| |
| |||||||
Log-Analyse und Auswertung: CloudScout bringt immer WerbungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
15.06.2015, 13:08
| #1 |
| |  CloudScout bringt immer Werbung Hallo miteinander Sobald ich in Chrome eine Webseite öffne, werden Werbungen von CloudScout eingeblendet. Diverse Links werden dann mit Werbung dieser Webseite verbunden. Das Ganze hat damit begonnen, dass ich dummerweise einen Installer auf dem PC ausgeführt habe. Kapersky zeigt mir keinen Fehler an. Als Betriebssystem verwende ich Windows 8.1. Der Fehler tritt mit Google Chrome als auch mit IE auf. Sämtliche Einstellungen bei Chrome habe ich schon zurückgesetzt, aber erfolglos. Wäre cool, wenn mir jemand helfen könnte. Danke und Gruss Thomas |
|
15.06.2015, 13:29
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | CloudScout bringt immer Werbung Hi und
__________________ Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
15.06.2015, 14:08
| #3 |
| | Nun noch richtig eingefügt Hier nochmals die Dateien, wie sie sein sollten.
__________________Addition: [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by TL at 2015-06-15 11:43:30
Running from C:\Users\tl\Desktop\Virenschutz
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1747593855-565391543-2980224419-500 - Administrator - Disabled)
Gast (S-1-5-21-1747593855-565391543-2980224419-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Advanced IP Scanner 2.4 (HKLM-x32\...\{051770B2-AC7A-4A63-9326-394C3E6E3B12}) (Version: 2.4.2526 - Famatech)
AMD Catalyst Install Manager (HKLM\...\{C23F43A3-327E-2969-52F2-89ED83D99F48}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{026B819B-4D60-4C8B-892D-33A0D8666F60}) (Version: 2.0.0.3 - Ihr Firmenname)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
cardPresso (HKLM-x32\...\cardPresso) (Version: 1.1.0 - Copyright 2012, cardPresso, Lda)
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)
DataDirect ODBC driver for InterBase (HKLM-x32\...\DataDirect ODBC driver for InterBase) (Version: - )
DecoderProgrammer (C:\Program Files (x86)\DecoderProgrammer\) (HKLM-x32\...\ST6UNST #2) (Version: - )
DecoderProgrammer (HKLM-x32\...\ST6UNST #1) (Version: - )
Digi Device Discovery (HKLM-x32\...\Digi Device Discovery) (Version: - )
ELCOM BTI-TERM (HKLM-x32\...\ELCOM BTI-TERM) (Version: 1.0 - ELCOM GmbH & Co. KG)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Drive (HKLM-x32\...\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
IB-Upgrade Version 1.0.0.1 (HKLM-x32\...\{15E58B69-C4D7-4338-AA1C-4519F843AE0C}_is1) (Version: 1.0.0.1 - Uhlenbrock Elektronik GmbH)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
InterBase 2009 (HKLM-x32\...\InterBase 2009) (Version: InterBase 2009 - Embarcadero Technologies Inc.)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Linphone (HKLM-x32\...\Linphone) (Version: 3.8.4 - Belledonne communications)
LogMeIn (HKLM-x32\...\{CB7AF84A-1B7F-4C6B-8A58-EB7CDE48C23A}) (Version: 4.1.3268 - LogMeIn, Inc.)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MySQL Utilities (HKLM-x32\...\{0B18AA75-6A44-4950-A0A2-A486C2D839A0}) (Version: 1.4.4 - Oracle Corporation)
MySQL Workbench 6.1 CE (HKLM-x32\...\{AD95295B-0279-43B6-A873-F12A1D1CD146}) (Version: 6.1.7 - Oracle Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
OKI Network Extension (HKLM-x32\...\{38ADB9A6-798C-11D6-A855-00105A80791C}) (Version: 1.00.000 - Okidata)
Online Plug-in (x32 Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden
Oracle VM VirtualBox 4.3.26 (HKLM\...\{5771F59A-BFC9-4FAF-A883-7642EF4BA3C3}) (Version: 4.3.26 - Oracle Corporation)
PhonerLite 2.25 (HKLM-x32\...\PhonerLite_is1) (Version: 2.25 - Heiko Sommerfeldt)
PingPlotter Standard 3.42.3s (HKLM-x32\...\{1C1D0A2C-C8B4-4C2C-9877-884F8FC082B5}) (Version: 3.42.3.6 - Nessoft, LLC)
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Scriptable Automation Manager (HKLM-x32\...\{9F26E6E5-66BD-4EEA-9038-AC18A63E49A5}) (Version: 0.9.20 - AIT Software GmbH)
Self-Service Plug-in (x32 Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6406 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
Toshiba Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.972 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{11A5F0A4-5738-4857-9CEA-216E4F78BEB5}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.2.2 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.3 - VMware, Inc)
VMware Player (Version: 6.0.3 - VMware, Inc.) Hidden
VMware vSphere Client 5.1 (HKLM-x32\...\{09DC364B-A77A-49A0-972B-E43F0DACC5E3}) (Version: 5.1.0.1557 - VMware, Inc.)
vtiger CRM Outlook Plugin-6.0-X86 (HKLM-x32\...\vtiger CRM Outlook Plugin-6.0-X86) (Version: - Vtiger)
vtiger CRM Outlook plugin-6.0-X86_64 (HKLM\...\vtiger CRM Outlook plugin-6.0-X86_64) (Version: - Vtiger)
vtigercrm600 (HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\vtigercrm600) (Version: - )
VWP100 (HKLM-x32\...\PfisterWaagenGmbH VWP100_is1) (Version: 2.1.0.205 - Pfister Waagen Bilanciai GmbH)
WinWeigh Plus (HKLM-x32\...\PfisterWaagenGmbH WinWeighPlus_is1) (Version: 6.0.0.203 - Pfister Waagen Bilanciai GmbH)
X-Lite (HKLM-x32\...\{D79740D7-405F-4A07-A144-40A655CA4B7C}) (Version: 48.7.6589 - CounterPath Corporation)
Zebra ZXP S3 and S1 Card Printers (HKLM-x32\...\{1132009E-7E6B-43D3-8F24-5554F5E9483B}) (Version: 05.01.00.00 - Zebra Technologies Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\tl\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
05-06-2015 16:17:04 Windows Update
10-06-2015 13:43:26 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
12-06-2015 14:37:53 Removed PlanetView 030006
15-06-2015 09:37:30 AA11
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1A2A573B-2C2A-44EF-A06D-5431D3C00D31} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-06-11] (Microsoft Corporation)
Task: {21E2740A-9194-4FAF-9B22-117618CDA0A0} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {26166EDA-84BE-488F-822B-13821D2B145E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-29] (Google Inc.)
Task: {2A54C017-97F1-445E-A08F-FF3A8CC22857} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {2F16612B-41A6-4680-A5EF-395EBE596C73} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {32A9D14E-C630-4A42-9556-CFD9EEAC6C4C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {417502C0-9D3B-4553-9DE0-69FA1FA67AE1} - System32\Tasks\{7FB0C9C3-0F3E-4C60-9925-21E2C811DC63} => pcalua.exe -a C:\Users\tl\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=slb2
Task: {5242AA7D-454B-4B4F-9014-D4837CDCBC5E} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-09-25] (Toshiba Europe GmbH)
Task: {5AB1DB5F-1591-4541-849A-635A46A95760} - System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202}
Task: {5B8BFD2D-202A-4F64-B1A4-B960C4BB4878} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {74415D5C-E789-4B25-8333-AA42DA002600} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}
Task: {8C7DC534-40B9-4692-90E4-DE07859545E2} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {A1AFF702-852D-4707-8739-A25D528605D5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-29] (Google Inc.)
Task: {B1495406-6C7D-4100-AFEC-5E5830E0966B} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1026108093-1314267383-2887952174-1155 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {CABB91D3-E361-4ECC-BADD-08D85B7C3E4D} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {E8B683AC-BAE7-4250-A5FB-DA5919F275FD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {EA7E79F4-622D-4847-9422-E8A0C990CB77} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: C:\WINDOWS\Tasks\vtigerCRM Email Reminder.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\modules\Calendar\SendReminder.bat
Task: C:\WINDOWS\Tasks\vtigerCRM Notification Scheduler.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\intimateTaskStatus.bat
Task: C:\WINDOWS\Tasks\vtigerCRM Recurring Invoice.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\modules\SalesOrder\RecurringInvoiceCron.bat
Task: C:\WINDOWS\Tasks\vtigerCRM WorkFlow.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\modules\com_vtiger_workflow\com_vtiger_workflow.bat
==================== Loaded Modules (Whitelisted) ==============
2011-10-13 14:38 - 2011-10-13 14:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2014-07-14 15:08 - 2014-07-14 15:08 - 00034304 _____ () C:\WINDOWS\System32\ssj2mlm.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-09-25 10:03 - 2012-09-25 10:03 - 05750784 _____ () C:\Program Files (x86)\vtigercrm600\mysql\bin\mysqld-nt.exe
2015-03-02 16:43 - 2015-03-02 16:43 - 00099288 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-09-11 09:29 - 2014-09-11 09:30 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 01272616 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\kpcengine.2.3.dll
2014-06-12 18:22 - 2014-06-12 18:22 - 01261272 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2013-07-03 11:20 - 2008-05-12 17:27 - 00389120 _____ () C:\CodeGear\InterBase\bin\sanctuarylib.dll
2013-06-05 11:26 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-03-02 22:30 - 2015-03-02 22:30 - 00039384 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 15003464 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\PepperFlash\pepflashplayer.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2014-01-13 12:42 - 2014-01-13 12:42 - 00251392 _____ () C:\Program Files (x86)\vtigerCRM\Outlook6.0\vtigerCRMOutlookAddin.dll
2013-07-04 07:30 - 2013-07-04 07:30 - 00886272 _____ () C:\Program Files (x86)\vtigerCRM\Outlook6.0\System.Data.SQLite.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\tl\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\bern.ch -> hxxps://portal.bern.ch
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\internet -> internet
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\logmein.com -> hxxps://secure.logmein.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\mcafee.com -> hxxp://mcafee.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\mcafee.com -> hxxps://mcafee.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\saidef.ch -> hxxps://login.saidef.ch
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\webcompanion.com -> hxxp://webcompanion.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\Control Panel\Desktop\\Wallpaper -> C:\Users\tl\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\hintergrundbild der windows-fotoanzeige.jpg
DNS Servers: 81.218.119.5 - 82.163.142.130
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "TPUReg(x86)"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Shairport4w"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [UDP Query User{6DF5E0C5-745D-42FA-9871-6AF4488677F5}C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe
FirewallRules: [TCP Query User{B968324F-A042-4C32-8EA8-DACFA77B2D6D}C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe
FirewallRules: [UDP Query User{1C96A74D-C23E-4798-BC57-8A50C87A1334}C:\pfisterwaagengmbh\leureko\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\leureko\bin\wiegen.exe
FirewallRules: [TCP Query User{E4707320-9033-4523-99C2-21B1B83C6D99}C:\pfisterwaagengmbh\leureko\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\leureko\bin\wiegen.exe
FirewallRules: [UDP Query User{35C67BCD-819A-46E1-9C7F-FD4ADBA67977}C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe
FirewallRules: [TCP Query User{AA9AADD3-C7AC-44BF-AFF4-B53DACB2B1BA}C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe
FirewallRules: [UDP Query User{D3A0D19A-A389-4B14-8F0D-725C9F57B9BE}C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe
FirewallRules: [TCP Query User{37571717-5AA6-4267-9262-D776B612060C}C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe
FirewallRules: [UDP Query User{8D8950B2-BFFD-4764-80C7-398755CA72DE}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{011C5D06-4136-4916-8EBB-61689F4233CC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{DFB5C209-6260-4295-A146-4C7738862D9D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C73F061D-B069-41BE-B38F-3C08140F3BC3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CB1512B8-1DE0-495B-ACFB-7F78AA456E7B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3387AB65-3249-4A15-BCF1-11FE086DAB27}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5D3135C9-0467-43FE-B51C-4005C1EC9A8C}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{3AC7E504-4078-4D6C-940C-BFCF5741D6DE}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [TCP Query User{18A83794-C959-40F8-9357-6074AAD50A6D}C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe
FirewallRules: [UDP Query User{2496DC98-1378-4DA3-84A2-2B702D8D7981}C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe
FirewallRules: [TCP Query User{AD62AC37-7B4D-450F-AD21-E418C0912308}C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe
FirewallRules: [UDP Query User{54B4FC3B-8064-4F9D-9316-BC966BA38ACB}C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe
FirewallRules: [TCP Query User{A12BD658-2F07-4300-8DA1-623A2E98F4BC}C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe
FirewallRules: [UDP Query User{563A6257-137D-4526-AC7F-760B3D200CCB}C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe
FirewallRules: [TCP Query User{F1ED3FA5-423F-4382-A2F2-371898F997F0}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Block) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [UDP Query User{E14CBF71-2B9E-4E9D-A6AE-92FABB963897}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Block) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [TCP Query User{FE23DF26-717A-47D6-A1A5-2376CAD0E33D}C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe] => (Allow) C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe
FirewallRules: [UDP Query User{A28910CA-6DDC-4C00-86EB-30755C32A3F3}C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe] => (Allow) C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe
FirewallRules: [TCP Query User{21DA7F26-C2F5-4B21-8A36-498488355AF5}C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe] => (Block) C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe
FirewallRules: [UDP Query User{184C6217-29E9-4DA7-9129-D2C62B1FE295}C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe] => (Block) C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe
FirewallRules: [TCP Query User{089CA0E6-CBBA-4C36-9826-B889F3B38B94}C:\pfisterwaagengmbh\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\sam\bin\sam.exe
FirewallRules: [UDP Query User{C77E5057-773F-41D0-A588-E01586DD8954}C:\pfisterwaagengmbh\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\sam\bin\sam.exe
FirewallRules: [TCP Query User{DD87B767-647C-40F8-AACD-8ABE328471C5}C:\pfisterwaagengmbh\vwp\bin\vwp100.exe] => (Allow) C:\pfisterwaagengmbh\vwp\bin\vwp100.exe
FirewallRules: [UDP Query User{8D9F3E63-B0AD-482F-9E19-587758D3F184}C:\pfisterwaagengmbh\vwp\bin\vwp100.exe] => (Allow) C:\pfisterwaagengmbh\vwp\bin\vwp100.exe
FirewallRules: [TCP Query User{C8720512-FE45-47AA-A0C0-84BC71589354}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [UDP Query User{65B458B4-ED04-48A4-9776-5F8DF6649BF4}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [TCP Query User{4BF94D84-EC94-41AF-9EF1-F0427563870C}C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe
FirewallRules: [UDP Query User{960BAFC1-E79B-4C3E-8061-637AC1941B77}C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe
FirewallRules: [TCP Query User{1A5BFCA4-FE72-4F6C-A5D2-DB6293FCEDDE}C:\pfisterwaagengmbh\laurent\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\laurent\bin\wiegen.exe
FirewallRules: [UDP Query User{929D7F75-EBBC-4931-B07B-C27E6BEB83BE}C:\pfisterwaagengmbh\laurent\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\laurent\bin\wiegen.exe
FirewallRules: [{4FC63C92-DCC9-4192-9DD1-0D0BA1F7328E}] => (Allow) LPort=6160
FirewallRules: [TCP Query User{19510CE2-CEDD-457F-A46B-D08D9DD539E7}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [UDP Query User{98CA6081-5BEB-417D-B701-FDAF9B4A6D89}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [TCP Query User{F3841F5E-F098-43FA-A794-DDA85A92D73A}C:\pfisterwaagengmbh\winweighplus\bin\vip.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\vip.exe
FirewallRules: [UDP Query User{3A7712EF-C62A-4FEC-84F4-FC5EB9576612}C:\pfisterwaagengmbh\winweighplus\bin\vip.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\vip.exe
FirewallRules: [TCP Query User{2861A8E2-B3A1-4326-A1B8-EABC00F03C2E}C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe
FirewallRules: [UDP Query User{13489791-BAE8-4DEE-85E8-F55AD935635F}C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe
FirewallRules: [TCP Query User{EE5A351F-F3E3-4DDA-9770-A11D4E2C7D33}C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe
FirewallRules: [UDP Query User{2DBA82D1-C9F6-4099-A9D8-3818A1F5A81B}C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe
FirewallRules: [TCP Query User{E419FD77-9C7D-4D7E-AD2E-4ADB4108A87C}C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe
FirewallRules: [UDP Query User{3B12BFEB-D1A6-4C05-AB44-F7E5AE7885F0}C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe
FirewallRules: [{A36AF5E9-B54B-401C-8C74-8DDAE0F34E34}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{34B6B948-E6EF-4939-ACC5-115FAE2B3748}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{707251A2-5EEA-4852-8AD2-A63E1D4B8576}C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [UDP Query User{3FA31B54-B923-4EAF-BCE1-E528B4E38194}C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [{96C82587-C833-4619-A865-8DB821473A86}] => (Block) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [{5259C50B-F01E-44BA-B23B-F63A58FAC4B5}] => (Block) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [TCP Query User{9F89E13E-10F4-438F-BFB6-B2CB2A689637}C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe] => (Allow) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [UDP Query User{DD6C979E-D6AB-4468-A494-1EB3724A599E}C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe] => (Allow) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [{1B974948-5978-4FB2-9B19-CAB1EC8A8F48}] => (Block) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [{5262CDE8-5098-48D9-A279-96972AFB16C8}] => (Block) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [TCP Query User{C319BF7B-A590-4002-8FA0-52FDF68A99A8}C:\users\tl\downloads\shairport4w.exe] => (Allow) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [UDP Query User{9502A222-BF4F-40AE-8B53-7C09D3DB0C1C}C:\users\tl\downloads\shairport4w.exe] => (Allow) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [{F19EEF4A-6688-4593-90E1-CFDC00370D6C}] => (Block) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [{0193E345-477B-4E0C-A87A-4B43F06777BC}] => (Block) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [TCP Query User{C77B61D7-9C05-4127-9A72-7F20F8FDD3F6}C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [UDP Query User{78F472D1-F4E2-4130-9F25-BB925EC414DF}C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [{1A855937-7B11-4B29-9A59-7E16B0EAB2E2}] => (Block) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [{ECA562BF-1826-4AB0-B99C-8DC1954F0B9F}] => (Block) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [TCP Query User{B1719AC7-0B8A-4952-9EE7-85E10DB80626}C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [UDP Query User{186A7E3E-39F7-409F-AD15-72AA8C7E5BD2}C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [{F7ED78AB-9616-4D0F-9803-E43D4BA8BDA6}] => (Block) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [{7608FBDA-6D5D-44B5-9C03-79FA96955295}] => (Block) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [TCP Query User{72C20564-E862-41F1-A0B6-371A98A82A49}C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [UDP Query User{88349468-55F1-484C-A391-84309A0F4898}C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [{48DB220E-ED51-4AFA-BF7D-5BCED6EB8048}] => (Block) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [{7E69A0E3-CCED-4D70-86CD-14E41E53509C}] => (Block) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [TCP Query User{ACC4ED1D-9534-4E5C-8670-927D64D503A3}C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe] => (Block) C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe
FirewallRules: [UDP Query User{EEDED9C7-08F7-4893-8F8C-1E6ACA6910EC}C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe] => (Block) C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe
FirewallRules: [{1F66F25A-757B-4DFE-9C08-D1E1F6A50E2F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6E88C7C3-54AC-42E8-8FE0-00DCE64F8CCB}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{827A314E-31ED-40D8-8BCF-482B9DA3EA6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{D0977BA1-314B-430A-BD6B-CCF77EA42B09}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{DF336DAC-12FE-4959-B746-2453E8B2547D}C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe] => (Allow) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [UDP Query User{82139993-6DC3-4AFE-9630-542F5B30F7B0}C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe] => (Allow) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [{5228C92C-C043-40DF-B51D-B8F2B67F9677}] => (Block) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [{46CEE341-4C5D-4D9C-8D46-A3996BD25CF6}] => (Block) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BDA41A5C-B3D6-44B3-BDB1-7D0267F0167E}\\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe] => (Allow) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [UDP Query User{A541D71C-AF00-4A4B-8D6B-5A644D3AA46C}\\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe] => (Allow) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [{D50BDBEC-8A14-49A9-9275-9643A3A4AD8B}] => (Block) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [{17C20F44-8078-4325-82BA-756CC9A9EA25}] => (Block) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [TCP Query User{F1A9A991-2331-4446-A176-70B983378FAD}C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [UDP Query User{01372AB0-BE78-4978-8269-2D750A4D7965}C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [{D064D779-2ACB-4411-B478-5CA6F4D39D80}] => (Block) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [{84F39603-F78D-4747-A2DC-3057524C00F3}] => (Block) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [TCP Query User{CA4FDDC9-5233-4EFA-8102-27AF1ADEBEA5}E:\dart\apps\nirsoft\netbscanner.exe] => (Allow) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [UDP Query User{89B348B1-96D1-451B-9F0D-13C7DE53C22E}E:\dart\apps\nirsoft\netbscanner.exe] => (Allow) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [{CEFCBAB9-6067-4A31-8A7A-BEA675D712AB}] => (Block) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [{B5083C7A-5234-4C8E-82D0-C579B18A17CF}] => (Block) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [TCP Query User{469E45CD-3341-43E3-BFDF-F80D4F861B7E}C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [UDP Query User{FE697957-28B8-4EF9-97A9-972124ACC2E8}C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [{46128B36-356E-4F9C-B3D0-134419AA4721}] => (Block) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [{D90E0E14-F3FF-4219-85D6-4CFD47254AD4}] => (Block) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [TCP Query User{BF17F129-A741-40B3-9997-E04D5A5C1C01}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [UDP Query User{3307843B-D079-4A5D-8C8F-7F87CDC288B6}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [{D01E3058-FB68-42CA-8F2A-EF4B5F06C2E6}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [{F7A2F2C4-EC7C-4FAC-9D81-141AB3C6AAD7}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [TCP Query User{A4497331-DA1D-44FF-9469-13D0A4BECB48}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [UDP Query User{E45321EF-1E1E-4DC8-AEB5-46FA47CC3676}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [{8C71A085-33E9-472E-8EC4-D5C8BF5B3BB9}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [{AF0DE006-A96A-4194-9578-80E5174A3CED}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [TCP Query User{8F7B07BB-B4C6-4DD2-AC5C-AB42B12B5E17}C:\users\tl\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [UDP Query User{414D4EB2-359C-40DB-96D2-5C50A05ACFBA}C:\users\tl\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [{784740AB-C5F0-4198-A245-9E991C3F7150}] => (Block) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [{3FD46780-447D-4F4A-93DB-24C97A43EFCC}] => (Block) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [TCP Query User{71B48C9A-3DE3-4A50-AB2D-209752523850}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [UDP Query User{0A6E9E96-C9D4-4870-8651-DF917046C45A}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [{81F33B51-E452-40A7-B2AF-924EE237644D}] => (Block) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [{4B1A6B12-3CDD-41B4-847D-44659325D312}] => (Block) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [TCP Query User{A358574F-D9F3-43AF-8F7C-C76C8F52489D}C:\program files (x86)\matx software\planetview_030006\planetview.exe] => (Allow) C:\program files (x86)\matx software\planetview_030006\planetview.exe
FirewallRules: [UDP Query User{E1DD3D6B-EE6E-438E-A6F1-872EA56930AA}C:\program files (x86)\matx software\planetview_030006\planetview.exe] => (Allow) C:\program files (x86)\matx software\planetview_030006\planetview.exe
FirewallRules: [{41F66AE3-DB6D-4A3A-A8F5-015BD4ABC803}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{1A994E50-837E-4938-8538-5AACE1B135BE}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe
FirewallRules: [UDP Query User{E1A2DADE-FBF5-40A6-9733-B50FF69586F4}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe
FirewallRules: [{EB52EE57-B11B-48B8-8064-F54907EA5FFF}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{C9FC595C-1F39-41A6-B017-BCCA3E1C7DBE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1F50B441-33B9-46BF-86F2-CA3E6AC7AD98}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{16AB997B-042A-4CC5-ABB1-FEE60CB7D897}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{31451F06-5738-4726-B13D-E776482E8E11}C:\program files (x86)\linphone\bin\linphone.exe] => (Allow) C:\program files (x86)\linphone\bin\linphone.exe
FirewallRules: [UDP Query User{C4071F1C-BC52-403E-BB26-D2C40E860E41}C:\program files (x86)\linphone\bin\linphone.exe] => (Allow) C:\program files (x86)\linphone\bin\linphone.exe
FirewallRules: [TCP Query User{8CD46B07-3048-44E2-8A63-8E4B40F0C5CD}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [UDP Query User{749C1348-45B0-46E2-A807-CA11757C211C}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [TCP Query User{6FD97CB3-59B4-42B2-99D2-9C9BA1B8D5D7}C:\program files (x86)\counterpath\x-lite\x-lite.exe] => (Allow) C:\program files (x86)\counterpath\x-lite\x-lite.exe
FirewallRules: [UDP Query User{4732951F-D02B-440C-ABCA-3713D2DDCDC0}C:\program files (x86)\counterpath\x-lite\x-lite.exe] => (Allow) C:\program files (x86)\counterpath\x-lite\x-lite.exe
FirewallRules: [{E6972F3F-1171-4E19-B89E-4142D3D960A9}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: VMware Virtual Ethernet Adapter for VMnet1
Description: VMware Virtual Ethernet Adapter for VMnet1
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: VMware Virtual Ethernet Adapter for VMnet8
Description: VMware Virtual Ethernet Adapter for VMnet8
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:27:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1334
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 10:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1184
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 10:25:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingSports_8wekyb3d8bbwe!AppexSports“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 10:10:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1344
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 09:44:34 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 09:44:33 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 09:44:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (06/15/2015 11:38:53 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingFoodAndDrink
Error: (06/15/2015 11:38:47 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: PONS.Wrterbuch
Error: (06/15/2015 11:38:47 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: WildTangentGames.-GamesApp-
Error: (06/15/2015 11:38:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.Reader
Error: (06/15/2015 11:38:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingNews
Error: (06/15/2015 11:38:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingTravel
Error: (06/15/2015 11:38:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.FreshPaint
Error: (06/15/2015 11:38:28 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.MicrosoftSolitaireCollection
Error: (06/15/2015 11:38:28 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.SkypeApp
Error: (06/15/2015 11:38:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.ZuneMusic
Microsoft Office:
=========================
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927148
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927148
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148
Error: (06/15/2015 11:27:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f133401d0a74d6ac59514C:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dllb0c85038-1340-11e5-bee5-2cd05a90f365
Error: (06/15/2015 10:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f118401d0a745541daccbC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dll98b83a3d-1338-11e5-bee4-2cd05a90f365
Error: (06/15/2015 10:25:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingSports_8wekyb3d8bbwe!AppexSports-2144927148
Error: (06/15/2015 10:10:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f134401d0a742bdb0842eC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dll003bdf5b-1336-11e5-bee4-2cd05a90f365
Error: (06/15/2015 09:44:34 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927148
Error: (06/15/2015 09:44:33 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148
Error: (06/15/2015 09:44:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927148
CodeIntegrity Errors:
===================================
Date: 2015-06-12 14:09:09.954
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:09.798
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:09.657
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:07.016
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.875
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.719
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.579
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.422
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.282
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.125
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 34%
Total physical RAM: 8143.22 MB
Available physical RAM: 5329.54 MB
Total Pagefile: 9423.22 MB
Available Pagefile: 6432.54 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (TI31025900A) (Fixed) (Total:454.36 GB) (Free:286.18 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End of log ============================
result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015 Ran by TL (administrator) on PFISTERNB20 on 15-06-2015 11:42:30 Running from C:\Users\tl\Des Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-15 11:59:48
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000033 TOSHIBA_MK5061GSYN rev.MH001M 465.76GB
Running: Gmer-19357.exe; Driver: C:\Users\tl\AppData\Local\Temp\kwlyqaoc.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff960000c4d00 15 bytes [00, A9, F3, 01, 80, 64, 6D, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff960000c4d10 11 bytes [00, 91, FC, FF, 00, BF, CA, ...]
---- User code sections - GMER 2.1 ----
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ff996904b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ff996904f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ff996905206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ff9969053ff 8 bytes {JMP 0xffffffffffffffee}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ff99690579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ff996905954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ff996905ef1 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ff996905f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ff9969060ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ff9969064d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ff996906616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ff9969066cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ff996908397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ff996908a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ff996908d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ff996908e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ff9969090ae 8 bytes {JMP 0xffffffffffffff96}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ff99690917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ff996909d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ff996909fcd 8 bytes {JMP 0xffffffffffffffaf}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ff99690aae0 8 bytes {JMP 0xffffffffffffffcd}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ff99690ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ff99690b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ff99690b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ff99690c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ff99690c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text ... * 2
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ff99690d0d3 8 bytes {JMP 0xffffffffffffffef}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ff99690d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ff99690d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ff99690d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ff99690d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ff99690d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ff99690dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ff99690dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ff99690e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ff99690e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ff99690e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ff99690eb74 8 bytes {JMP 0xffffffffffffffd0}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ff99690fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ff99691009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ff99691015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ff996911438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ff9969115e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ff996911877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ff996911a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ff996911c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ff996981290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ff996981410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ff996981440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ff996981560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ff996981610 8 bytes {JMP QWORD [RIP-0x71122]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ff996981cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread 00007ff996981fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread 00007ff996982850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438 0000000076e713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387 0000000076e71583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000076e71621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68 0000000076e71674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000076e716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000076e716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000076e71727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 7
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 0000000076e725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000076e72714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000076e72961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\tl\Desktop\Virenschutz\Gmer-19357.exe[2272] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000076e72bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
---- User IAT/EAT - GMER 2.1 ----
IAT C:\WINDOWS\explorer.exe[5764] @ C:\WINDOWS\system32\RPCRT4.dll[ntdll.dll!NtAlpcConnectPortEx] [66444d70] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\prremote.dll
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [800:828] fffff960008762d0
Thread C:\WINDOWS\system32\svchost.exe [1032:4620] 00007ff98acb4ee0
Thread C:\WINDOWS\system32\svchost.exe [1096:6440] 00007ff985ce6c60
Thread C:\WINDOWS\system32\svchost.exe [1096:6444] 00007ff985ce6850
Thread C:\WINDOWS\system32\svchost.exe [1612:4536] 00007ff984201600
Thread C:\WINDOWS\system32\svchost.exe [1612:4616] 00007ff984151b70
Thread C:\WINDOWS\system32\svchost.exe [1612:4428] 00007ff985f24440
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
15.06.2015, 14:09
| #4 |
| | Addition File [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by TL at 2015-06-15 11:43:30
Running from C:\Users\tl\Desktop\Virenschutz
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1747593855-565391543-2980224419-500 - Administrator - Disabled)
Gast (S-1-5-21-1747593855-565391543-2980224419-501 - Limited - Disabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Anti-Virus (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Anti-Virus (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Advanced IP Scanner 2.4 (HKLM-x32\...\{051770B2-AC7A-4A63-9326-394C3E6E3B12}) (Version: 2.4.2526 - Famatech)
AMD Catalyst Install Manager (HKLM\...\{C23F43A3-327E-2969-52F2-89ED83D99F48}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{026B819B-4D60-4C8B-892D-33A0D8666F60}) (Version: 2.0.0.3 - Ihr Firmenname)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
cardPresso (HKLM-x32\...\cardPresso) (Version: 1.1.0 - Copyright 2012, cardPresso, Lda)
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)
DataDirect ODBC driver for InterBase (HKLM-x32\...\DataDirect ODBC driver for InterBase) (Version: - )
DecoderProgrammer (C:\Program Files (x86)\DecoderProgrammer\) (HKLM-x32\...\ST6UNST #2) (Version: - )
DecoderProgrammer (HKLM-x32\...\ST6UNST #1) (Version: - )
Digi Device Discovery (HKLM-x32\...\Digi Device Discovery) (Version: - )
ELCOM BTI-TERM (HKLM-x32\...\ELCOM BTI-TERM) (Version: 1.0 - ELCOM GmbH & Co. KG)
FileZilla Client 3.10.2 (HKLM-x32\...\FileZilla Client) (Version: 3.10.2 - Tim Kosse)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Drive (HKLM-x32\...\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
IB-Upgrade Version 1.0.0.1 (HKLM-x32\...\{15E58B69-C4D7-4338-AA1C-4519F843AE0C}_is1) (Version: 1.0.0.1 - Uhlenbrock Elektronik GmbH)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel AppUp(SM) center (HKLM-x32\...\Intel AppUp(SM) center 33268) (Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
InterBase 2009 (HKLM-x32\...\InterBase 2009) (Version: InterBase 2009 - Embarcadero Technologies Inc.)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Kaspersky Anti-Virus (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Anti-Virus (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Linphone (HKLM-x32\...\Linphone) (Version: 3.8.4 - Belledonne communications)
LogMeIn (HKLM-x32\...\{CB7AF84A-1B7F-4C6B-8A58-EB7CDE48C23A}) (Version: 4.1.3268 - LogMeIn, Inc.)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package - SE (x64) (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package - SE (x64)) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
MySQL Utilities (HKLM-x32\...\{0B18AA75-6A44-4950-A0A2-A486C2D839A0}) (Version: 1.4.4 - Oracle Corporation)
MySQL Workbench 6.1 CE (HKLM-x32\...\{AD95295B-0279-43B6-A873-F12A1D1CD146}) (Version: 6.1.7 - Oracle Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
OKI Network Extension (HKLM-x32\...\{38ADB9A6-798C-11D6-A855-00105A80791C}) (Version: 1.00.000 - Okidata)
Online Plug-in (x32 Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden
Oracle VM VirtualBox 4.3.26 (HKLM\...\{5771F59A-BFC9-4FAF-A883-7642EF4BA3C3}) (Version: 4.3.26 - Oracle Corporation)
PhonerLite 2.25 (HKLM-x32\...\PhonerLite_is1) (Version: 2.25 - Heiko Sommerfeldt)
PingPlotter Standard 3.42.3s (HKLM-x32\...\{1C1D0A2C-C8B4-4C2C-9877-884F8FC082B5}) (Version: 3.42.3.6 - Nessoft, LLC)
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6738 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: 1.90 - Ghostgum Software Pty Ltd)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Scriptable Automation Manager (HKLM-x32\...\{9F26E6E5-66BD-4EEA-9038-AC18A63E49A5}) (Version: 0.9.20 - AIT Software GmbH)
Self-Service Plug-in (x32 Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.41110 - TeamViewer)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6406 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
Toshiba Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.972 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{11A5F0A4-5738-4857-9CEA-216E4F78BEB5}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.2.2 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 5.1.0.12-A - Toshiba Corporation)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.3 - VMware, Inc)
VMware Player (Version: 6.0.3 - VMware, Inc.) Hidden
VMware vSphere Client 5.1 (HKLM-x32\...\{09DC364B-A77A-49A0-972B-E43F0DACC5E3}) (Version: 5.1.0.1557 - VMware, Inc.)
vtiger CRM Outlook Plugin-6.0-X86 (HKLM-x32\...\vtiger CRM Outlook Plugin-6.0-X86) (Version: - Vtiger)
vtiger CRM Outlook plugin-6.0-X86_64 (HKLM\...\vtiger CRM Outlook plugin-6.0-X86_64) (Version: - Vtiger)
vtigercrm600 (HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\vtigercrm600) (Version: - )
VWP100 (HKLM-x32\...\PfisterWaagenGmbH VWP100_is1) (Version: 2.1.0.205 - Pfister Waagen Bilanciai GmbH)
WinWeigh Plus (HKLM-x32\...\PfisterWaagenGmbH WinWeighPlus_is1) (Version: 6.0.0.203 - Pfister Waagen Bilanciai GmbH)
X-Lite (HKLM-x32\...\{D79740D7-405F-4A07-A144-40A655CA4B7C}) (Version: 48.7.6589 - CounterPath Corporation)
Zebra ZXP S3 and S1 Card Printers (HKLM-x32\...\{1132009E-7E6B-43D3-8F24-5554F5E9483B}) (Version: 05.01.00.00 - Zebra Technologies Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\tl\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
05-06-2015 16:17:04 Windows Update
10-06-2015 13:43:26 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
12-06-2015 14:37:53 Removed PlanetView 030006
15-06-2015 09:37:30 AA11
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1A2A573B-2C2A-44EF-A06D-5431D3C00D31} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-06-11] (Microsoft Corporation)
Task: {21E2740A-9194-4FAF-9B22-117618CDA0A0} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {26166EDA-84BE-488F-822B-13821D2B145E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-29] (Google Inc.)
Task: {2A54C017-97F1-445E-A08F-FF3A8CC22857} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-06] (Microsoft Corporation)
Task: {2F16612B-41A6-4680-A5EF-395EBE596C73} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {32A9D14E-C630-4A42-9556-CFD9EEAC6C4C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {417502C0-9D3B-4553-9DE0-69FA1FA67AE1} - System32\Tasks\{7FB0C9C3-0F3E-4C60-9925-21E2C811DC63} => pcalua.exe -a C:\Users\tl\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=slb2
Task: {5242AA7D-454B-4B4F-9014-D4837CDCBC5E} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2012-09-25] (Toshiba Europe GmbH)
Task: {5AB1DB5F-1591-4541-849A-635A46A95760} - System32\Tasks\Microsoft\Windows\GroupPolicy\{A7719E0F-10DB-4640-AD8C-490CC6AD5202}
Task: {5B8BFD2D-202A-4F64-B1A4-B960C4BB4878} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {74415D5C-E789-4B25-8333-AA42DA002600} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}
Task: {8C7DC534-40B9-4692-90E4-DE07859545E2} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-06] (Microsoft Corporation)
Task: {A1AFF702-852D-4707-8739-A25D528605D5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-07-29] (Google Inc.)
Task: {B1495406-6C7D-4100-AFEC-5E5830E0966B} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1026108093-1314267383-2887952174-1155 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {CABB91D3-E361-4ECC-BADD-08D85B7C3E4D} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {E8B683AC-BAE7-4250-A5FB-DA5919F275FD} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {EA7E79F4-622D-4847-9422-E8A0C990CB77} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Task: C:\WINDOWS\Tasks\vtigerCRM Email Reminder.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\modules\Calendar\SendReminder.bat
Task: C:\WINDOWS\Tasks\vtigerCRM Notification Scheduler.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\intimateTaskStatus.bat
Task: C:\WINDOWS\Tasks\vtigerCRM Recurring Invoice.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\modules\SalesOrder\RecurringInvoiceCron.bat
Task: C:\WINDOWS\Tasks\vtigerCRM WorkFlow.job => C:\Program Files (x86)\vtigercrm600\apache\htdocs\vtigerCRM\cron\modules\com_vtiger_workflow\com_vtiger_workflow.bat
==================== Loaded Modules (Whitelisted) ==============
2011-10-13 14:38 - 2011-10-13 14:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2014-07-14 15:08 - 2014-07-14 15:08 - 00034304 _____ () C:\WINDOWS\System32\ssj2mlm.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-02-13 05:20 - 2015-02-13 05:20 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-09-25 10:03 - 2012-09-25 10:03 - 05750784 _____ () C:\Program Files (x86)\vtigercrm600\mysql\bin\mysqld-nt.exe
2015-03-02 16:43 - 2015-03-02 16:43 - 00099288 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2014-09-11 09:29 - 2014-09-11 09:30 - 00183296 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\ErrorReporting.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 01272616 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\kpcengine.2.3.dll
2014-06-12 18:22 - 2014-06-12 18:22 - 01261272 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2013-07-03 11:20 - 2008-05-12 17:27 - 00389120 _____ () C:\CodeGear\InterBase\bin\sanctuarylib.dll
2013-06-05 11:26 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2015-03-02 22:30 - 2015-03-02 22:30 - 00039384 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll
2015-06-15 09:43 - 2015-06-05 20:22 - 15003464 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\PepperFlash\pepflashplayer.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\office14\Cultures\office.odf
2013-02-14 15:46 - 2013-02-14 15:46 - 01044048 _____ () C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2014-01-13 12:42 - 2014-01-13 12:42 - 00251392 _____ () C:\Program Files (x86)\vtigerCRM\Outlook6.0\vtigerCRMOutlookAddin.dll
2013-07-04 07:30 - 2013-07-04 07:30 - 00886272 _____ () C:\Program Files (x86)\vtigerCRM\Outlook6.0\System.Data.SQLite.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\tl\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\bern.ch -> hxxps://portal.bern.ch
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\internet -> internet
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\logmein.com -> hxxps://secure.logmein.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\mcafee.com -> hxxp://mcafee.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\mcafee.com -> hxxps://mcafee.com
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\saidef.ch -> hxxps://login.saidef.ch
IE trusted site: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\webcompanion.com -> hxxp://webcompanion.com
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\Control Panel\Desktop\\Wallpaper -> C:\Users\tl\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\hintergrundbild der windows-fotoanzeige.jpg
DNS Servers: 81.218.119.5 - 82.163.142.130
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "SynTPEnh"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "TPUReg(x86)"
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "Shairport4w"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppextcomobj.exe
FirewallRules: [UDP Query User{6DF5E0C5-745D-42FA-9871-6AF4488677F5}C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe
FirewallRules: [TCP Query User{B968324F-A042-4C32-8EA8-DACFA77B2D6D}C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\hkw_basel\bin\wiegen.exe
FirewallRules: [UDP Query User{1C96A74D-C23E-4798-BC57-8A50C87A1334}C:\pfisterwaagengmbh\leureko\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\leureko\bin\wiegen.exe
FirewallRules: [TCP Query User{E4707320-9033-4523-99C2-21B1B83C6D99}C:\pfisterwaagengmbh\leureko\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\leureko\bin\wiegen.exe
FirewallRules: [UDP Query User{35C67BCD-819A-46E1-9C7F-FD4ADBA67977}C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe
FirewallRules: [TCP Query User{AA9AADD3-C7AC-44BF-AFF4-B53DACB2B1BA}C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\kva_winterthur\bin\wiegen.exe
FirewallRules: [UDP Query User{D3A0D19A-A389-4B14-8F0D-725C9F57B9BE}C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe
FirewallRules: [TCP Query User{37571717-5AA6-4267-9262-D776B612060C}C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\flueckiger\bin\wiegen.exe
FirewallRules: [UDP Query User{8D8950B2-BFFD-4764-80C7-398755CA72DE}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{011C5D06-4136-4916-8EBB-61689F4233CC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{DFB5C209-6260-4295-A146-4C7738862D9D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{C73F061D-B069-41BE-B38F-3C08140F3BC3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CB1512B8-1DE0-495B-ACFB-7F78AA456E7B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3387AB65-3249-4A15-BCF1-11FE086DAB27}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5D3135C9-0467-43FE-B51C-4005C1EC9A8C}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [{3AC7E504-4078-4D6C-940C-BFCF5741D6DE}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe
FirewallRules: [TCP Query User{18A83794-C959-40F8-9357-6074AAD50A6D}C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe
FirewallRules: [UDP Query User{2496DC98-1378-4DA3-84A2-2B702D8D7981}C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen.exe
FirewallRules: [TCP Query User{AD62AC37-7B4D-450F-AD21-E418C0912308}C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe
FirewallRules: [UDP Query User{54B4FC3B-8064-4F9D-9316-BC966BA38ACB}C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\haefeli-bruegger\bin\wiegen.exe
FirewallRules: [TCP Query User{A12BD658-2F07-4300-8DA1-623A2E98F4BC}C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe
FirewallRules: [UDP Query User{563A6257-137D-4526-AC7F-760B3D200CCB}C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmia96.tmp\logmein client.exe
FirewallRules: [TCP Query User{F1ED3FA5-423F-4382-A2F2-371898F997F0}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Block) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [UDP Query User{E14CBF71-2B9E-4E9D-A6AE-92FABB963897}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Block) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [TCP Query User{FE23DF26-717A-47D6-A1A5-2376CAD0E33D}C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe] => (Allow) C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe
FirewallRules: [UDP Query User{A28910CA-6DDC-4C00-86EB-30755C32A3F3}C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe] => (Allow) C:\pfisterwaagengmbh\regio-recycling\replikation\sdctec\ibrdemon\rpdemon.exe
FirewallRules: [TCP Query User{21DA7F26-C2F5-4B21-8A36-498488355AF5}C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe] => (Block) C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe
FirewallRules: [UDP Query User{184C6217-29E9-4DA7-9129-D2C62B1FE295}C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe] => (Block) C:\pfisterwaagengmbh\regio-recycling\bin\wiegen.exe
FirewallRules: [TCP Query User{089CA0E6-CBBA-4C36-9826-B889F3B38B94}C:\pfisterwaagengmbh\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\sam\bin\sam.exe
FirewallRules: [UDP Query User{C77E5057-773F-41D0-A588-E01586DD8954}C:\pfisterwaagengmbh\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\sam\bin\sam.exe
FirewallRules: [TCP Query User{DD87B767-647C-40F8-AACD-8ABE328471C5}C:\pfisterwaagengmbh\vwp\bin\vwp100.exe] => (Allow) C:\pfisterwaagengmbh\vwp\bin\vwp100.exe
FirewallRules: [UDP Query User{8D9F3E63-B0AD-482F-9E19-587758D3F184}C:\pfisterwaagengmbh\vwp\bin\vwp100.exe] => (Allow) C:\pfisterwaagengmbh\vwp\bin\vwp100.exe
FirewallRules: [TCP Query User{C8720512-FE45-47AA-A0C0-84BC71589354}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [UDP Query User{65B458B4-ED04-48A4-9776-5F8DF6649BF4}C:\program files (x86)\microsoft office\office14\outlook.exe] => (Block) C:\program files (x86)\microsoft office\office14\outlook.exe
FirewallRules: [TCP Query User{4BF94D84-EC94-41AF-9EF1-F0427563870C}C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe
FirewallRules: [UDP Query User{960BAFC1-E79B-4C3E-8061-637AC1941B77}C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe] => (Allow) C:\pfisterwaagengmbh\laurent\sam\bin\sam.exe
FirewallRules: [TCP Query User{1A5BFCA4-FE72-4F6C-A5D2-DB6293FCEDDE}C:\pfisterwaagengmbh\laurent\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\laurent\bin\wiegen.exe
FirewallRules: [UDP Query User{929D7F75-EBBC-4931-B07B-C27E6BEB83BE}C:\pfisterwaagengmbh\laurent\bin\wiegen.exe] => (Allow) C:\pfisterwaagengmbh\laurent\bin\wiegen.exe
FirewallRules: [{4FC63C92-DCC9-4192-9DD1-0D0BA1F7328E}] => (Allow) LPort=6160
FirewallRules: [TCP Query User{19510CE2-CEDD-457F-A46B-D08D9DD539E7}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [UDP Query User{98CA6081-5BEB-417D-B701-FDAF9B4A6D89}C:\users\tl\appdata\local\logmein client\logmein client.exe] => (Allow) C:\users\tl\appdata\local\logmein client\logmein client.exe
FirewallRules: [TCP Query User{F3841F5E-F098-43FA-A794-DDA85A92D73A}C:\pfisterwaagengmbh\winweighplus\bin\vip.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\vip.exe
FirewallRules: [UDP Query User{3A7712EF-C62A-4FEC-84F4-FC5EB9576612}C:\pfisterwaagengmbh\winweighplus\bin\vip.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\vip.exe
FirewallRules: [TCP Query User{2861A8E2-B3A1-4326-A1B8-EABC00F03C2E}C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe
FirewallRules: [UDP Query User{13489791-BAE8-4DEE-85E8-F55AD935635F}C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi8a0b.tmp\logmein client.exe
FirewallRules: [TCP Query User{EE5A351F-F3E3-4DDA-9770-A11D4E2C7D33}C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe
FirewallRules: [UDP Query User{2DBA82D1-C9F6-4099-A9D8-3818A1F5A81B}C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmicab0.tmp\logmein client.exe
FirewallRules: [TCP Query User{E419FD77-9C7D-4D7E-AD2E-4ADB4108A87C}C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe
FirewallRules: [UDP Query User{3B12BFEB-D1A6-4C05-AB44-F7E5AE7885F0}C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmif23.tmp\logmein client.exe
FirewallRules: [{A36AF5E9-B54B-401C-8C74-8DDAE0F34E34}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{34B6B948-E6EF-4939-ACC5-115FAE2B3748}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [TCP Query User{707251A2-5EEA-4852-8AD2-A63E1D4B8576}C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [UDP Query User{3FA31B54-B923-4EAF-BCE1-E528B4E38194}C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [{96C82587-C833-4619-A865-8DB821473A86}] => (Block) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [{5259C50B-F01E-44BA-B23B-F63A58FAC4B5}] => (Block) C:\users\tl\appdata\local\temp\lmi5aef.tmp\logmein client.exe
FirewallRules: [TCP Query User{9F89E13E-10F4-438F-BFB6-B2CB2A689637}C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe] => (Allow) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [UDP Query User{DD6C979E-D6AB-4468-A494-1EB3724A599E}C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe] => (Allow) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [{1B974948-5978-4FB2-9B19-CAB1EC8A8F48}] => (Block) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [{5262CDE8-5098-48D9-A279-96972AFB16C8}] => (Block) C:\users\tl\appdata\local\temp\temp1_shairport4w73.zip\shairport4w.exe
FirewallRules: [TCP Query User{C319BF7B-A590-4002-8FA0-52FDF68A99A8}C:\users\tl\downloads\shairport4w.exe] => (Allow) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [UDP Query User{9502A222-BF4F-40AE-8B53-7C09D3DB0C1C}C:\users\tl\downloads\shairport4w.exe] => (Allow) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [{F19EEF4A-6688-4593-90E1-CFDC00370D6C}] => (Block) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [{0193E345-477B-4E0C-A87A-4B43F06777BC}] => (Block) C:\users\tl\downloads\shairport4w.exe
FirewallRules: [TCP Query User{C77B61D7-9C05-4127-9A72-7F20F8FDD3F6}C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [UDP Query User{78F472D1-F4E2-4130-9F25-BB925EC414DF}C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [{1A855937-7B11-4B29-9A59-7E16B0EAB2E2}] => (Block) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [{ECA562BF-1826-4AB0-B99C-8DC1954F0B9F}] => (Block) C:\users\tl\appdata\local\temp\lmi32fb.tmp\logmein client.exe
FirewallRules: [TCP Query User{B1719AC7-0B8A-4952-9EE7-85E10DB80626}C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [UDP Query User{186A7E3E-39F7-409F-AD15-72AA8C7E5BD2}C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [{F7ED78AB-9616-4D0F-9803-E43D4BA8BDA6}] => (Block) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [{7608FBDA-6D5D-44B5-9C03-79FA96955295}] => (Block) C:\users\tl\appdata\local\temp\lmi506b.tmp\logmein client.exe
FirewallRules: [TCP Query User{72C20564-E862-41F1-A0B6-371A98A82A49}C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [UDP Query User{88349468-55F1-484C-A391-84309A0F4898}C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [{48DB220E-ED51-4AFA-BF7D-5BCED6EB8048}] => (Block) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [{7E69A0E3-CCED-4D70-86CD-14E41E53509C}] => (Block) C:\users\tl\appdata\local\temp\lmi5479.tmp\logmein client.exe
FirewallRules: [TCP Query User{ACC4ED1D-9534-4E5C-8670-927D64D503A3}C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe] => (Block) C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe
FirewallRules: [UDP Query User{EEDED9C7-08F7-4893-8F8C-1E6ACA6910EC}C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe] => (Block) C:\users\tl\appdata\local\temp\lmi1c36.tmp\logmein client.exe
FirewallRules: [{1F66F25A-757B-4DFE-9C08-D1E1F6A50E2F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{6E88C7C3-54AC-42E8-8FE0-00DCE64F8CCB}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{827A314E-31ED-40D8-8BCF-482B9DA3EA6D}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{D0977BA1-314B-430A-BD6B-CCF77EA42B09}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{DF336DAC-12FE-4959-B746-2453E8B2547D}C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe] => (Allow) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [UDP Query User{82139993-6DC3-4AFE-9630-542F5B30F7B0}C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe] => (Allow) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [{5228C92C-C043-40DF-B51D-B8F2B67F9677}] => (Block) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [{46CEE341-4C5D-4D9C-8D46-A3996BD25CF6}] => (Block) C:\program files (x86)\vtigercrm600\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BDA41A5C-B3D6-44B3-BDB1-7D0267F0167E}\\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe] => (Allow) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [UDP Query User{A541D71C-AF00-4A4B-8D6B-5A644D3AA46C}\\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe] => (Allow) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [{D50BDBEC-8A14-49A9-9275-9643A3A4AD8B}] => (Block) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [{17C20F44-8078-4325-82BA-756CC9A9EA25}] => (Block) \\chpf05\ftp\tools\ftp_server\quick£neasy\ftpserver3lite\ftpserver.exe
FirewallRules: [TCP Query User{F1A9A991-2331-4446-A176-70B983378FAD}C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [UDP Query User{01372AB0-BE78-4978-8269-2D750A4D7965}C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [{D064D779-2ACB-4411-B478-5CA6F4D39D80}] => (Block) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [{84F39603-F78D-4747-A2DC-3057524C00F3}] => (Block) C:\users\tl\appdata\local\temp\lmi4d14.tmp\logmein client.exe
FirewallRules: [TCP Query User{CA4FDDC9-5233-4EFA-8102-27AF1ADEBEA5}E:\dart\apps\nirsoft\netbscanner.exe] => (Allow) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [UDP Query User{89B348B1-96D1-451B-9F0D-13C7DE53C22E}E:\dart\apps\nirsoft\netbscanner.exe] => (Allow) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [{CEFCBAB9-6067-4A31-8A7A-BEA675D712AB}] => (Block) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [{B5083C7A-5234-4C8E-82D0-C579B18A17CF}] => (Block) E:\dart\apps\nirsoft\netbscanner.exe
FirewallRules: [TCP Query User{469E45CD-3341-43E3-BFDF-F80D4F861B7E}C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [UDP Query User{FE697957-28B8-4EF9-97A9-972124ACC2E8}C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe] => (Allow) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [{46128B36-356E-4F9C-B3D0-134419AA4721}] => (Block) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [{D90E0E14-F3FF-4219-85D6-4CFD47254AD4}] => (Block) C:\users\tl\appdata\local\temp\lmi59c2.tmp\logmein client.exe
FirewallRules: [TCP Query User{BF17F129-A741-40B3-9997-E04D5A5C1C01}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [UDP Query User{3307843B-D079-4A5D-8C8F-7F87CDC288B6}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [{D01E3058-FB68-42CA-8F2A-EF4B5F06C2E6}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [{F7A2F2C4-EC7C-4FAC-9D81-141AB3C6AAD7}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-1-0-204.exe
FirewallRules: [TCP Query User{A4497331-DA1D-44FF-9469-13D0A4BECB48}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [UDP Query User{E45321EF-1E1E-4DC8-AEB5-46FA47CC3676}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe] => (Allow) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [{8C71A085-33E9-472E-8EC4-D5C8BF5B3BB9}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [{AF0DE006-A96A-4194-9578-80E5174A3CED}] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-2-0-203.exe
FirewallRules: [TCP Query User{8F7B07BB-B4C6-4DD2-AC5C-AB42B12B5E17}C:\users\tl\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [UDP Query User{414D4EB2-359C-40DB-96D2-5C50A05ACFBA}C:\users\tl\appdata\local\logmein client\lmiignition.exe] => (Allow) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [{784740AB-C5F0-4198-A245-9E991C3F7150}] => (Block) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [{3FD46780-447D-4F4A-93DB-24C97A43EFCC}] => (Block) C:\users\tl\appdata\local\logmein client\lmiignition.exe
FirewallRules: [TCP Query User{71B48C9A-3DE3-4A50-AB2D-209752523850}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [UDP Query User{0A6E9E96-C9D4-4870-8651-DF917046C45A}C:\program files (x86)\logmein\ignition\lmiignition.exe] => (Allow) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [{81F33B51-E452-40A7-B2AF-924EE237644D}] => (Block) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [{4B1A6B12-3CDD-41B4-847D-44659325D312}] => (Block) C:\program files (x86)\logmein\ignition\lmiignition.exe
FirewallRules: [TCP Query User{A358574F-D9F3-43AF-8F7C-C76C8F52489D}C:\program files (x86)\matx software\planetview_030006\planetview.exe] => (Allow) C:\program files (x86)\matx software\planetview_030006\planetview.exe
FirewallRules: [UDP Query User{E1DD3D6B-EE6E-438E-A6F1-872EA56930AA}C:\program files (x86)\matx software\planetview_030006\planetview.exe] => (Allow) C:\program files (x86)\matx software\planetview_030006\planetview.exe
FirewallRules: [{41F66AE3-DB6D-4A3A-A8F5-015BD4ABC803}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{1A994E50-837E-4938-8538-5AACE1B135BE}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe
FirewallRules: [UDP Query User{E1A2DADE-FBF5-40A6-9733-B50FF69586F4}C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe] => (Block) C:\pfisterwaagengmbh\winweighplus\bin\wiegen-6-0-0-109.exe
FirewallRules: [{EB52EE57-B11B-48B8-8064-F54907EA5FFF}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{C9FC595C-1F39-41A6-B017-BCCA3E1C7DBE}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1F50B441-33B9-46BF-86F2-CA3E6AC7AD98}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{16AB997B-042A-4CC5-ABB1-FEE60CB7D897}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [TCP Query User{31451F06-5738-4726-B13D-E776482E8E11}C:\program files (x86)\linphone\bin\linphone.exe] => (Allow) C:\program files (x86)\linphone\bin\linphone.exe
FirewallRules: [UDP Query User{C4071F1C-BC52-403E-BB26-D2C40E860E41}C:\program files (x86)\linphone\bin\linphone.exe] => (Allow) C:\program files (x86)\linphone\bin\linphone.exe
FirewallRules: [TCP Query User{8CD46B07-3048-44E2-8A63-8E4B40F0C5CD}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [UDP Query User{749C1348-45B0-46E2-A807-CA11757C211C}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [TCP Query User{6FD97CB3-59B4-42B2-99D2-9C9BA1B8D5D7}C:\program files (x86)\counterpath\x-lite\x-lite.exe] => (Allow) C:\program files (x86)\counterpath\x-lite\x-lite.exe
FirewallRules: [UDP Query User{4732951F-D02B-440C-ABCA-3713D2DDCDC0}C:\program files (x86)\counterpath\x-lite\x-lite.exe] => (Allow) C:\program files (x86)\counterpath\x-lite\x-lite.exe
FirewallRules: [{E6972F3F-1171-4E19-B89E-4142D3D960A9}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: VMware Virtual Ethernet Adapter for VMnet1
Description: VMware Virtual Ethernet Adapter for VMnet1
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: VMware Virtual Ethernet Adapter for VMnet8
Description: VMware Virtual Ethernet Adapter for VMnet8
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: VMware, Inc.
Service: VMnetAdapter
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 11:27:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1334
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 10:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1184
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 10:25:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingSports_8wekyb3d8bbwe!AppexSports“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 10:10:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.3.9600.17667, Zeitstempel: 0x54c6f7c2
Name des fehlerhaften Moduls: twinui.dll, Version: 6.3.9600.17415, Zeitstempel: 0x54503c45
Ausnahmecode: 0x80270249
Fehleroffset: 0x00000000002f497f
ID des fehlerhaften Prozesses: 0x1344
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3
Vollständiger Name des fehlerhaften Pakets: Explorer.EXE4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Explorer.EXE5
Error: (06/15/2015 09:44:34 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 09:44:33 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (06/15/2015 09:44:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Bei der Aktivierung der App „Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel“ ist folgender Fehler aufgetreten: -2144927148. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (06/15/2015 11:38:53 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingFoodAndDrink
Error: (06/15/2015 11:38:47 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: PONS.Wrterbuch
Error: (06/15/2015 11:38:47 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: WildTangentGames.-GamesApp-
Error: (06/15/2015 11:38:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.Reader
Error: (06/15/2015 11:38:40 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingNews
Error: (06/15/2015 11:38:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.BingTravel
Error: (06/15/2015 11:38:34 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.FreshPaint
Error: (06/15/2015 11:38:28 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.MicrosoftSolitaireCollection
Error: (06/15/2015 11:38:28 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.SkypeApp
Error: (06/15/2015 11:38:22 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80072ee4 fehlgeschlagen: Microsoft.ZuneMusic
Microsoft Office:
=========================
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927148
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927148
Error: (06/15/2015 11:41:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148
Error: (06/15/2015 11:27:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f133401d0a74d6ac59514C:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dllb0c85038-1340-11e5-bee5-2cd05a90f365
Error: (06/15/2015 10:29:11 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f118401d0a745541daccbC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dll98b83a3d-1338-11e5-bee4-2cd05a90f365
Error: (06/15/2015 10:25:18 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingSports_8wekyb3d8bbwe!AppexSports-2144927148
Error: (06/15/2015 10:10:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.3.9600.1766754c6f7c2twinui.dll6.3.9600.1741554503c458027024900000000002f497f134401d0a742bdb0842eC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\twinui.dll003bdf5b-1336-11e5-bee4-2cd05a90f365
Error: (06/15/2015 09:44:34 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927148
Error: (06/15/2015 09:44:33 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927148
Error: (06/15/2015 09:44:31 AM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PFISTERWAAGEN)
Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927148
CodeIntegrity Errors:
===================================
Date: 2015-06-12 14:09:09.954
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:09.798
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:09.657
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:07.016
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.875
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.719
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.579
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.422
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.282
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-06-12 14:09:06.125
Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 34%
Total physical RAM: 8143.22 MB
Available physical RAM: 5329.54 MB
Total Pagefile: 9423.22 MB
Available Pagefile: 6432.54 MB
Total Virtual: 131072 MB
Available Virtual: 131071.78 MB
==================== Drives ================================
Drive c: (TI31025900A) (Fixed) (Total:454.36 GB) (Free:286.18 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End of log ============================
So nun ist es glaub übersichtlicher. Sorry. |
|
15.06.2015, 14:11
| #5 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CloudScout bringt immer Werbung Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
15.06.2015, 14:24
| #6 |
| | CloudScout bringt immer Werbung Das einzige Log welches ich noch habe ist dieses, Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.9.7 (06.15.2015:1)
OS: Windows 8.1 Pro x64
Ran by TL on 15.06.2015 at 14:45:08.40
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{85A60A59-D3D8-468F-B598-FB4393789EF4}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{BDF61FAE-9D19-40F0-8F34-688DEB334CA9}
~~~ Files
~~~ Folders
~~~ Chrome
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.06.2015 at 14:48:48.35
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Das sind aber alle Ergebnisse, die ich habe. |
|
15.06.2015, 14:29
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CloudScout bringt immer Werbung Dann mal anders gefragt: sind Malwarebytes oder Avira denn je fündig geworden??
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.06.2015, 14:43
| #8 |
| | CloudScout bringt immer Werbung Malewareabits hat nie einen Fehler gezeigt. Avira habe ich nie ausgeführt, Ich dachte, Kapersky sollte das Selbe auch sehen. Betreffend dem Virus, waren ursprünglich schon die Virenverseuchenden Programme installiert. Gameirgendetwas und noch etwa 5 ähnliche. Die habe ich alle deinstalliert. Aber die Werbung habe ich nicht weggekriegt. Die kommt immer wieder. |
|
15.06.2015, 14:55
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CloudScout bringt immer Werbung Adware/Junkware/Toolbars entfernen 1. Schritt: Malwarebytes Downloade Dir bitte  Malwarebytes Anti-Malware
(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 2. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
3. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
4. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
15.06.2015, 16:30
| #10 |
| | CloudScout bringt immer Werbung So nun habe ich mal alle Programme wie beschrieben nochmals durchlaufen lassen. Und plötzlich zeigt sich etwas: Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 15.06.2015 Suchlauf-Zeit: 16:10:58 Logdatei: Malwareabytes.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.06.15.04 Rootkit Datenbank: v2015.06.15.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: TL Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 496816 Verstrichene Zeit: 36 Min, 34 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 4 PUP.Optional.MultiPlug.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{1146AC44-2F03-4431-B4FD-889BC837521F}{53a1c4d9}, , [14ecdcdf1278fe389f2fe7a32fd648b8], PUP.Optional.SuperOptimizer.C, HKU\S-1-5-18\SOFTWARE\APPDATALOW\{1146AC44-2F03-4431-B4FD-889BC837521F}, , [926e2794bfcbd95dd5a7fc9234d1c739], PUP.Optional.Spigot.A, HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6C9E9AAE-F67D-4F6E-8420-209B154CCB43}, , [43bdedcea6e4ab8be9b25e957a89b24e], PUP.Optional.ProductSetup.A, HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\SOFTWARE\PRODUCTSETUP, , [c040b6050486350118199cf27b8a669a], Registrierungswerte: 2 PUP.Optional.Spigot.A, HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6C9E9AAE-F67D-4F6E-8420-209B154CCB43}|URL, hxxp://ch.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=971163&p={searchTerms}, , [43bdedcea6e4ab8be9b25e957a89b24e] PUP.Optional.ProductSetup.A, HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\SOFTWARE\PRODUCTSETUP|tb, 0V1D1S1R1D0V1O, , [c040b6050486350118199cf27b8a669a] Registrierungsdaten: 3 Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{0F6D1F5D-C50A-4E37-BD6A-A691B579304D}|NameServer, 81.218.119.5,82.163.142.130, Gut: (), Schlecht: (81.218.119.5,82.163.142.130),,[bf41ceed2d5d0f270a514df842c4f709] Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{4213E76E-5361-42F0-9897-80E46871CF3D}|NameServer, 81.218.119.5,82.163.142.130, Gut: (), Schlecht: (81.218.119.5,82.163.142.130),,[34cc19a226648aac184370d57a8cc739] Trojan.DNSChanger, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\TCPIP\PARAMETERS\Interfaces\{E8258C0E-E2C7-4F00-90C1-202B1E2FAD22}|NameServer, 81.218.119.5,82.163.142.130, Gut: (), Schlecht: (81.218.119.5,82.163.142.130),,[39c788332c5e979ff9620342d92d4ab6] Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 4 PUP.Optional.OptimizerPro.A, C:\Users\tl\AppData\Local\Temp\optprosetup.exe, , [bd43d3e8602aa195d6d3dc89d32ff40c], PUP.Optional.OfferInstaller.C, C:\Users\tl\AppData\Local\Temp\sdfABF1.exe, , [f20ed2e9b2d854e2885e81bf837fb34d], PUP.Optional.OfferInstaller.C, C:\Users\tl\AppData\Local\Temp\sdfAC8D.exe, , [0cf462590a8049ed12d495abc73b23dd], PUP.Optional.MyStartSearch.A, C:\Users\tl\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_76.exe, , [f10fbb0012785dd908be88f5689ecd33], Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.206 - Bericht erstellt 15/06/2015 um 16:54:07
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-14.1 [Server]
# Betriebssystem : Windows 8.1 Pro (x64)
# Benutzername : TL - PFISTERNB20
# Gestarted von : C:\Users\tl\Desktop\V2\AdwCleaner_4.206.exe
# Option : Suchlauf
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Daten Gefunden : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] -
Daten Gefunden : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] -
Wert Gefunden : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [DefaultConnectionSettings]
Wert Gefunden : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [SavedLegacySettings]
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Google Chrome v43.0.2357.124
*************************
AdwCleaner[R0].txt - [8082 Bytes] - [12/06/2015 15:50:15]
AdwCleaner[R1].txt - [1334 Bytes] - [12/06/2015 16:03:28]
AdwCleaner[R2].txt - [1393 Bytes] - [12/06/2015 16:12:16]
AdwCleaner[R3].txt - [1511 Bytes] - [12/06/2015 16:50:35]
AdwCleaner[R4].txt - [1791 Bytes] - [15/06/2015 08:59:13]
AdwCleaner[R5].txt - [366 Bytes] - [15/06/2015 09:04:30]
AdwCleaner[R6].txt - [2004 Bytes] - [15/06/2015 10:37:56]
AdwCleaner[R7].txt - [1491 Bytes] - [15/06/2015 16:54:07]
AdwCleaner[S0].txt - [5698 Bytes] - [12/06/2015 15:53:22]
AdwCleaner[S1].txt - [1222 Bytes] - [12/06/2015 16:12:45]
AdwCleaner[S2].txt - [1340 Bytes] - [12/06/2015 16:51:42]
AdwCleaner[S3].txt - [1833 Bytes] - [15/06/2015 10:39:37]
########## EOF - C:\AdwCleaner\AdwCleaner[R7].txt - [1786 Bytes] ##########
Code:
ATTFilter # AdwCleaner v4.206 - Bericht erstellt 15/06/2015 um 17:00:31
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-14.1 [Server]
# Betriebssystem : Windows 8.1 Pro (x64)
# Benutzername : TL - PFISTERNB20
# Gestarted von : C:\Users\tl\Desktop\V2\AdwCleaner_4.206.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyServer] -
Daten Gelöscht : HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] -
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Google Chrome v43.0.2357.124
*************************
AdwCleaner[R0].txt - [8082 Bytes] - [12/06/2015 15:50:15]
AdwCleaner[R1].txt - [1334 Bytes] - [12/06/2015 16:03:28]
AdwCleaner[R2].txt - [1393 Bytes] - [12/06/2015 16:12:16]
AdwCleaner[R3].txt - [1511 Bytes] - [12/06/2015 16:50:35]
AdwCleaner[R4].txt - [1791 Bytes] - [15/06/2015 08:59:13]
AdwCleaner[R5].txt - [366 Bytes] - [15/06/2015 09:04:30]
AdwCleaner[R6].txt - [2004 Bytes] - [15/06/2015 10:37:56]
AdwCleaner[R7].txt - [1865 Bytes] - [15/06/2015 16:54:07]
AdwCleaner[S0].txt - [5698 Bytes] - [12/06/2015 15:53:22]
AdwCleaner[S1].txt - [1222 Bytes] - [12/06/2015 16:12:45]
AdwCleaner[S2].txt - [1340 Bytes] - [12/06/2015 16:51:42]
AdwCleaner[S3].txt - [1833 Bytes] - [15/06/2015 10:39:37]
AdwCleaner[S4].txt - [1555 Bytes] - [15/06/2015 17:00:31]
########## EOF - C:\AdwCleaner\AdwCleaner[S4].txt - [1614 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.9.7 (06.15.2015:1)
OS: Windows 8.1 Pro x64
Ran by TL on 15.06.2015 at 17:03:09.75
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Chrome
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\tl\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.06.2015 at 17:07:00.91
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by TL (administrator) on PFISTERNB20 on 15-06-2015 17:10:31
Running from C:\Users\tl\Desktop\V2
Loaded Profiles: TL (Available Profiles: TL & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avp.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
(Microsoft Corporation) C:\Windows\System32\printfilterpipelinesvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avpui.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2611112 2012-09-04] ()
HKLM\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [LogMeIn GUI] => C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2013-04-30] (LogMeIn, Inc.)
HKLM\...\Run: [Seagull Drivers] => ssdal_nc.exe startup
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-02] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-09-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7148032 2012-10-31] (Pegatron Corporation)
HKLM-x32\...\Run: [TPUReg(x86)] => "C:\Program Files\TOSHIBA\Password Utility\TosPU.exe" /Retimes
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
HKLM-x32\...\Run: [Shairport4w] => "C:\Users\tl\Downloads\Shairport4w.exe"
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [21969480 2015-05-19] (Google)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [720064 2015-03-18] (Microsoft Corporation)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [OneDrive] => C:\Users\tl\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-23] (Microsoft Corporation)
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\logon.scr
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Pfister-Admin.lnk [2013-07-05]
ShortcutTarget: Pfister-Admin.lnk -> C:\PfisterWaagenGmbH\WinWeighPlus\Bin\Pfister-Admin.js ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1026108093-1314267383-2887952174-1155\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155 -> {021622C1-E2A8-4586-A500-093A474F1671} URL = hxxp://www.google.ch/search?hl=de&q={searchTerms}&btnG=Google-Suche&meta=
SearchScopes: HKU\S-1-5-21-1026108093-1314267383-2887952174-1155 -> {D06EC416-9D1A-4B75-B3B2-3F4FD13F9A19} URL =
BHO: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-04-21] (Oracle Corporation)
BHO: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\x64\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-04-21] (Oracle Corporation)
BHO-x32: Virtual Keyboard Plugin -> {4A66AD60-A03D-4D01-86F0-5F0F7C0EF1AD} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-04-21] (Oracle Corporation)
BHO-x32: Content Blocker Plugin -> {93BC2EA7-2F17-4729-948A-D2E03FFB2412} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Safe Money Plugin -> {AB379017-4C03-4E00-8EDF-E6D6AF7CCF82} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\IEExt\ie_plugin.dll [2014-12-23] (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-04-21] (Oracle Corporation)
DPF: HKLM-x32 {44C1E3A2-B594-401C-B27A-D1B4476E4797} https://login.saidef.ch/XTSAC.cab
DPF: HKLM-x32 {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/RACtrl.cab?rnd=854258499
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2013-10-01] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.5
FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-04-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-04-21] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2013-10-01] (Citrix Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-04-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-04-21] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker_663BE84DBCC949E88C7600F63CA7F098 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com [2015-06-15] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard_07402848C2F6470194F131B0F3DE025E -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-06-15] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-15] (Google Inc.)
FF Plugin-x32: @vmware.com/vmrc,version=5.1.0.00000 -> C:\Program Files (x86)\Common Files\VMware\VMware Remote Console Plug-in 5.1\Firefox\np-vmware-vmrc.dll [2012-07-13] (VMware, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [content_blocker_663BE84DBCC949E88C7600F63CA7F098@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\content_blocker@kaspersky.com [2015-06-12]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_07402848C2F6470194F131B0F3DE025E@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\FFExt\virtual_keyboard@kaspersky.com [2015-06-12]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
Chrome:
=======
CHR Profile: C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-15]
CHR Extension: (Google Docs) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-15]
CHR Extension: (Google Drive) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-15]
CHR Extension: (YouTube) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-15]
CHR Extension: (Google Search) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-15]
CHR Extension: (Kaspersky Protection) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-06-15]
CHR Extension: (Google Sheets) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-15]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-06-15]
CHR Extension: (Google Wallet) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-15]
CHR Extension: (Gmail) - C:\Users\tl\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-15]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.)
R2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\avp.exe [193400 2014-12-23] (Kaspersky Lab ZAO)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
S2 IBG_gds_db; C:\CodeGear\InterBase\bin\ibguard.exe [36864 2009-08-12] (Embarcadero Technologies, Inc.) [File not signed]
S3 IBS_gds_db; C:\CodeGear\InterBase\bin\ibserver.exe [2887680 2009-08-12] (Embarcadero Technologies, Inc.) [File not signed]
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [417640 2015-05-27] (LogMeIn, Inc.)
S2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [234856 2015-05-27] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2013-04-30] (LogMeIn, Inc.)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)
S3 Scriptable Automation Manager; C:\PfisterWaagenGmbH\SAM\Bin\SAM.exe [233472 2010-11-26] (AIT Software GmbH) [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [114656 2012-09-25] (Toshiba Europe GmbH)
S2 vtigercrmApache600; C:\Program Files (x86)\vtigercrm600\apache\bin\httpd.exe [19968 2013-11-14] (Apache Software Foundation) [File not signed]
S2 vtigercrmMysql600; C:\Program Files (x86)\vtigercrm600\mysql\my.ini [2988 2014-08-26] () [File not signed]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3858944 2013-10-24] (Qualcomm Atheros Communications, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [56008 2015-05-18] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [151240 2014-11-28] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [247496 2014-10-22] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [824008 2015-05-18] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30920 2014-10-10] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [31432 2014-10-30] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [69320 2014-11-20] (Kaspersky Lab ZAO)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [77000 2014-11-22] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [181960 2014-11-10] (Kaspersky Lab ZAO)
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-04-30] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-04-14] (Malwarebytes Corporation)
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [33168 2013-11-01] (Windows (R) Win 7 DDK provider)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)
S3 avchv; \SystemRoot\system32\DRIVERS\avchv.sys [X]
U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-15 17:07 - 2015-06-15 17:07 - 00001032 _____ C:\Users\tl\Desktop\JRT.txt
2015-06-15 16:10 - 2015-06-15 16:10 - 00136408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-06-15 16:10 - 2015-06-15 16:10 - 00001089 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-15 16:10 - 2015-06-15 16:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-06-15 16:10 - 2015-06-15 16:10 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-06-15 16:10 - 2015-04-14 09:38 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-06-15 16:10 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-06-15 16:10 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-06-15 16:07 - 2015-06-15 17:09 - 00000000 ____D C:\Users\tl\Desktop\V2
2015-06-15 14:50 - 2015-06-15 14:50 - 00052312 _____ C:\Users\tl\Downloads\FRST.txt
2015-06-15 14:44 - 2015-06-15 14:44 - 02109952 _____ (Farbar) C:\Users\tl\Downloads\FRST64.exe
2015-06-15 14:42 - 2015-06-15 14:42 - 02945429 _____ (Thisisu) C:\Users\tl\Downloads\JRT.exe
2015-06-15 11:55 - 2015-06-15 11:55 - 00380416 _____ C:\Users\tl\Downloads\0l72b8z2.exe
2015-06-15 11:53 - 2015-06-15 11:53 - 00380416 _____ C:\Users\tl\Downloads\Gmer-19357.exe
2015-06-15 11:42 - 2015-06-15 17:10 - 00000000 ____D C:\FRST
2015-06-15 11:42 - 2015-06-15 11:42 - 00000000 _____ C:\Users\tl\defogger_reenable
2015-06-15 11:40 - 2015-06-15 14:50 - 00000000 ____D C:\Users\tl\Desktop\Virenschutz
2015-06-15 10:37 - 2015-06-15 10:37 - 02231296 _____ C:\Users\tl\Downloads\adwcleaner_4.206.exe
2015-06-15 09:43 - 2015-06-15 14:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-06-15 09:43 - 2015-06-15 09:43 - 00002242 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-15 09:42 - 2015-06-15 09:48 - 00000000 ____D C:\searchplugins
2015-06-15 09:42 - 2015-06-15 09:42 - 00002904 _____ C:\WINDOWS\SysWOW64\LavasoftTcpServiceOff.ini
2015-06-15 09:42 - 2015-06-15 09:42 - 00002904 _____ C:\WINDOWS\system32\LavasoftTcpServiceOff.ini
2015-06-15 09:42 - 2015-06-15 09:42 - 00000000 ____D C:\Users\tl\AppData\Roaming\LavasoftStatistics
2015-06-15 09:41 - 2015-06-15 09:42 - 00000000 ____D C:\Users\tl\AppData\Local\Deployment
2015-06-15 09:41 - 2015-06-08 14:13 - 00428880 _____ (Lavasoft Limited) C:\WINDOWS\system32\LavasoftTcpService64.dll
2015-06-15 09:41 - 2015-06-08 14:13 - 00348488 _____ (Lavasoft Limited) C:\WINDOWS\SysWOW64\LavasoftTcpService.dll
2015-06-15 09:40 - 2015-06-15 10:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
2015-06-15 09:40 - 2015-06-15 09:40 - 00000000 ____H C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-06-15 09:11 - 2015-06-15 09:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-12 16:40 - 2015-06-12 16:40 - 00000207 _____ C:\WINDOWS\tweaking.com-regbackup-PFISTERNB20-Windows-8.1-Pro-(64-bit).dat
2015-06-12 16:40 - 2015-06-12 16:40 - 00000000 ____D C:\RegBackup
2015-06-12 15:50 - 2015-06-15 17:00 - 00000000 ____D C:\AdwCleaner
2015-06-12 15:34 - 2015-06-12 15:34 - 00003152 _____ C:\WINDOWS\System32\Tasks\{7FB0C9C3-0F3E-4C60-9925-21E2C811DC63}
2015-06-12 15:13 - 2015-06-15 14:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus
2015-06-12 15:13 - 2015-06-12 15:13 - 00002078 _____ C:\Users\Public\Desktop\Kaspersky Anti-Virus.lnk
2015-06-12 15:13 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\klfphc.dll
2015-06-12 15:11 - 2015-06-15 17:01 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-12 15:11 - 2015-06-12 15:11 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-12 15:11 - 2015-05-18 22:16 - 00824008 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klif.sys
2015-06-12 15:11 - 2014-11-28 18:19 - 00151240 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klflt.sys
2015-06-12 15:11 - 2014-10-22 21:13 - 00247496 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klhk.sys
2015-06-12 11:14 - 2015-06-12 11:16 - 00000063 _____ C:\WINDOWS\winfix.ini
2015-06-12 11:11 - 2015-06-12 11:11 - 00369923 _____ C:\Users\tl\Desktop\atc.zip
2015-06-12 11:01 - 2015-06-12 14:40 - 00000000 ____D C:\Program Files (x86)\LogMeTT
2015-06-12 11:01 - 2015-06-12 11:01 - 00000000 ____D C:\Users\tl\AppData\Local\LogMeTT
2015-06-12 11:00 - 2015-06-15 14:50 - 00000000 ____D C:\Program Files (x86)\teraterm
2015-06-10 14:21 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-06-10 14:21 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-06-10 14:21 - 2015-05-25 15:23 - 00036864 _____ (Microsoft Corporation) C:\WINDOWS\system32\UtcResources.dll
2015-06-10 14:21 - 2015-05-25 15:07 - 01430528 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2015-06-10 14:21 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-06-10 14:21 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-06-10 14:21 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-06-10 14:21 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-06-10 14:21 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2015-06-10 14:21 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2015-06-10 14:21 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-06-10 14:21 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2015-06-10 14:21 - 2015-05-23 04:47 - 00128000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iepeers.dll
2015-06-10 14:21 - 2015-05-23 04:43 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-06-10 14:21 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-06-10 14:21 - 2015-05-23 04:38 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2015-06-10 14:21 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2015-06-10 14:21 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-06-10 14:21 - 2015-05-23 04:28 - 01042944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-06-10 14:21 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-06-10 14:21 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-06-10 14:21 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-06-10 14:21 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-06-10 14:21 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-06-10 14:21 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-06-10 14:21 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-06-10 14:21 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-06-10 14:21 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-06-10 14:21 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2015-06-10 14:21 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2015-06-10 14:21 - 2015-05-22 20:23 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-06-10 14:21 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2015-06-10 14:21 - 2015-05-22 20:15 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-06-10 14:21 - 2015-05-22 20:09 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-06-10 14:21 - 2015-05-22 20:08 - 00374272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2015-06-10 14:21 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-06-10 14:21 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-06-10 14:21 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-06-10 14:21 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-06-10 14:21 - 2015-05-22 19:49 - 02865152 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-06-10 14:21 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-06-10 14:21 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-06-10 14:21 - 2015-05-21 18:47 - 04177920 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-06-10 14:21 - 2015-04-25 04:34 - 00653824 _____ (Microsoft Corporation) C:\WINDOWS\system32\comctl32.dll
2015-06-10 14:21 - 2015-04-25 04:33 - 00549888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comctl32.dll
2015-06-10 14:21 - 2015-04-16 08:17 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2015-06-10 14:21 - 2015-04-14 00:37 - 00275968 _____ (Microsoft Corporation) C:\WINDOWS\system32\authz.dll
2015-06-10 14:21 - 2015-04-14 00:34 - 00180224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authz.dll
2015-06-10 14:21 - 2015-04-10 02:40 - 01249280 _____ (Microsoft Corporation) C:\WINDOWS\system32\UIAutomationCore.dll
2015-06-10 14:21 - 2015-04-10 02:17 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UIAutomationCore.dll
2015-06-10 14:21 - 2015-04-09 00:41 - 00158720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rgb9rast.dll
2015-06-10 14:21 - 2015-04-09 00:07 - 00410336 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-06-10 14:21 - 2015-04-02 00:42 - 03097600 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2015-06-10 14:21 - 2015-04-02 00:30 - 02483712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2015-06-10 14:21 - 2015-04-01 06:21 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchProtocolHost.exe
2015-06-10 14:21 - 2015-04-01 06:18 - 00468480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssph.dll
2015-06-10 14:21 - 2015-04-01 06:17 - 00248832 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssphtb.dll
2015-06-10 14:21 - 2015-04-01 06:08 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssvp.dll
2015-06-10 14:21 - 2015-04-01 05:46 - 03633664 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll
2015-06-10 14:21 - 2015-04-01 05:17 - 02551808 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll
2015-06-10 14:21 - 2015-04-01 05:17 - 00903168 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe
2015-06-10 14:21 - 2015-04-01 04:53 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssph.dll
2015-06-10 14:21 - 2015-04-01 04:53 - 00272896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchProtocolHost.exe
2015-06-10 14:21 - 2015-04-01 04:45 - 02749952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll
2015-06-10 14:21 - 2015-04-01 04:45 - 00699392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssvp.dll
2015-06-10 14:21 - 2015-04-01 04:14 - 01920000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll
2015-06-10 14:21 - 2015-04-01 04:12 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe
2015-06-10 14:21 - 2015-03-20 05:49 - 00309760 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2015-06-10 14:21 - 2015-03-20 05:08 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-06-10 14:21 - 2015-03-20 04:37 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-06-10 14:21 - 2015-03-20 04:07 - 01091072 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-06-10 14:21 - 2015-03-02 03:43 - 00222208 _____ (Microsoft Corporation) C:\WINDOWS\system32\rastapi.dll
2015-06-10 14:21 - 2015-03-02 03:21 - 00207872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rastapi.dll
2015-06-10 13:58 - 2015-06-15 14:50 - 00000000 ____D C:\Users\tl\AppData\Roaming\PhonerLite
2015-06-10 13:58 - 2015-06-15 14:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhonerLite
2015-06-10 13:58 - 2015-06-15 14:50 - 00000000 ____D C:\Program Files (x86)\PhonerLite
2015-06-10 13:58 - 2015-06-10 13:58 - 00001058 _____ C:\Users\tl\Desktop\PhonerLite.lnk
2015-06-10 13:46 - 2015-06-10 13:46 - 00000000 ____D C:\ProgramData\CounterPath Corporation
2015-06-10 13:45 - 2015-06-15 14:50 - 00000000 ____D C:\Users\tl\AppData\Local\CounterPath
2015-06-10 13:45 - 2015-06-10 13:45 - 00000000 ____D C:\Users\tl\AppData\Local\CounterPath Corporation
2015-06-10 13:44 - 2015-06-15 14:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CounterPath X-Lite
2015-06-10 13:44 - 2015-06-10 13:44 - 00001136 _____ C:\Users\Public\Desktop\X-Lite.lnk
2015-06-10 13:44 - 2015-06-10 13:44 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-10 13:44 - 2015-06-10 13:44 - 00000000 ____D C:\Program Files (x86)\CounterPath
2015-06-10 13:22 - 2015-06-15 14:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Linphone 3.8.4
2015-06-10 13:22 - 2015-06-10 13:35 - 00000000 ____D C:\Users\tl\AppData\Roaming\Linphone
2015-06-10 13:21 - 2015-06-10 13:22 - 00000000 ____D C:\Program Files (x86)\Linphone
2015-06-10 09:28 - 2015-06-10 10:01 - 18309674 _____ C:\Users\tl\Desktop\Seckenberg-2015-06-10.zip
2015-06-09 16:05 - 2015-06-09 16:05 - 00000000 ____D C:\Users\tl\Desktop\TransportAG
2015-06-08 13:19 - 2015-06-08 13:19 - 00319430 _____ C:\Users\tl\Desktop\Winweigh-archive.zip
2015-06-08 11:23 - 2015-06-08 11:23 - 35893000 _____ C:\Users\tl\Desktop\Interbase2009.zip
2015-06-08 10:27 - 2015-06-08 10:27 - 131486630 _____ C:\Users\tl\Desktop\CD-WinweighPlus-60-109-REVISION-4.zip
2015-06-08 10:27 - 2015-06-08 10:27 - 00000000 ____D C:\Users\tl\Desktop\CD-WinweighPlus-60-109-REVISION-4
2015-06-05 10:14 - 2015-05-22 15:08 - 00700416 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 01119232 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 01020928 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 00756736 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 00422912 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 00193536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2015-06-05 10:14 - 2015-05-21 15:08 - 00045568 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-06-05 10:14 - 2015-04-17 00:07 - 00227328 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2015-06-01 11:38 - 2015-06-01 11:39 - 11062464 _____ C:\Users\tl\Desktop\LIEFERUNG_HKW_BASEL.csv
2015-05-29 14:37 - 2015-05-29 14:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HK-Software
2015-05-29 14:37 - 2015-05-29 14:37 - 00000000 ____D C:\Program Files (x86)\HK-Software
2015-05-29 14:04 - 2009-06-23 07:39 - 12063303 _____ (IBExpert KG ) C:\Users\tl\Desktop\setup_personal.exe
2015-05-29 11:51 - 2015-04-01 06:05 - 00038689 _____ C:\Users\tl\Desktop\Artikel.txd
2015-05-29 11:32 - 2015-05-29 11:32 - 00034805 _____ C:\Users\tl\Desktop\fürPeter.TXT
2015-05-29 11:31 - 2015-05-29 11:31 - 00034805 _____ C:\Users\tl\Desktop\TEST.db
2015-05-22 10:50 - 2015-05-22 10:51 - 00101244 _____ C:\Users\tl\Desktop\TEST1_HKW_BASEL.csv
2015-05-22 10:46 - 2015-05-22 10:49 - 00103732 _____ C:\Users\tl\Desktop\kkk.csv
2015-05-22 09:49 - 2015-05-22 10:45 - 00359793 _____ C:\Users\tl\Desktop\Export.csv
2015-05-21 11:56 - 2015-05-21 11:56 - 00000000 ____D C:\Users\tl\Desktop\Transport_AG-Entsorgungshof-Buchs
2015-05-19 16:52 - 2015-05-22 09:07 - 00101142 _____ C:\Users\tl\Desktop\TEST_HKW_BASEL.csv
2015-05-18 22:16 - 2015-05-18 22:16 - 00056008 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\kldisk.sys
2015-05-18 11:44 - 2015-05-18 11:44 - 21923270 _____ C:\Users\tl\Desktop\TEST-insert.sql
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-15 17:07 - 2013-06-05 13:35 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1026108093-1314267383-2887952174-1155
2015-06-15 17:02 - 2014-04-21 09:25 - 00000000 __RDO C:\Users\tl\OneDrive
2015-06-15 17:02 - 2013-10-24 16:29 - 01694237 _____ C:\WINDOWS\WindowsUpdate.log
2015-06-15 17:02 - 2013-07-29 12:52 - 00001146 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-15 17:01 - 2015-03-17 10:54 - 00000000 ____D C:\Users\tl\AppData\Local\CrashDumps
2015-06-15 17:01 - 2014-01-22 10:43 - 00000991 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Client.lnk
2015-06-15 17:01 - 2014-01-22 10:43 - 00000975 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Control Panel.lnk
2015-06-15 17:01 - 2013-10-23 16:10 - 00000000 ____D C:\ProgramData\VMware
2015-06-15 17:01 - 2013-09-29 21:04 - 00164214 _____ C:\WINDOWS\PFRO.log
2015-06-15 17:01 - 2013-08-22 16:46 - 00363268 _____ C:\WINDOWS\setupact.log
2015-06-15 17:01 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-06-15 17:01 - 2013-06-05 13:26 - 00000144 _____ C:\WINDOWS\system32\config\netlogon.ftl
2015-06-15 17:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-06-15 16:52 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\FileManager
2015-06-15 16:52 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-06-15 16:26 - 2013-07-29 12:52 - 00001150 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-15 14:50 - 2015-04-04 04:36 - 00000000 ___SD C:\WINDOWS\system32\GWX
2015-06-15 14:50 - 2014-12-23 08:04 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-06-15 14:50 - 2014-07-09 05:53 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-06-15 14:50 - 2013-08-22 17:36 - 00000000 __RSD C:\WINDOWS\Media
2015-06-15 14:50 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2015-06-15 14:50 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PolicyDefinitions
2015-06-15 14:50 - 2013-06-05 11:43 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-06-15 14:49 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-06-15 14:49 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\system32\Sysprep
2015-06-15 14:09 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-06-15 13:09 - 2013-09-30 06:14 - 01815266 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-06-15 13:09 - 2013-09-30 05:56 - 00779002 _____ C:\WINDOWS\system32\perfh007.dat
2015-06-15 13:09 - 2013-09-30 05:56 - 00164152 _____ C:\WINDOWS\system32\perfc007.dat
2015-06-15 11:42 - 2013-10-24 16:21 - 00000000 ____D C:\Users\tl
2015-06-15 10:22 - 2013-06-05 11:30 - 00045092 _____ C:\WINDOWS\DPINST.LOG
2015-06-15 10:22 - 2012-12-05 19:23 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-06-15 09:43 - 2013-07-29 12:52 - 00000000 ____D C:\Users\tl\AppData\Local\Google
2015-06-15 09:43 - 2013-07-29 12:52 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-15 00:13 - 2013-07-03 14:13 - 00000000 ____D C:\ProgramData\LogMeIn
2015-06-12 16:21 - 2012-12-05 19:51 - 00000000 ____D C:\ProgramData\Nero
2015-06-12 15:17 - 2014-03-31 09:34 - 00001437 _____ C:\Users\tl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-06-12 15:17 - 2013-10-24 16:47 - 00001255 _____ C:\Users\tl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iexplore.lnk
2015-06-12 15:13 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2015-06-12 15:12 - 2012-07-26 10:12 - 00000000 ___HD C:\WINDOWS\ELAMBKUP
2015-06-12 15:11 - 2012-07-26 07:37 - 00000000 ____D C:\Users\Default.migrated
2015-06-12 15:00 - 2013-08-22 16:44 - 00410152 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-06-12 14:43 - 2013-09-23 15:18 - 00000000 ___RD C:\Users\tl\Documents\UDC Output Files
2015-06-12 14:43 - 2013-07-01 14:17 - 00000000 ____D C:\Users\tl\AppData\Roaming\WildTangent
2015-06-12 14:43 - 2013-06-05 11:44 - 00000000 ____D C:\Program Files (x86)\TOSHIBA Games
2015-06-12 14:43 - 2013-06-05 11:43 - 00000000 ____D C:\ProgramData\WildTangent
2015-06-12 14:42 - 2015-02-24 11:06 - 00000000 ____D C:\Users\tl\AppData\Local\Unity
2015-06-12 14:38 - 2015-04-09 08:44 - 00000000 ____D C:\Users\tl\AppData\Roaming\Juniper Networks
2015-06-12 14:38 - 2015-03-17 15:20 - 00000000 ____D C:\Users\tl\Documents\planetView_030006
2015-06-11 09:18 - 2013-07-31 15:37 - 00002998 _____ C:\WINDOWS\SysWOW64\RBuilder.ini
2015-06-11 08:36 - 2015-05-12 15:55 - 00000000 ____D C:\Users\tl\Desktop\Pratteln
2015-06-11 08:35 - 2015-01-14 12:39 - 00000000 ____D C:\Users\tl\AppData\Local\LogMeInIgnition
2015-06-11 08:31 - 2013-08-21 10:56 - 00000261 _____ C:\WINDOWS\IKP.INI
2015-06-11 05:41 - 2013-06-12 15:55 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 05:41 - 2012-07-26 09:59 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-06-11 05:39 - 2013-07-30 03:00 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-06-11 05:30 - 2013-06-06 13:37 - 140135120 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-06-11 05:27 - 2012-07-26 07:26 - 00000301 _____ C:\WINDOWS\win.ini
2015-06-10 13:12 - 2013-06-05 13:29 - 00002280 ____H C:\Users\tl\Documents\Default.rdp
2015-06-10 13:05 - 2015-01-26 12:40 - 00011608 _____ C:\Users\tl\advanced_ip_scanner_MAC.bin
2015-06-08 02:28 - 2013-07-29 12:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-06-05 09:20 - 2013-07-17 11:45 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2015-06-03 18:18 - 2015-04-17 08:38 - 00792568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-06-03 18:18 - 2015-04-17 08:38 - 00178168 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-01 14:51 - 2014-04-22 12:38 - 00000000 ____D C:\WINDOWS\system32\%LOCALAPPDATA%
2015-05-31 09:20 - 2013-07-17 11:45 - 00107392 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIRfsClientNP.dll.000.bak
2015-05-29 14:36 - 2013-07-31 11:28 - 00000000 ____D C:\ProgramData\firebird
2015-05-28 15:58 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\FxsTmp
2015-05-28 13:57 - 2013-06-10 16:18 - 00000000 ____D C:\Users\tl\AppData\Local\Apple
2015-05-28 09:16 - 2013-06-05 13:29 - 00000000 ____D C:\Users\tl\AppData\Roaming\VMware
2015-05-27 17:17 - 2013-07-17 11:45 - 00107392 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIRfsClientNP.dll
2015-05-27 17:17 - 2013-07-17 11:45 - 00092520 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIinit.dll
2015-05-27 17:17 - 2013-07-17 11:45 - 00035688 _____ (LogMeIn, Inc.) C:\WINDOWS\system32\LMIport.dll
2015-05-23 02:21 - 2014-04-21 08:57 - 00000000 ___RD C:\Users\tl\SkyDrive
2015-05-23 02:21 - 2014-02-20 11:54 - 00003100 _____ C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1026108093-1314267383-2887952174-1155
2015-05-21 11:04 - 2014-01-08 11:39 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2015-05-21 11:04 - 2014-01-08 11:39 - 00001117 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2015-05-20 04:43 - 2015-04-04 04:36 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2015-05-18 08:35 - 2014-12-10 06:42 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-18 08:35 - 2014-12-10 06:42 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-18 08:31 - 2013-08-22 17:36 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2015-05-18 08:31 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\system32\AdvancedInstallers
==================== Files in the root of some directories =======
2015-03-11 15:17 - 2015-03-10 03:17 - 0000044 ____H () C:\Program Files (x86)\b922db64.tmp
2013-07-29 10:06 - 2013-07-29 10:06 - 0007597 _____ () C:\Users\tl\AppData\Local\resmon.resmoncfg
Some files in TEMP:
====================
C:\Users\tl\AppData\Local\Temp\1fvwautoupd.exe
C:\Users\tl\AppData\Local\Temp\ICReinstall_FileZilla_3.10.2_win32-setup.exe
C:\Users\tl\AppData\Local\Temp\nv82D7.tmp.exe
C:\Users\tl\AppData\Local\Temp\Quarantine.exe
C:\Users\tl\AppData\Local\Temp\Setup.exe
C:\Users\tl\AppData\Local\Temp\sqlite3.dll
C:\Users\tl\AppData\Local\Temp\Win8_x64.exe
C:\Users\tl\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-15 14:10
==================== End of log ============================
Ich melde mich wie es aussieht, wenn ich den Rechner nochmals neu gestartet habe. So nun habe ich den PC noch zwei mal neu gebootet. Ich kann nun sowohl den IE wie auch Google Chrom benützen, ohne dass die lästige Werbung erscheint. Es sieht so aus, als wäre alles wieder in Ordnung. Gibt es noch etwas, was ich noch ausführen muss, oder ist dies nun alles? Auf alle Fälle vielen Dank für die Hilfe. Da war ich nun wirklich kurz davor zu verzweifeln. Gruss thomas |
|
16.06.2015, 08:32
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | CloudScout bringt immer Werbung Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu CloudScout bringt immer Werbung |
| ausgeführt, betriebssystem, chrome, cloudscout, diverse, einstellungen, fehler, gen, google, google chrome, installer, links, thomas, tritt, webseite, werbun, werbung, werbungen, windows, zurückgesetzt |
Linear-Darstellung
