03-17 20:45 - 2013-03-01 22:52 - 00000000 ____D () C:\Users\Jana\Baby
2015-03-17 20:11 - 2014-10-05 20:32 - 00001021 _____ () C:\Users\Jana\Desktop\Dropbox.lnk
2015-03-17 20:11 - 2014-10-05 20:31 - 00000000 ____D () C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
==================== Files in the root of some directories =======
2013-08-20 22:07 - 2013-08-20 22:07 - 0007597 _____ () C:\Users\Jana\AppData\Local\Resmon.ResmonCfg
Some content of TEMP:
====================
C:\Users\Jana\AppData\Local\Temp\avgnt.exe
C:\Users\Jana\AppData\Local\Temp\Quarantine.exe
C:\Users\Jana\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-14 21:19
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-04-2015
Ran by Jana at 2015-04-14 21:48:39
Running from C:\Users\Jana\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Microsoft Security Essentials (Disabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Disabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 5.0 Sprint Plus (HKLM-x32\...\{D1696920-9794-4BBC-8A30-7A88763DE5A2}) (Version: 5.0.0.3501 - ABBYY Software House)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Photoshop 6.0 (HKLM-x32\...\Adobe Photoshop 6.0) (Version: 6.0 - Adobe Systems, Inc.)
Adobe Reader XI (11.0.02) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.02 - Adobe Systems Incorporated)
Adobe SVG Viewer (HKLM-x32\...\Adobe SVG Viewer) (Version: 1.0 - Adobe Systems, Inc.)
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
Avira (HKLM-x32\...\{df495620-2ba9-412d-828d-b27f020d9fc8}) (Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.28431 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Bing Bar (HKLM-x32\...\{16793295-2366-40F7-A045-A3E42A81365E}) (Version: 7.1.362.0 - Microsoft Corporation)
CameraHelperMsi (x32 Version: 13.31.1038.0 - Logitech) Hidden
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5306 - CDBurnerXP)
Cherry Keyboard Manager V3.0 Build 16 (HKLM-x32\...\{DC627AE5-A2B1-4D16-AF56-178D10EC3E81}) (Version: 3.0.0.16 - Cherry GmbH)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\...\Dropbox) (Version: 3.2.9 - Dropbox, Inc.)
EPSON Copy Utility (HKLM-x32\...\{B69CC1A5-0404-11D6-ABCB-005004C21D30}) (Version: - )
EPSON Photo Print (HKLM-x32\...\{1349B2BD-3B1E-4D25-BF6E-1BBAE2DD2F67}) (Version: - )
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON Smart Panel (HKLM-x32\...\{6C11D561-620B-47DA-A693-4C597F3CDF40}) (Version: - )
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evrsoft First Page 2006 (HKLM-x32\...\Evrsoft First Page 2006_is1) (Version: - Evrsoft)
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Free Pdf Perfect Prereq (HKLM-x32\...\{8a8f0ec0-a24b-4eb8-b811-2cf05c4d1c85}) (Version: 1.1.0.80 - Covus Freemium GmbH)
Free Pdf Perfect Prereq (x32 Version: 1.1.0.80 - Covus Freemium GmbH) Hidden
Free Video to DVD Converter version 5.0.45.806 (HKLM-x32\...\Free Video to DVD Converter_is1) (Version: 5.0.45.806 - DVDVideoSoft Ltd.)
Freemium Free PDF Perfect (HKLM-x32\...\{88265079-D6F4-4292-86BE-D2053E80BFE4}) (Version: 1.0 - Freemium)
Galería de fotos (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Hessen 3D (HKLM-x32\...\Hessen 3D) (Version: - )
InterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{56009CA3-423B-41F8-884A-E5B049534F15}) (Version: 12.0.1.340 - Kaspersky Lab)
Kaspersky Security Scan (x32 Version: 12.0.1.340 - Kaspersky Lab) Hidden
Lidl-Fotos (HKLM-x32\...\Lidl-Fotos_is1) (Version: - )
Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.1.4.1018 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.4.1018 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Media Markt Fotoservice 4.4 (HKLM-x32\...\Media Markt Fotoservice_is1) (Version: - )
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.6.0 (x86 de)) (Version: 31.6.0 - Mozilla)
MyDriveConnect 3.3.0.1812 (HKLM-x32\...\MyDriveConnect) (Version: 3.3.0.1812 - TomTom)
Nero 6 Demo (HKLM-x32\...\Nero - Burning Rom!UninstallKey) (Version: - )
Perf4870 Referenzhandbuch (HKLM-x32\...\Perf4870 Referenzhandbuch) (Version: - )
QuickTime (HKLM-x32\...\{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}) (Version: 7.1.3.100 - Apple Computer, Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RGMUpdater Monetization Control (HKLM-x32\...\RGMUpdater Monetization Controlcc56729e-9fc2-4c79-a5a8-77edc7087390) (Version: 2.2.0322.1140 - )
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.14083.17 - Samsung Electronics Co., Ltd.) Hidden
ScanToWeb (HKLM-x32\...\{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}) (Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)
SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) Hidden
System Checkup 3.5 (HKLM-x32\...\{4AC7B4E7-59B7-4E48-A60D-263C486FC33A}_is1) (Version: 3.5.1.17 - iolo technologies, LLC)
t@x 2014 (HKLM-x32\...\{2547CF96-DBB7-4EDD-9327-0EFDD0D1FA8A}) (Version: 21.00.8480 - Buhl Data Service GmbH)
tax 2015 (HKLM-x32\...\{4CF96070-DEE5-43B5-B6A7-23AC07BC0C77}) (Version: 22.00.8811 - Buhl Data Service GmbH)
TL-WN751ND Driver (HKLM-x32\...\{14770694-6C1C-4137-95F9-6F934D8491B4}) (Version: 1.00.0000 - TP-LINK)
Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)
VideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) Hidden
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1291533527-3129815193-1259002340-1002_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Jana\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
08-04-2015 21:23:16 Revo Uninstaller's restore point - Yahoo Community Smartbar Engine
08-04-2015 21:25:59 Revo Uninstaller's restore point - Yahoo Community Smartbar
08-04-2015 21:28:00 Revo Uninstaller's restore point - Ask Toolbar
08-04-2015 21:29:28 Revo Uninstaller's restore point - Avira SearchFree Toolbar plus Web Protection Updater
08-04-2015 22:28:45 Windows Update
09-04-2015 21:11:13 Windows Update
10-04-2015 20:57:32 Windows Update
12-04-2015 22:11:50 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2015-04-09 19:53 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0393A789-BABA-4CE8-83C5-A9A3F5108839} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: {14B369BE-2BDB-4D35-8F88-AE20A3086585} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {48CC9294-5632-4961-8D3B-B4D075B55699} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {82530C68-DA05-4407-BBE1-ECDDD4215D31} - System32\Tasks\{034EF818-35FD-4225-9FE1-F399BE423749} => pcalua.exe -a D:\NERO\NERO6303.EXE -d D:\NERO
Task: {828CC646-5F43-4A26-A0F7-1E8B28CA2C8E} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {9C7BEEF5-DB1B-4AC2-B453-AC3D88CB11F8} - System32\Tasks\iolo System Checkup => C:\ProgramData\iolo\scustask.lnk [2014-06-14] ()
Task: {F6657653-8F0A-47E5-AD56-3601E830E103} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
==================== Loaded Modules (whitelisted) ==============
2012-12-19 16:32 - 2012-12-19 16:32 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2012-12-07 15:15 - 2012-12-07 15:15 - 02126264 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtCore4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 07422392 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtGui4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 02453944 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtDeclarative4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 01270200 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtScript4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 00192952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtSql4.dll
2012-12-07 15:15 - 2012-12-07 15:15 - 00795064 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtNetwork4.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00026488 _____ () C:\Program Files (x86)\MyDrive Connect\DeviceDetection.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00087416 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterBase.dll
2014-10-03 14:04 - 2014-10-03 14:04 - 00398712 _____ () C:\Program Files (x86)\MyDrive Connect\TomTomSupporterProxy.dll
2015-04-10 19:29 - 2014-07-14 16:49 - 00049744 _____ () C:\Users\Jana\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll
2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll
2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll
2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2006-02-22 15:47 - 2006-02-22 15:47 - 00073728 _____ () C:\Program Files (x86)\Cherry\KeyMan\zlib1.dll
2006-02-22 15:47 - 2006-02-22 15:47 - 00114688 _____ () C:\Program Files (x86)\Cherry\KeyMan\libpng13.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1291533527-3129815193-1259002340-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Jana\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1291533527-3129815193-1259002340-500 - Administrator - Disabled)
Gast (S-1-5-21-1291533527-3129815193-1259002340-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1291533527-3129815193-1259002340-1004 - Limited - Enabled)
Jana (S-1-5-21-1291533527-3129815193-1259002340-1002 - Administrator - Enabled) => C:\Users\Jana
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/14/2015 09:37:40 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/14/2015 09:21:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/14/2015 09:21:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/14/2015 09:21:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/14/2015 09:20:29 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/14/2015 09:20:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (04/14/2015 07:34:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/14/2015 07:34:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/14/2015 07:34:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/14/2015 07:34:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (04/14/2015 07:37:15 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/14/2015 07:37:12 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/14/2015 07:33:45 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/14/2015 07:29:00 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (04/14/2015 07:28:35 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/14/2015 07:28:21 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (04/14/2015 07:27:41 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (04/14/2015 07:27:42 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )
Description: Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
Feature: %%886
Fehlercode: 0x80070005
Fehlerbeschreibung: Zugriff verweigert
Grund: %%892
Error: (04/14/2015 07:27:06 PM) (Source: atikmdag) (EventID: 10261) (User: )
Description: Display is not active
Error: (04/14/2015 07:27:06 PM) (Source: atikmdag) (EventID: 19468) (User: )
Description: CPLIB :: General - Invalid Parameter
Microsoft Office Sessions:
=========================
Error: (04/14/2015 09:37:40 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (04/14/2015 09:21:05 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\uvdetecthw.exe
Error: (04/14/2015 09:21:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\BatchDL.exe
Error: (04/14/2015 09:21:00 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"c:\program files (x86)\ulead systems\ulead videostudio 11\APLoading.exe
Error: (04/14/2015 09:20:29 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
Error: (04/14/2015 09:20:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\vstudio.exe
Error: (04/14/2015 07:34:38 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jana\Desktop\esetsmartinstaller_deu.exe
Error: (04/14/2015 07:34:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jana\Desktop\esetsmartinstaller_deu.exe
Error: (04/14/2015 07:34:35 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jana\Desktop\esetsmartinstaller_deu.exe
Error: (04/14/2015 07:34:26 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Jana\Desktop\esetsmartinstaller_deu.exe
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X4 945 Processor
Percentage of memory in use: 30%
Total physical RAM: 7934.12 MB
Available physical RAM: 5524.74 MB
Total Pagefile: 15866.42 MB
Available Pagefile: 13265.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (Win7HPx64) (Fixed) (Total:931.51 GB) (Free:777.18 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive i: (DATA) (Fixed) (Total:298.02 GB) (Free:243.4 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E05430EB)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 298.1 GB) (Disk ID: 0E207A27)
Partition 1: (Not Active) - (Size=298.1 GB) - (Type=0C)
==================== End Of Log ============================
Viele Grüße, chancex |
|
15.04.2015, 14:07
| #12 |
| /// the machine /// TB-Ausbilder | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Flash Player updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Users\Jana\AppData\Local\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\cache2\entries\058FAD19FD57514BA47257E301D3C4A8D4860956
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Firefox deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.mozilla.org/de/kb/fi...einfach-loesen  Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen. Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.   Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. Meine Empfehlung:  Emsisoft Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.04.2015, 20:51
| #13 |
| | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden Hallo, hier kommt Fixlog: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 15-04-2015 04
Ran by Jana at 2015-04-15 21:04:12 Run:1
Running from C:\Users\Jana\Desktop
Loaded Profiles: Jana (Available profiles: Jana)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Users\Jana\AppData\Local\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\cache2\entries\058FAD19FD57514BA47257E301D3C4A8D4860956
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll
Emptytemp:
*****************
C:\Users\Jana\AppData\Local\Mozilla\Firefox\Profiles\yqzpld84.default-1365012383058\cache2\entries\058FAD19FD57514BA47257E301D3C4A8D4860956 => Moved successfully.
C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll => Moved successfully.
EmptyTemp: => Removed 10.3 GB temporary data.
The system needed a reboot.
==== End of Fixlog 21:04:26 ====
chancex |
|
16.04.2015, 10:45
| #14 |
| /// the machine /// TB-Ausbilder | TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden ja
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu TR/Dropper.gen in C:\Windows\Temp\Setup_4.exe gefunden |
| adware, avira, browser, canon, computer, fehler, firefox, flash player, google, helper, home, homepage, kaspersky, launch, malware, mozilla, problem, programm, realtek, registry, security, services.exe, spyware, svchost.exe, trojan, windows, windows xp |
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
