| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Avira meldet Pua Somoto Gen 2Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.07.2015, 23:23
| #1 |
 |  Avira meldet Pua Somoto Gen 2 Hallo Trojaner Board Team, Ich bräuchte Hilfe bei der Bereinigung meines Pcs von der Malware die mir Avira meldet. Jedes Mal nach dem Neustart des PCs meldet Avira diese Malware 2 Mal! Bin leider überhaupt kein PC Fachmann. Freue mich über Hilfe. LG Jule |
|
01.07.2015, 23:33
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Avira meldet Pua Somoto Gen 2 Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten! Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht! Zudem bitte auch ein Log mit Farbars Tool machen: Scan mit Farbar's Recovery Scan Tool (FRST) Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
 Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
02.07.2015, 00:06
| #3 |
| | Avira meldet Pua Somoto Gen 2 Ich hatte Avira die ganze Zeit als Virenprogramm, aber vor einem Monat habe ich zum ersten Mal diesen Virus in Avira bemerkt und gleich in Quarantäne und gelöscht. Dann habe ich beschlossen die Testversion (1 Monat) von Kaspersky auszuprobieren. Kaspersky hat nie etwas gefunden. Heute lief die Testversion ab und ich habe Avira wieder installiert, daraufhin kam erneut dieser Fund (genau der gleiche wie vor einem Monat). Hier die Ergebnisse von einigen Neustarts:
__________________02.07.2015 00:46 [Updater] Update erfolgreich durchgeführt Update von Avira Free Antivirus auf Computer JULIA-PC (192.168.0.2) erfolgreich durchgeführt. Folgende Dateien wurden von "hxxp://personal.avira-update.com/update" aktualisiert: aevdf.dat 8.11.244.142 xbv00083.vdf 8.11.244.142 local000.vdf 02.07.2015 00:45 [Planer] Auftrag gestartet Auftrag "Automatisches Update Free" wurde erfolgreich gestartet. 01.07.2015 23:51 [System-Scanner] Malware gefunden Die Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' enthielt einen Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4b02d12f.qua' verschoben! 01.07.2015 23:51 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.]. Anzahl Dateien: 923 Anzahl Verzeichnisse: 0 Anzahl Malware: 2 Anzahl Warnungen: 0 01.07.2015 23:51 [System-Scanner] Malware gefunden Die Datei 'C:\Users\Julia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4WPZEEPX\sdpupdater[1].exe' enthielt einen Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5395fef1.qua' verschoben! 01.07.2015 23:49 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4WPZEEPX\sdpupdater[1].exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Übergeben an Scanner 01.07.2015 23:49 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Zugriff verweigern 01.07.2015 23:49 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Übergeben an Scanner 01.07.2015 23:48 [Echtzeit-Scanner] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.572 Engine Version: VDF Version: 01.07.2015 23:48 [Hilfsdienst] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.550 Engine Version: 8.3.32.12 VDF Version: 8.11.244.106 01.07.2015 23:47 [Planer] Dienst gestartet Der Dienst wurde gestartet. Dienst Version 15.0.11.572 01.07.2015 23:46 [Echtzeit-Scanner] Dienst gestoppt Der Dienst wurde gestoppt. 01.07.2015 23:46 [Planer] Dienst gestoppt Der Dienst wurde gestoppt. 01.07.2015 23:31 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.]. Anzahl Dateien: 2595 Anzahl Verzeichnisse: 0 Anzahl Malware: 0 Anzahl Warnungen: 0 01.07.2015 23:29 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde abgebrochen!]. Anzahl Dateien: 128032 Anzahl Verzeichnisse: 1806 Anzahl Malware: 0 Anzahl Warnungen: 0 01.07.2015 23:11 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde abgebrochen!]. Anzahl Dateien: 127991 Anzahl Verzeichnisse: 1806 Anzahl Malware: 0 Anzahl Warnungen: 0 01.07.2015 22:46 [Updater] Update erfolgreich durchgeführt Update auf Computer JULIA-PC (192.168.0.2) von "hxxp://personal.avira-update.com/update" wurde erfolgreich durchgeführt. Es sind keine neuen Engine/VDF Dateien verfügbar. 01.07.2015 22:45 [Planer] Auftrag gestartet Auftrag "Automatisches Update Free" wurde erfolgreich gestartet. 01.07.2015 21:53 [System-Scanner] Malware gefunden Die Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' enthielt einen Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4b05fed2.qua' verschoben! 01.07.2015 21:53 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.]. Anzahl Dateien: 936 Anzahl Verzeichnisse: 0 Anzahl Malware: 2 Anzahl Warnungen: 0 01.07.2015 21:53 [System-Scanner] Malware gefunden Die Datei 'C:\Users\Julia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Q8OJD8S\sdpupdater[1].exe' enthielt einen Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5392d14e.qua' verschoben! 01.07.2015 21:52 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3Q8OJD8S\sdpupdater[1].exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Übergeben an Scanner 01.07.2015 21:52 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Übergeben an Scanner 01.07.2015 21:50 [Echtzeit-Scanner] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.572 Engine Version: VDF Version: 01.07.2015 21:50 [Hilfsdienst] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.550 Engine Version: 8.3.32.12 VDF Version: 8.11.244.106 01.07.2015 21:50 [Planer] Dienst gestartet Der Dienst wurde gestartet. Dienst Version 15.0.11.572 01.07.2015 21:48 [Echtzeit-Scanner] Dienst gestoppt Der Dienst wurde gestoppt. 01.07.2015 21:48 [Planer] Dienst gestoppt Der Dienst wurde gestoppt. 01.07.2015 20:46 [Updater] Update erfolgreich durchgeführt Update von Avira Free Antivirus auf Computer JULIA-PC (192.168.0.2) erfolgreich durchgeführt. Folgende Dateien wurden von "hxxp://personal.avira-update.com/update" aktualisiert: aevdf.dat 8.11.244.106 xbv00081.vdf 8.11.244.74 xbv00082.vdf 8.11.244.106 local001.vdf 01.07.2015 20:45 [Planer] Auftrag gestartet Auftrag "Automatisches Update Free" wurde erfolgreich gestartet. 01.07.2015 19:28 [System-Scanner] Malware gefunden Die Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' enthielt einen Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '539ab569.qua' verschoben! 01.07.2015 19:28 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.]. Anzahl Dateien: 996 Anzahl Verzeichnisse: 0 Anzahl Malware: 1 Anzahl Warnungen: 0 01.07.2015 19:27 [Echtzeit-Scanner] Malware gefunden In der Datei 'C:\Users\Julia\AppData\Local\Temp\sdpupdater.exe' wurde ein Virus oder unerwünschtes Programm 'PUA/Somoto.Gen2' [riskware] gefunden. Ausgeführte Aktion: Zugriff verweigern 01.07.2015 18:49 [System-Scanner] Suche Suchlauf beendet [Der Suchlauf wurde vollständig durchgeführt.]. Anzahl Dateien: 2566 Anzahl Verzeichnisse: 0 Anzahl Malware: 0 Anzahl Warnungen: 0 01.07.2015 18:47 [Planer] Auftrag gestartet Auftrag "scan_after_installation" wurde erfolgreich gestartet. 01.07.2015 18:47 [Updater] Update erfolgreich durchgeführt Update von Avira Free Antivirus auf Computer JULIA-PC (192.168.0.2) erfolgreich durchgeführt. Folgende Dateien wurden von "hxxp://personal.avira-update.com/update" aktualisiert: aecore.dll 8.3.7.2 aegen.dll 8.1.7.42 aehelp.dll 8.3.2.2 aeheur.dll 8.1.4.1758 aeoffice.dll 8.3.1.42 aepack.dll 8.4.0.82 aescript.dll 8.2.2.76 aeset.dat 8.3.32.12 aedroid.dll 8.4.3.280 aevdf.dat 8.11.244.42 xbv00021.vdf 8.11.243.12 xbv00042.vdf 8.11.243.20 xbv00043.vdf 8.11.243.28 xbv00044.vdf 8.11.243.36 xbv00045.vdf 8.11.243.46 xbv00046.vdf 8.11.243.48 xbv00047.vdf 8.11.243.52 xbv00048.vdf 8.11.243.54 xbv00049.vdf 8.11.243.56 xbv00050.vdf 8.11.243.60 xbv00051.vdf 8.11.243.62 xbv00052.vdf 8.11.243.70 xbv00053.vdf 8.11.243.78 xbv00054.vdf 8.11.243.86 xbv00055.vdf 8.11.243.94 xbv00056.vdf 8.11.243.96 xbv00057.vdf 8.11.243.98 xbv00058.vdf 8.11.243.100 xbv00059.vdf 8.11.243.102 xbv00060.vdf 8.11.243.122 xbv00061.vdf 8.11.243.124 xbv00062.vdf 8.11.243.126 xbv00063.vdf 8.11.243.128 xbv00064.vdf 8.11.243.134 xbv00065.vdf 8.11.243.138 xbv00066.vdf 8.11.243.146 xbv00067.vdf 8.11.243.152 xbv00068.vdf 8.11.243.158 xbv00069.vdf 8.11.243.170 xbv00070.vdf 8.11.243.176 xbv00071.vdf 8.11.243.184 xbv00072.vdf 8.11.243.186 xbv00073.vdf 8.11.243.188 xbv00074.vdf 8.11.243.192 xbv00075.vdf 8.11.243.194 xbv00076.vdf 8.11.243.196 xbv00077.vdf 8.11.243.198 xbv00078.vdf 8.11.243.200 xbv00079.vdf 8.11.243.234 xbv00080.vdf 8.11.244.42 xbv00081.vdf 8.11.243.12 xbv00082.vdf 8.11.243.12 xbv00083.vdf 8.11.243.12 xbv00084.vdf 8.11.243.12 xbv00085.vdf 8.11.243.12 xbv00086.vdf 8.11.243.12 xbv00087.vdf 8.11.243.12 xbv00088.vdf 8.11.243.12 xbv00089.vdf 8.11.243.12 xbv00090.vdf 8.11.243.12 xbv00091.vdf 8.11.243.12 xbv00092.vdf 8.11.243.12 xbv00093.vdf 8.11.243.12 xbv00094.vdf 8.11.243.12 xbv00095.vdf 8.11.243.12 xbv00096.vdf 8.11.243.12 xbv00097.vdf 8.11.243.12 xbv00098.vdf 8.11.243.12 xbv00099.vdf 8.11.243.12 xbv00100.vdf 8.11.243.12 xbv00101.vdf 8.11.243.12 xbv00102.vdf 8.11.243.12 xbv00103.vdf 8.11.243.12 xbv00104.vdf 8.11.243.12 xbv00105.vdf 8.11.243.12 xbv00106.vdf 8.11.243.12 xbv00107.vdf 8.11.243.12 xbv00108.vdf 8.11.243.12 xbv00109.vdf 8.11.243.12 xbv00110.vdf 8.11.243.12 xbv00111.vdf 8.11.243.12 xbv00112.vdf 8.11.243.12 xbv00113.vdf 8.11.243.12 xbv00114.vdf 8.11.243.12 xbv00115.vdf 8.11.243.12 xbv00116.vdf 8.11.243.12 xbv00117.vdf 8.11.243.12 xbv00118.vdf 8.11.243.12 xbv00119.vdf 8.11.243.12 xbv00120.vdf 8.11.243.12 xbv00121.vdf 8.11.243.12 xbv00122.vdf 8.11.243.12 xbv00123.vdf 8.11.243.12 xbv00124.vdf 8.11.243.12 xbv00125.vdf 8.11.243.12 xbv00126.vdf 8.11.243.12 xbv00127.vdf 8.11.243.12 xbv00128.vdf 8.11.243.12 xbv00129.vdf 8.11.243.12 xbv00130.vdf 8.11.243.12 xbv00131.vdf 8.11.243.12 xbv00132.vdf 8.11.243.12 xbv00133.vdf 8.11.243.12 xbv00134.vdf 8.11.243.12 xbv00135.vdf 8.11.243.12 xbv00136.vdf 8.11.243.12 xbv00137.vdf 8.11.243.12 xbv00138.vdf 8.11.243.12 xbv00139.vdf 8.11.243.12 xbv00140.vdf 8.11.243.12 xbv00141.vdf 8.11.243.12 xbv00142.vdf 8.11.243.12 xbv00143.vdf 8.11.243.12 xbv00144.vdf 8.11.243.12 xbv00145.vdf 8.11.243.12 xbv00146.vdf 8.11.243.12 xbv00147.vdf 8.11.243.12 xbv00148.vdf 8.11.243.12 xbv00149.vdf 8.11.243.12 xbv00150.vdf 8.11.243.12 xbv00151.vdf 8.11.243.12 xbv00152.vdf 8.11.243.12 xbv00153.vdf 8.11.243.12 xbv00154.vdf 8.11.243.12 xbv00155.vdf 8.11.243.12 xbv00156.vdf 8.11.243.12 xbv00157.vdf 8.11.243.12 xbv00158.vdf 8.11.243.12 xbv00159.vdf 8.11.243.12 xbv00160.vdf 8.11.243.12 xbv00161.vdf 8.11.243.12 xbv00162.vdf 8.11.243.12 xbv00163.vdf 8.11.243.12 xbv00164.vdf 8.11.243.12 xbv00165.vdf 8.11.243.12 xbv00166.vdf 8.11.243.12 xbv00167.vdf 8.11.243.12 xbv00168.vdf 8.11.243.12 xbv00169.vdf 8.11.243.12 xbv00170.vdf 8.11.243.12 xbv00171.vdf 8.11.243.12 xbv00172.vdf 8.11.243.12 xbv00173.vdf 8.11.243.12 xbv00174.vdf 8.11.243.12 xbv00175.vdf 8.11.243.12 xbv00176.vdf 8.11.243.12 xbv00177.vdf 8.11.243.12 xbv00178.vdf 8.11.243.12 xbv00179.vdf 8.11.243.12 xbv00180.vdf 8.11.243.12 xbv00181.vdf 8.11.243.12 xbv00182.vdf 8.11.243.12 xbv00183.vdf 8.11.243.12 xbv00184.vdf 8.11.243.12 xbv00185.vdf 8.11.243.12 xbv00186.vdf 8.11.243.12 xbv00187.vdf 8.11.243.12 xbv00188.vdf 8.11.243.12 xbv00189.vdf 8.11.243.12 xbv00190.vdf 8.11.243.12 xbv00191.vdf 8.11.243.12 xbv00192.vdf 8.11.243.12 xbv00193.vdf 8.11.243.12 xbv00194.vdf 8.11.243.12 xbv00195.vdf 8.11.243.12 xbv00196.vdf 8.11.243.12 xbv00197.vdf 8.11.243.12 xbv00198.vdf 8.11.243.12 xbv00199.vdf 8.11.243.12 xbv00200.vdf 8.11.243.12 xbv00201.vdf 8.11.243.12 xbv00202.vdf 8.11.243.12 xbv00203.vdf 8.11.243.12 xbv00204.vdf 8.11.243.12 xbv00205.vdf 8.11.243.12 xbv00206.vdf 8.11.243.12 xbv00207.vdf 8.11.243.12 xbv00208.vdf 8.11.243.12 xbv00209.vdf 8.11.243.12 xbv00210.vdf 8.11.243.12 xbv00211.vdf 8.11.243.12 xbv00212.vdf 8.11.243.12 xbv00213.vdf 8.11.243.12 xbv00214.vdf 8.11.243.12 xbv00215.vdf 8.11.243.12 xbv00216.vdf 8.11.243.12 xbv00217.vdf 8.11.243.12 xbv00218.vdf 8.11.243.12 xbv00219.vdf 8.11.243.12 xbv00220.vdf 8.11.243.12 xbv00221.vdf 8.11.243.12 xbv00222.vdf 8.11.243.12 xbv00223.vdf 8.11.243.12 xbv00224.vdf 8.11.243.12 xbv00225.vdf 8.11.243.12 xbv00226.vdf 8.11.243.12 xbv00227.vdf 8.11.243.12 xbv00228.vdf 8.11.243.12 xbv00229.vdf 8.11.243.12 xbv00230.vdf 8.11.243.12 xbv00231.vdf 8.11.243.12 xbv00232.vdf 8.11.243.12 xbv00233.vdf 8.11.243.12 xbv00234.vdf 8.11.243.12 xbv00235.vdf 8.11.243.12 xbv00236.vdf 8.11.243.12 xbv00237.vdf 8.11.243.12 xbv00238.vdf 8.11.243.12 xbv00239.vdf 8.11.243.12 xbv00240.vdf 8.11.243.12 xbv00241.vdf 8.11.243.12 xbv00242.vdf 8.11.243.12 xbv00243.vdf 8.11.243.12 xbv00244.vdf 8.11.243.12 xbv00245.vdf 8.11.243.12 xbv00246.vdf 8.11.243.12 xbv00247.vdf 8.11.243.12 xbv00248.vdf 8.11.243.12 xbv00249.vdf 8.11.243.12 xbv00250.vdf 8.11.243.12 xbv00251.vdf 8.11.243.12 xbv00252.vdf 8.11.243.12 xbv00253.vdf 8.11.243.12 xbv00254.vdf 8.11.243.12 xbv00255.vdf 8.11.243.12 local000.vdf repair.rdf 1.0.8.58 01.07.2015 18:45 [Planer] Auftrag gestartet Auftrag "update_after_installation" wurde erfolgreich gestartet. 01.07.2015 18:45 [Planer] Auftrag gestartet Auftrag "AVRunFact" wurde erfolgreich gestartet. 01.07.2015 18:45 [Planer] Dienst gestartet Der Dienst wurde gestartet. Dienst Version 15.0.11.572 01.07.2015 18:45 [Echtzeit-Scanner] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.572 Engine Version: VDF Version: 01.07.2015 18:45 [Hilfsdienst] Dienst gestartet Der Dienst wurde gestartet. Dienst Version: 15.0.11.550 Engine Version: 8.3.30.48 VDF Version: 8.11.241.22 Code:
ATTFilter can result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01
Ran by Julia (administrator) on JULIA-PC on 02-07-2015 00:59:10
Running from C:\Users\Julia\Downloads
Loaded Profiles: Julia (Available Profiles: Julia)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Foxit Software Inc.) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Spotify Ltd) C:\Users\Julia\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
() C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\SysWOW64\ResStub.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Spotify Ltd) C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_194.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_18_0_0_194.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2012-03-01] (Conexant Systems, Inc.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-09-27] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [792224 2012-02-09] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2012-02-09] (Atheros Commnucations)
HKLM\...\Run: [EPSON Stylus DX4200 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIAEE.EXE [98304 2005-03-08] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [618496 2010-06-08] ()
HKLM-x32\...\Run: [PONS-CD 7] => C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe [5878272 2012-02-02] ()
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [730416 2015-06-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [SDP] => C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe [201808 2012-10-03] (Somoto)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31683168 2015-03-25] (Skype Technologies S.A.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Spotify Web Helper] => C:\Users\Julia\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030648 2015-07-01] (Spotify Ltd)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Spotify] => C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe [7504952 2015-07-01] (Spotify Ltd)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\MountPoints2: {94bcc585-5993-11e2-9b10-b888e371e02e} - E:\HTC_Sync_Manager_PC.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2012-10-23]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2315325413-3490006923-2595072304-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2315325413-3490006923-2595072304-1000 -> {DAB18780-E65A-4B2C-87F9-4EC4656C82E0} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=AB29193D-1CF7-45A9-92C4-0D2B09C2EF33&apn_sauid=71D72AD8-1AF7-4D18-BF69-DACB0A7F6834
BHO: No Name -> {4D594333-0076-A76A-76A7-7A786E7484D7} -> No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-01] (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-02-09] (Atheros Commnucations)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-01] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2315325413-3490006923-2595072304-1000 -> No Name - {4D594333-0076-A76A-76A7-7A786E7484D7} - No File
Toolbar: HKU\S-1-5-21-2315325413-3490006923-2595072304-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{32A3E2A2-1273-4378-AFEA-5A8F708D706A}: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Google
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-07-01] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-11-18] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-01] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-2315325413-3490006923-2595072304-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\user.js [2015-06-02]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF SearchPlugin: C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\searchplugins\ask-search.xml [2013-06-07]
FF SearchPlugin: C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\searchplugins\askcom.xml [2013-04-25]
FF Extension: Avira Browser Safety - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\Extensions\abs@avira.com [2015-05-28]
FF Extension: Print pages to PDF - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\Extensions\printPages2Pdf@reinhold.ripper [2015-06-01]
FF Extension: No Name - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\Extensions\trash [2015-06-01]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [827184 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1188360 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [106144 2012-02-09] (Atheros Commnucations) [File not signed]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244448 2014-10-28] (Foxit Software Inc.)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2012-02-09] (Atheros) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-16] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-06-16] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [29696 2012-10-11] (ManyCam LLC)
S2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-09-11] (Samsung Electronics)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-02 00:59 - 2015-07-02 00:59 - 00017027 _____ C:\Users\Julia\Downloads\FRST.txt
2015-07-02 00:57 - 2015-07-02 00:59 - 00000000 ____D C:\FRST
2015-07-02 00:56 - 2015-07-02 00:56 - 02112512 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe
2015-07-02 00:47 - 2015-07-02 00:47 - 00032382 _____ C:\Users\Julia\Desktop\Ereignisse.txt
2015-07-01 19:20 - 2015-07-01 19:21 - 00000000 ____D C:\Users\Julia\AppData\Local\Adobe
2015-07-01 19:18 - 2015-07-01 19:18 - 00562784 _____ (Oracle Corporation) C:\Users\Julia\Downloads\jre-8u45-windows-i586-iftw.exe
2015-07-01 18:46 - 2015-07-01 18:46 - 00003432 _____ C:\Windows\System32\Tasks\Avira Browser Safety Updater Task
2015-07-01 18:45 - 2015-07-01 18:45 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Avira
2015-07-01 18:44 - 2015-06-16 09:36 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-07-01 18:40 - 2015-07-01 18:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-01 18:40 - 2015-07-01 18:40 - 00001196 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-01 18:40 - 2015-07-01 18:40 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-01 18:39 - 2015-07-01 18:39 - 04718584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Julia\Downloads\avira_de_av_556df0eb278e9__ws.exe
2015-06-30 16:20 - 2015-06-30 16:21 - 00000000 ____D C:\Users\Julia\Desktop\Neuer Ordner (2)
2015-06-29 10:05 - 2015-06-29 10:23 - 00000000 ____D C:\Users\Julia\Desktop\Neuer Ordner
2015-06-26 07:48 - 2015-06-26 07:48 - 00000000 ____D C:\Users\Julia\Documents\spiel
2015-06-22 09:14 - 2015-06-22 09:14 - 00013380 ____H C:\Users\Julia\Desktop\~WRL2861.tmp
2015-06-16 21:00 - 2015-07-01 13:08 - 00000000 ____D C:\Users\Julia\Desktop\praxissemester
2015-06-16 20:59 - 2015-06-16 21:01 - 00000000 ____D C:\Users\Julia\Desktop\bewerbung
2015-06-10 17:03 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 17:03 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 17:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 17:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 17:03 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 17:03 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 17:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 17:03 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 17:03 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 17:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 17:03 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 17:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 17:03 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 17:03 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 17:03 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 17:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 17:03 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 17:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 17:03 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 17:03 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 17:03 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 17:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 17:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 17:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 17:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 17:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 17:03 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 17:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 17:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 17:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 17:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 17:03 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 17:03 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 17:03 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 17:03 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 17:03 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 17:03 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 17:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 17:03 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 17:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 17:03 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 17:03 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 17:03 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 17:03 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 17:03 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 17:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 17:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 17:03 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 17:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 17:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 17:03 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 17:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 17:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 17:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 17:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 17:02 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 17:02 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 17:02 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 17:02 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 17:02 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 17:02 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 17:02 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 17:02 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 17:02 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 17:02 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 17:02 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 17:02 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 17:02 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 17:02 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 17:02 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 17:02 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 17:02 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 17:02 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 17:02 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 17:02 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 17:02 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 17:02 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 17:02 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 17:01 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 17:01 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 17:01 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 17:01 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 17:01 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 17:01 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 17:01 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 17:01 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 17:01 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 17:01 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 17:01 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 17:01 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 17:01 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-05 22:56 - 2015-06-18 00:07 - 00104237 _____ C:\Users\Julia\Documents\Los islamistas en Europa.pptx
2015-06-04 23:35 - 2015-06-04 23:35 - 00002231 _____ C:\Users\Julia\Desktop\Kindle.lnk
2015-06-04 23:34 - 2015-06-04 23:34 - 40891792 _____ (Amazon.com) C:\Users\Julia\Downloads\KindleForPC-installer.exe
2015-06-03 12:55 - 2015-06-03 13:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 21:28 - 2015-06-02 21:28 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2015-06-02 21:17 - 2015-06-02 21:17 - 01775424 _____ (Kaspersky Lab) C:\Users\Julia\Downloads\kav15.0.2.361de_7540.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-02 00:57 - 2012-10-05 16:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-01 23:56 - 2009-07-14 06:45 - 00029120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-01 23:56 - 2009-07-14 06:45 - 00029120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-01 23:54 - 2014-12-11 17:27 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Spotify
2015-07-01 23:52 - 2012-09-26 03:33 - 01133548 _____ C:\Windows\WindowsUpdate.log
2015-07-01 23:49 - 2015-02-09 14:13 - 00000000 ____D C:\Users\Julia\AppData\Local\Spotify
2015-07-01 23:47 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-01 23:47 - 2009-07-14 06:51 - 00153449 _____ C:\Windows\setupact.log
2015-07-01 21:49 - 2010-11-21 05:47 - 00543916 _____ C:\Windows\PFRO.log
2015-07-01 19:31 - 2015-04-16 21:54 - 00000000 ____D C:\Users\Julia\Desktop\GRAMATICA soluciones
2015-07-01 19:31 - 2014-12-17 20:12 - 00000000 ____D C:\Users\Julia\Desktop\übersetzungen soluciones
2015-07-01 19:30 - 2013-12-12 19:45 - 00000000 ____D C:\Users\Julia\AppData\Roaming\IrfanView
2015-07-01 19:22 - 2014-10-15 17:00 - 00000000 ____D C:\Program Files (x86)\Java
2015-07-01 19:22 - 2013-10-23 19:27 - 00000000 ____D C:\ProgramData\Oracle
2015-07-01 19:21 - 2012-10-05 16:57 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-01 19:21 - 2012-10-05 16:57 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-01 19:21 - 2012-10-05 16:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-01 19:19 - 2014-10-15 17:00 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-07-01 18:46 - 2012-09-27 22:31 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-01 18:44 - 2012-09-27 22:31 - 00000000 ____D C:\ProgramData\Avira
2015-07-01 11:32 - 2012-10-13 11:08 - 00000000 ____D C:\Users\Julia\AppData\Local\CrashDumps
2015-06-30 21:58 - 2011-04-12 09:43 - 00699682 _____ C:\Windows\system32\perfh007.dat
2015-06-30 21:58 - 2011-04-12 09:43 - 00149790 _____ C:\Windows\system32\perfc007.dat
2015-06-30 21:58 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-30 15:47 - 2012-10-05 14:18 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Skype
2015-06-26 07:48 - 2015-05-08 00:15 - 00000000 ____D C:\Users\Julia\Desktop\aufgaben testimonio
2015-06-22 23:36 - 2015-04-28 16:47 - 00000000 ____D C:\Users\Julia\Desktop\wortarten ausarbeitungen
2015-06-21 12:21 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 23:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 21:34 - 2013-07-09 10:46 - 01292288 ___SH C:\Users\Julia\Thumbs.db
2015-06-11 21:33 - 2015-05-31 16:40 - 00000000 ____D C:\Users\Julia\kk
2015-06-11 21:33 - 2012-09-27 03:41 - 00000000 ____D C:\Users\Julia
2015-06-11 06:54 - 2009-07-14 06:45 - 00418568 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 06:51 - 2014-12-11 11:16 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 06:51 - 2014-05-06 13:35 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 06:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 00:12 - 2012-10-03 14:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 00:07 - 2013-07-18 15:24 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 00:02 - 2012-11-05 09:50 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-06 19:03 - 2012-10-20 17:11 - 00000000 ____D C:\Users\Julia\Documents\TmForever
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\Documents\My Kindle Content
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\AppData\Local\Amazon
2015-06-03 13:08 - 2012-10-16 10:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
Some files in TEMP:
====================
C:\Users\Julia\AppData\Local\Temp\APNSetup.exe
C:\Users\Julia\AppData\Local\Temp\APNStub.exe
C:\Users\Julia\AppData\Local\Temp\AskSLib.dll
C:\Users\Julia\AppData\Local\Temp\avgnt.exe
C:\Users\Julia\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE
C:\Users\Julia\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Julia\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Julia\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Julia\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Julia\AppData\Local\Temp\setup.exe
C:\Users\Julia\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Julia\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Julia\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Julia\AppData\Local\Temp\_is7D88.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 20:25
==================== End of log ============================
FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01
Ran by Julia at 2015-07-02 01:00:13
Running from C:\Users\Julia\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2315325413-3490006923-2595072304-500 - Administrator - Disabled)
Gast (S-1-5-21-2315325413-3490006923-2595072304-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2315325413-3490006923-2595072304-1002 - Limited - Enabled)
Julia (S-1-5-21-2315325413-3490006923-2595072304-1000 - Administrator - Enabled) => C:\Users\Julia
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.12.36 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.9.9 - Atheros Communications Inc.)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.3.0.150 - Atheros Communications)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.34.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - )
FilesFrog Update Checker (HKLM-x32\...\FilesFrog Update Checker) (Version: - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.3.25.1124 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)
Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2656 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.11.1206.1 - Vimicro)
Lenovo pointing device (HKLM\...\Elantech) (Version: 10.4.2.8 - ELAN Microelectronic Corp.)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Paragon Software PONS-CD 7 (HKLM-x32\...\Paragon Software PONS-CD 7) (Version: - )
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Radio.fx (HKLM-x32\...\Tobit Radio.fx Server) (Version: - Tobit.Software)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39016 - Realtek Semiconductor Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Spotify) (Version: 1.0.8.59.gee82e7e6 - Spotify AB)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version: - Nadeo)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Wartung Samsung CLP-320 Series (HKLM-x32\...\Samsung CLP-320 Series) (Version: - Samsung Electronics Co., Ltd.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
23-06-2015 13:12:29 Windows Update
26-06-2015 21:45:40 Windows Update
30-06-2015 14:38:08 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {559A1B5A-A01E-44EA-97F6-7033A89E9DF4} - System32\Tasks\{48907F76-35F5-4A62-B747-6576A7E7BC97} => pcalua.exe -a "C:\Drivers\Camera Driver (Bison, Chicony)\Bison\1.12.204.1\setup.exe" -d "C:\Drivers\Camera Driver (Bison, Chicony)\Bison\1.12.204.1"
Task: {63EA8F3F-476D-4AF7-A2C1-0FCF961C922F} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG)
Task: {64CC8197-532D-4EFF-A614-65467CE4A1AD} - System32\Tasks\{2A411514-1A08-4A80-8B45-E13B6664067C} => pcalua.exe -a C:\Users\Julia\Downloads\0zca03ww(1).exe -d C:\Users\Julia\Downloads
Task: {64EDACA4-2CEE-4313-BC5F-F8C0F75DF0A1} - System32\Tasks\{389A87CB-3803-4BA7-A587-AD1C056AA250} => pcalua.exe -a C:\Users\Julia\Downloads\epson375782eu(1).exe -d C:\Users\Julia\Downloads
Task: {722CA4F6-3A7E-4275-9284-56D44566E93F} - System32\Tasks\{EE2FE40A-CD69-461B-AF47-4C23E666A395} => pcalua.exe -a "C:\Drivers\Camera Driver (Bison, Chicony)\Setup.exe" -d "C:\Drivers\Camera Driver (Bison, Chicony)"
Task: {9D303FBC-19CC-4407-8C4D-47AEEAE2FC53} - System32\Tasks\{798C46A0-5F80-47B7-8A05-4361B72769F8} => pcalua.exe -a C:\Users\Julia\Downloads\0zca03ww.exe -d C:\Users\Julia\Downloads
Task: {BDEA842A-DDEA-4FA4-BC67-93702F897FC0} - System32\Tasks\{E4FC5148-0476-4098-9AC6-CDDEA6913E1C} => pcalua.exe -a C:\Users\Julia\Downloads\vpnclient-win-msi-5.0.07.0290-k9\vpnclient_setup.exe -d C:\Users\Julia\Downloads\vpnclient-win-msi-5.0.07.0290-k9
Task: {D0D7D87B-C13C-48F4-BD4B-1F96D6495628} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {E4B8E261-7322-486E-9C5C-AFAD337EECF4} - System32\Tasks\{8E5AAD55-B9B0-4E95-8D63-07B0A6FED3A7} => pcalua.exe -a C:\Users\Julia\Downloads\epson375776eu(1).exe -d C:\Users\Julia\Downloads
Task: {FBB3DFD8-C425-4F47-ABEC-6269745B27BE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-01] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2013-01-01 22:03 - 2009-09-12 02:48 - 00027648 _____ () C:\Windows\System32\sst3cl6.dll
2012-10-05 16:09 - 2013-06-03 13:06 - 03999512 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
2008-12-20 03:20 - 2012-09-27 22:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2012-09-27 22:02 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2012-09-27 22:02 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2012-09-27 22:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-09-27 22:04 - 2012-02-17 18:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 20:50 - 2013-05-22 20:50 - 00400704 _____ () C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2013-01-01 22:03 - 2010-06-08 05:15 - 00618496 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2012-02-02 15:17 - 2012-02-02 15:17 - 05878272 _____ () C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe
2009-10-09 16:08 - 2009-10-09 16:08 - 00125952 _____ () C:\Windows\SysWOW64\ResStub.exe
2013-01-01 22:03 - 2009-09-30 23:51 - 00306688 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2010-03-23 13:26 - 2010-03-23 13:26 - 00201512 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-10-05 16:09 - 2013-06-03 13:06 - 09907712 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\TOBITCLT.dll
2012-10-05 16:09 - 2013-05-16 14:28 - 00242688 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client$.ger
2015-03-08 10:28 - 2015-07-01 18:37 - 41287224 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libcef.dll
2012-01-19 12:35 - 2012-01-19 12:35 - 00479744 _____ () C:\Program Files (x86)\Paragon Software\PONS\Engine.dll
2012-01-19 12:35 - 2012-01-19 12:35 - 00124928 _____ () C:\Program Files (x86)\Paragon Software\PONS\morphology.dll
2006-11-27 20:26 - 2006-11-27 20:26 - 04349952 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtGui4.dll
2007-09-12 13:44 - 2007-09-12 13:44 - 01191936 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtCore4.dll
2006-11-27 20:20 - 2006-11-27 20:20 - 00172032 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtXml4.dll
2006-11-27 20:31 - 2006-11-27 20:31 - 00225280 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtNetwork4.dll
2006-11-27 20:38 - 2006-11-27 20:38 - 00032768 _____ () C:\Program Files (x86)\Paragon Software\PONS\iconengines\qsvg1.dll
2006-11-27 20:32 - 2006-11-27 20:32 - 00172032 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtSvg4.dll
2015-03-08 10:28 - 2015-07-01 18:37 - 01488440 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libglesv2.dll
2015-03-08 10:28 - 2015-07-01 18:37 - 00079928 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libegl.dll
2015-03-08 10:28 - 2015-03-23 11:03 - 09305656 _____ () C:\Users\Julia\AppData\Roaming\Spotify\pdf.dll
2014-10-15 19:22 - 2014-10-15 19:22 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-09-27 22:05 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{6AC23DF8-D5F3-496D-AC25-0BD74A4FB75B}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{F60E3CEA-5E09-4E3A-BF5E-70879A8051EE}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{2D1DE809-C988-40FA-85F1-787A7ACE763F}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [{97BF04EE-237C-4E5E-B4AF-6ACA6C1B06AD}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [TCP Query User{9036CA5E-8D33-4BAA-AEC0-51EC8170E799}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{F4F453BA-8FEE-4ADE-BCB6-84D530192F15}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [TCP Query User{099995C7-6BF4-4DDB-BC84-E06FBC5AF16B}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{FF3ACC0F-DF94-448D-B562-3360936CC67A}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [TCP Query User{DC30C68F-B1A0-4A7B-AAFF-B5925A216BEF}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{D16445F7-98E2-420C-BA74-9578153DEFDA}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{2FED4120-015A-440A-AAF6-5C5EDDC9C43F}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{62D8752E-F7D8-43C3-85D1-7ADB8A167C34}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{87FB96AD-FCC9-4324-839A-BDE805C06E95}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{FB604C08-60A3-46B4-8E3E-2768EF2C5DEB}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [{4FB68F9C-1CD4-4196-8E93-0E0F6F30D740}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{22B7B5AB-6895-4EA6-82E6-2B427F68A6B6}] => (Allow) LPort=2869
FirewallRules: [{32C563D4-5807-4420-9B3A-E9BB77CA263A}] => (Allow) LPort=1900
FirewallRules: [{4A4D60D2-1D5B-4C50-A854-92869D732645}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{DE0A2BD3-D7EA-4289-9374-A3046D932350}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AAC656B1-43E4-4094-842C-198837260FB7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5FA5283C-B44B-4BEE-A19B-B7C277C3C245}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B27CF9D3-B837-47ED-9CE3-DFD9387FCE72}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: GT-S7562
Description: GT-S7562
Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Manufacturer: SAMSUNG Electronics Co. Ltd.
Service: WUDFRd
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/01/2015 11:49:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 10:37:13 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: ERROR: Not enough free disk space
Error: (07/01/2015 09:51:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 06:33:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 05:17:43 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 11:32:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.5.5623, Zeitstempel: 0x5563c49a
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.5.5623, Zeitstempel: 0x5563b229
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x28c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/01/2015 11:32:08 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.5.5623, Zeitstempel: 0x5563c49a
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.5.5623, Zeitstempel: 0x5563b229
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1ab4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/01/2015 11:31:55 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 38.0.5.5623, Zeitstempel: 0x5563c49a
Name des fehlerhaften Moduls: mozalloc.dll, Version: 38.0.5.5623, Zeitstempel: 0x5563b229
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x166c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (07/01/2015 11:21:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/30/2015 09:14:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/01/2015 11:47:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 11:47:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 11:47:36 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (07/01/2015 09:50:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 09:50:11 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 09:50:04 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (07/01/2015 06:31:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 06:31:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 05:16:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/01/2015 05:16:06 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Microsoft Office:
=========================
Error: (05/16/2015 05:26:51 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6720.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time. This session ended with a crash.
Error: (03/11/2015 09:37:51 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6715.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 309 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU B970 @ 2.30GHz
Percentage of memory in use: 41%
Total physical RAM: 3993.28 MB
Available physical RAM: 2320.11 MB
Total Pagefile: 7984.77 MB
Available Pagefile: 5866.73 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.54 GB) (Free:389.9 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: C3FFC3FF)
Partition: GPT Partition Type.
==================== End of log ============================
|
|
02.07.2015, 08:23
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 Adware/Junkware/Toolbars entfernen 1. Schritt: Malwarebytes Downloade Dir bitte  Malwarebytes Anti-Malware
(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 2. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
3. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
4. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
02.07.2015, 18:35
| #5 |
| | Avira meldet Pua Somoto Gen 2 So alles erledigt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 02.07.2015 Suchlaufzeit: 18:20 Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.02.03 Rootkit-Datenbank: v2015.07.01.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julia Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 389077 Abgelaufene Zeit: 22 Min., 22 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 5 PUP.Optional.APNToolBar.Gen, HKU\S-1-5-18\SOFTWARE\AskPartnerNetwork, In Quarantäne, [25d6f3e903871f1702bf877456adef11], PUP.Optional.Somoto.A, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\Somoto, In Quarantäne, [fdfea8341476cc6a8915e637e81cbc44], PUP.Optional.Ask.A, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{DAB18780-E65A-4B2C-87F9-4EC4656C82E0}, In Quarantäne, [9e5d7567d4b6c6708235e3b48f766799], PUP.Optional.Somoto.A, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\SOMOTO\SDP, In Quarantäne, [b5466379fc8e42f445bba0c5e02535cb], PUP.Optional.FilesFrog.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FilesFrog Update Checker, In Quarantäne, [e61565776921e94dcb8304c925dec63a], Registrierungswerte: 4 PUP.Optional.Ask.A, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{DAB18780-E65A-4B2C-87F9-4EC4656C82E0}|URL, hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^DE&apn_uid=AB29193D-1CF7-45A9-92C4-0D2B09C2EF33&apn_sauid=71D72AD8-1AF7-4D18-BF69-DACB0A7F6834, In Quarantäne, [9e5d7567d4b6c6708235e3b48f766799] PUP.Optional.FilesFrog, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SDP, C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe /auto , In Quarantäne, [3dbe2ab2b1d9b87eaa3de093848104fc] PUP.Optional.FilesFrog, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SDP, C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe /auto , In Quarantäne, [3dbe2ab2b1d9b87eaa3de093848104fc] PUP.Optional.Somoto.A, HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\SOFTWARE\SOMOTO\SDP|affid, downloadsourcede, In Quarantäne, [b5466379fc8e42f445bba0c5e02535cb] Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 2 PUP.Optional.FilesFrog.A, C:\Program Files (x86)\FilesFrog Update Checker, In Quarantäne, [e61565776921e94dcb8304c925dec63a], PUP.Optional.APNToolBar.Gen, C:\ProgramData\APN\APN-Stub, In Quarantäne, [9d5ea23ab7d387afe21b24d407fcf010], Dateien: 6 PUP.Optional.APNToolBar.A, C:\Users\Julia\AppData\Local\Temp\APNSetup.exe, In Quarantäne, [6f8c8d4fcfbb3afc87c3333240c206fa], PUP.Optional.FilesFrog.A, C:\Users\Julia\AppData\Local\Temp\Temporary Internet Files\Content.IE5\Z26G314Y\sdpupdater[1].exe, In Quarantäne, [d62599438505ab8b84c7ff2609f7b64a], PUP.Optional.APNToolBar.A, C:\Users\Julia\Documents\APNSetup.exe, In Quarantäne, [05f6b12b63274cead1791f46ee143ec2], PUP.Optional.FilesFrog, C:\Program Files (x86)\FilesFrog Update Checker\update_checker.exe, In Quarantäne, [3dbe2ab2b1d9b87eaa3de093848104fc], PUP.Optional.FilesFrog.A, C:\Program Files (x86)\FilesFrog Update Checker\uninstall.exe, In Quarantäne, [e61565776921e94dcb8304c925dec63a], PUP.Optional.AskAPN.Gen, C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\searchplugins\ask-search.xml, In Quarantäne, [7b80f4e8f595fb3b7975b2dfcf3704fc], Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.207 - Bericht erstellt 02/07/2015 um 19:05:28
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-07-02.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Julia - JULIA-PC
# Gestarted von : C:\Users\Julia\Downloads\AdwCleaner_4.207.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : mcaudrv_simple
[#] Dienst Gelöscht : ManyCam
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Tobit
Ordner Gelöscht : C:\Users\Julia\AppData\Local\Temp\apn
Ordner Gelöscht : C:\Users\Julia\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Julia\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Julia\AppData\Roaming\Tobit
[x] Nicht Gelöscht : C:\Windows\System32\drivers\mcaudrv_x64.sys
Datei Gelöscht : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\user.js
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SDP
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\SOFTWARE\PIP
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\apnwidgets.ask.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\ask.com
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Mozilla Firefox v38.0.5 (x86 de)
[7bq8jojx.default\prefs.js] - Zeile Gelöscht : user_pref("browser.search.hiddenOneOffs", "Ask Search,Ask.com,DuckDuckGo");
*************************
AdwCleaner[R0].txt - [2300 Bytes] - [02/07/2015 19:00:04]
AdwCleaner[S0].txt - [2145 Bytes] - [02/07/2015 19:05:28]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2204 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.2.7 (07.02.2015:2)
OS: Windows 7 Home Premium x64
Ran by Julia on 02.07.2015 at 19:18:14,23
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{4D594333-0076-A76A-76A7-7A786E7484D7}
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{c3c77255-42c0-499f-b664-6e981a0b1647}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3c77255-42c0-499f-b664-6e981a0b1647}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c3c77255-42c0-499f-b664-6e981a0b1647}
~~~ Files
~~~ Folders
~~~ FireFox
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 02.07.2015 at 19:21:13,20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01
Ran by Julia (administrator) on JULIA-PC on 02-07-2015 19:27:17
Running from C:\Users\Julia\Downloads
Loaded Profiles: Julia (Available Profiles: Julia)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avcenter.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Farbar) C:\Users\Julia\Downloads\FRST64(1).exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [564352 2012-03-01] (Conexant Systems, Inc.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2012-09-27] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6199128 2012-09-27] (Lenovo(beijing) Limited)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2809856 2012-01-16] (ELAN Microelectronics Corp.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [792224 2012-02-09] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2012-02-09] (Atheros Commnucations)
HKLM\...\Run: [EPSON Stylus DX4200 Series] => C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIAEE.EXE [98304 2005-03-08] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331_STI.EXE [548864 2011-11-24] (Vimicro)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\ssmmgr.exe [618496 2010-06-08] ()
HKLM-x32\...\Run: [PONS-CD 7] => C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe [5878272 2012-02-02] ()
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [193568 2014-11-28] (Geek Software GmbH)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-06-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [730416 2015-06-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [rfxsrvtray] => C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe [1838872 2013-02-07] (Tobit.Software)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31683168 2015-03-25] (Skype Technologies S.A.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Spotify Web Helper] => C:\Users\Julia\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2030648 2015-07-01] (Spotify Ltd)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Run: [Spotify] => C:\Users\Julia\AppData\Roaming\Spotify\Spotify.exe [7504952 2015-07-01] (Spotify Ltd)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\MountPoints2: {94bcc585-5993-11e2-9b10-b888e371e02e} - E:\HTC_Sync_Manager_PC.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2012-10-23]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{467D5E81-8349-4892-9E81-C3674ED8E451}\Icon09DB8A851.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name -> {4D594333-0076-A76A-76A7-7A786E7484D7} -> No File
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-01] (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2012-02-09] (Atheros Commnucations)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-01] (Oracle Corporation)
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{32A3E2A2-1273-4378-AFEA-5A8F708D706A}: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default
FF SearchEngineOrder.1: Ask Search
FF SelectedSearchEngine: Google
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_194.dll [2015-07-01] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_194.dll [2015-07-01] ()
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2014-11-18] (Foxit Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-07-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-01] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-2315325413-3490006923-2595072304-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll [2013-05-22] (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Extension: Avira Browser Safety - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\Extensions\abs@avira.com [2015-07-02]
FF Extension: Print pages to PDF - C:\Users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\7bq8jojx.default\Extensions\printPages2Pdf@reinhold.ripper [2015-06-01]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [827184 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [450808 2015-06-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1188360 2015-06-16] (Avira Operations GmbH & Co. KG)
S2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [106144 2012-02-09] (Atheros Commnucations) [File not signed]
S2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [217280 2015-06-02] (Avira Operations GmbH & Co. KG)
S2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [244448 2014-10-28] (Foxit Software Inc.)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2012-02-09] (Atheros) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-16] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-16] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-06-16] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-06-16] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [304784 2010-03-23] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S2 SSPORT; C:\Windows\SysWOW64\Drivers\SSPORT.sys [11576 2009-09-11] (Samsung Electronics)
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [952832 2011-12-06] (Vimicro Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-02 19:26 - 2015-07-02 19:26 - 02112512 _____ (Farbar) C:\Users\Julia\Downloads\FRST64(1).exe
2015-07-02 19:21 - 2015-07-02 19:21 - 00001237 _____ C:\Users\Julia\Desktop\JRT.txt
2015-07-02 19:18 - 2015-07-02 19:18 - 00000207 _____ C:\Windows\tweaking.com-regbackup-JULIA-PC-Windows-7-Home-Premium-(64-bit).dat
2015-07-02 19:18 - 2015-07-02 19:18 - 00000000 ____D C:\RegBackup
2015-07-02 19:15 - 2015-07-02 19:16 - 02951023 _____ (Malwarebytes Corporation) C:\Users\Julia\Downloads\JRT(1).exe
2015-07-02 19:13 - 2015-07-02 19:14 - 02951023 _____ (Malwarebytes Corporation) C:\Users\Julia\Downloads\JRT.exe
2015-07-02 19:08 - 2015-07-02 19:08 - 00002284 _____ C:\Users\Julia\Desktop\AdwCleaner[S0].txt
2015-07-02 18:59 - 2015-07-02 19:05 - 00000000 ____D C:\AdwCleaner
2015-07-02 18:58 - 2015-07-02 18:58 - 02244096 _____ C:\Users\Julia\Downloads\AdwCleaner_4.207.exe
2015-07-02 18:54 - 2015-07-02 18:54 - 00004070 _____ C:\Users\Julia\Desktop\mbam.txt
2015-07-02 18:18 - 2015-07-02 18:51 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-02 18:17 - 2015-07-02 18:19 - 00001106 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-02 18:17 - 2015-07-02 18:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-02 18:17 - 2015-07-02 18:19 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-02 18:17 - 2015-07-02 18:17 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-02 18:17 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-02 18:17 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-02 18:17 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-02 18:16 - 2015-07-02 18:57 - 00000419 _____ C:\Users\Julia\Desktop\Neues Textdokument.txt
2015-07-02 18:14 - 2015-07-02 18:14 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Julia\Downloads\mbam-setup-2.1.6.1022.exe
2015-07-02 01:00 - 2015-07-02 01:00 - 00027778 _____ C:\Users\Julia\Downloads\Addition.txt
2015-07-02 00:59 - 2015-07-02 19:27 - 00012723 _____ C:\Users\Julia\Downloads\FRST.txt
2015-07-02 00:57 - 2015-07-02 19:27 - 00000000 ____D C:\FRST
2015-07-02 00:56 - 2015-07-02 00:56 - 02112512 _____ (Farbar) C:\Users\Julia\Downloads\FRST64.exe
2015-07-02 00:47 - 2015-07-02 00:47 - 00032382 _____ C:\Users\Julia\Desktop\Ereignisse.txt
2015-07-01 19:20 - 2015-07-01 19:21 - 00000000 ____D C:\Users\Julia\AppData\Local\Adobe
2015-07-01 19:18 - 2015-07-01 19:18 - 00562784 _____ (Oracle Corporation) C:\Users\Julia\Downloads\jre-8u45-windows-i586-iftw.exe
2015-07-01 18:46 - 2015-07-01 18:46 - 00003432 _____ C:\Windows\System32\Tasks\Avira Browser Safety Updater Task
2015-07-01 18:45 - 2015-07-01 18:45 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Avira
2015-07-01 18:44 - 2015-06-16 09:36 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-07-01 18:44 - 2015-06-16 09:36 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-07-01 18:40 - 2015-07-01 18:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-01 18:40 - 2015-07-01 18:40 - 00001196 _____ C:\Users\Public\Desktop\Avira.lnk
2015-07-01 18:40 - 2015-07-01 18:40 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-01 18:39 - 2015-07-01 18:39 - 04718584 _____ (Avira Operations GmbH & Co. KG) C:\Users\Julia\Downloads\avira_de_av_556df0eb278e9__ws.exe
2015-06-30 16:20 - 2015-06-30 16:21 - 00000000 ____D C:\Users\Julia\Desktop\Neuer Ordner (2)
2015-06-29 10:05 - 2015-06-29 10:23 - 00000000 ____D C:\Users\Julia\Desktop\Neuer Ordner
2015-06-26 07:48 - 2015-06-26 07:48 - 00000000 ____D C:\Users\Julia\Documents\spiel
2015-06-22 09:14 - 2015-06-22 09:14 - 00013380 ____H C:\Users\Julia\Desktop\~WRL2861.tmp
2015-06-16 21:00 - 2015-07-01 13:08 - 00000000 ____D C:\Users\Julia\Desktop\praxissemester
2015-06-16 20:59 - 2015-06-16 21:01 - 00000000 ____D C:\Users\Julia\Desktop\bewerbung
2015-06-10 17:03 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 17:03 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 17:03 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 17:03 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 17:03 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 17:03 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 17:03 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 17:03 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 17:03 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 17:03 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 17:03 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 17:03 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 17:03 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 17:03 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 17:03 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 17:03 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 17:03 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 17:03 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 17:03 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 17:03 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 17:03 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 17:03 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 17:03 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 17:03 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 17:03 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 17:03 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 17:03 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 17:03 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 17:03 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 17:03 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 17:03 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 17:03 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 17:03 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 17:03 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 17:03 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 17:03 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 17:03 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 17:03 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 17:03 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 17:03 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 17:03 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 17:03 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 17:03 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 17:03 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 17:03 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 17:03 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 17:03 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 17:03 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 17:03 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 17:03 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 17:03 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 17:03 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 17:03 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 17:03 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 17:03 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 17:03 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 17:03 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 17:02 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 17:02 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 17:02 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 17:02 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 17:02 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 17:02 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 17:02 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 17:02 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 17:02 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 17:02 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 17:02 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 17:02 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 17:02 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 17:02 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 17:02 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 17:02 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 17:02 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 17:02 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 17:02 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 17:02 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 17:02 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 17:02 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 17:02 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 17:02 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 17:02 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 17:02 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 17:02 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 17:02 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 17:01 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 17:01 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 17:01 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 17:01 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 17:01 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 17:01 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 17:01 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 17:01 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 17:01 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 17:01 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 17:01 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 17:01 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 17:01 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 17:01 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 17:01 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 17:01 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 17:01 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 17:01 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-05 22:56 - 2015-06-18 00:07 - 00104237 _____ C:\Users\Julia\Documents\Los islamistas en Europa.pptx
2015-06-04 23:35 - 2015-06-04 23:35 - 00002231 _____ C:\Users\Julia\Desktop\Kindle.lnk
2015-06-04 23:34 - 2015-06-04 23:34 - 40891792 _____ (Amazon.com) C:\Users\Julia\Downloads\KindleForPC-installer.exe
2015-06-03 12:55 - 2015-06-03 13:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-02 21:28 - 2015-06-02 21:28 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2015-06-02 21:17 - 2015-06-02 21:17 - 01775424 _____ (Kaspersky Lab) C:\Users\Julia\Downloads\kav15.0.2.361de_7540.exe
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-02 19:16 - 2009-07-14 06:45 - 00029120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-02 19:16 - 2009-07-14 06:45 - 00029120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-02 19:12 - 2014-12-11 17:27 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Spotify
2015-07-02 19:07 - 2015-02-09 14:13 - 00000000 ____D C:\Users\Julia\AppData\Local\Spotify
2015-07-02 19:06 - 2010-11-21 05:47 - 00546718 _____ C:\Windows\PFRO.log
2015-07-02 19:06 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-02 19:06 - 2009-07-14 06:51 - 00153673 _____ C:\Windows\setupact.log
2015-07-02 19:05 - 2012-09-26 03:33 - 01193330 _____ C:\Windows\WindowsUpdate.log
2015-07-02 18:57 - 2012-10-05 16:57 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-07-02 18:46 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\Performance
2015-07-01 19:31 - 2015-04-16 21:54 - 00000000 ____D C:\Users\Julia\Desktop\GRAMATICA soluciones
2015-07-01 19:31 - 2014-12-17 20:12 - 00000000 ____D C:\Users\Julia\Desktop\übersetzungen soluciones
2015-07-01 19:30 - 2013-12-12 19:45 - 00000000 ____D C:\Users\Julia\AppData\Roaming\IrfanView
2015-07-01 19:22 - 2014-10-15 17:00 - 00000000 ____D C:\Program Files (x86)\Java
2015-07-01 19:22 - 2013-10-23 19:27 - 00000000 ____D C:\ProgramData\Oracle
2015-07-01 19:21 - 2012-10-05 16:57 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-01 19:21 - 2012-10-05 16:57 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-01 19:21 - 2012-10-05 16:57 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-01 19:19 - 2014-10-15 17:00 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-07-01 18:46 - 2012-09-27 22:31 - 00000000 ____D C:\Program Files (x86)\Avira
2015-07-01 18:44 - 2012-09-27 22:31 - 00000000 ____D C:\ProgramData\Avira
2015-07-01 11:32 - 2012-10-13 11:08 - 00000000 ____D C:\Users\Julia\AppData\Local\CrashDumps
2015-06-30 21:58 - 2011-04-12 09:43 - 00699682 _____ C:\Windows\system32\perfh007.dat
2015-06-30 21:58 - 2011-04-12 09:43 - 00149790 _____ C:\Windows\system32\perfc007.dat
2015-06-30 21:58 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-30 15:47 - 2012-10-05 14:18 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Skype
2015-06-26 07:48 - 2015-05-08 00:15 - 00000000 ____D C:\Users\Julia\Desktop\aufgaben testimonio
2015-06-22 23:36 - 2015-04-28 16:47 - 00000000 ____D C:\Users\Julia\Desktop\wortarten ausarbeitungen
2015-06-21 12:21 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 23:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-11 21:34 - 2013-07-09 10:46 - 01292288 ___SH C:\Users\Julia\Thumbs.db
2015-06-11 21:33 - 2015-05-31 16:40 - 00000000 ____D C:\Users\Julia\kk
2015-06-11 21:33 - 2012-09-27 03:41 - 00000000 ____D C:\Users\Julia
2015-06-11 06:54 - 2009-07-14 06:45 - 00418568 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 06:51 - 2014-12-11 11:16 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 06:51 - 2014-05-06 13:35 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 06:51 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 00:12 - 2012-10-03 14:49 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 00:07 - 2013-07-18 15:24 - 00000000 ____D C:\Windows\system32\MRT
2015-06-11 00:02 - 2012-11-05 09:50 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-06 19:03 - 2012-10-20 17:11 - 00000000 ____D C:\Users\Julia\Documents\TmForever
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\Documents\My Kindle Content
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Amazon
2015-06-04 23:35 - 2012-12-05 20:06 - 00000000 ____D C:\Users\Julia\AppData\Local\Amazon
2015-06-03 13:08 - 2012-10-16 10:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
Some files in TEMP:
====================
C:\Users\Julia\AppData\Local\Temp\APNStub.exe
C:\Users\Julia\AppData\Local\Temp\AskSLib.dll
C:\Users\Julia\AppData\Local\Temp\avgnt.exe
C:\Users\Julia\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE
C:\Users\Julia\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Julia\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Julia\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Julia\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Julia\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Julia\AppData\Local\Temp\Quarantine.exe
C:\Users\Julia\AppData\Local\Temp\setup.exe
C:\Users\Julia\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Julia\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Julia\AppData\Local\Temp\sqlite3.dll
C:\Users\Julia\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\Julia\AppData\Local\Temp\_is7D88.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-06-23 20:25
==================== End of log ============================
|
|
03.07.2015, 19:51
| #6 |
| | Avira meldet Pua Somoto Gen 2 Nur zur Vergewisserung, ist jetzt alles gelöscht? Passen die Ergebnisse? Vielen Dank schonmal. Avira meldet nichts mehr. LG |
|
03.07.2015, 19:57
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.07.2015, 20:17
| #8 |
| | Avira meldet Pua Somoto Gen 2 [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01
Ran by Julia at 2015-07-03 21:13:35
Running from C:\Users\Julia\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2315325413-3490006923-2595072304-500 - Administrator - Disabled)
Gast (S-1-5-21-2315325413-3490006923-2595072304-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2315325413-3490006923-2595072304-1002 - Limited - Enabled)
Julia (S-1-5-21-2315325413-3490006923-2595072304-1000 - Administrator - Enabled) => C:\Users\Julia
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.12.36 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.194 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.9.9 - Atheros Communications Inc.)
Avira (HKLM-x32\...\{8467e01f-0496-42ce-b247-88ef205b4880}) (Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.40.29239 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.579 - Avira Operations GmbH & Co. KG)
Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.3.0.150 - Atheros Communications)
Cisco Systems VPN Client 5.0.07.0290 (HKLM\...\{467D5E81-8349-4892-9E81-C3674ED8E451}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.34.0 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.11 - Dolby Laboratories Inc)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 7.0.3.4 - Lenovo)
Energy Management (x32 Version: 7.0.3.4 - Lenovo) Hidden
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )
EPSON-Drucker-Software (HKLM\...\EPSON Printer and Utilities) (Version: - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Foxit Cloud (HKLM-x32\...\{41914D8B-9D6E-4764-A1F9-BC43FB6782C1}_is1) (Version: 2.3.25.1124 - Foxit Software Inc.)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 7.0.6.1126 - Foxit Software Inc.)
Free YouTube to MP3 Converter version 3.12.54.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.54.128 - DVDVideoSoft Ltd.)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2656 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ecc-B6BD-9C31E51D0332}) (Version: 13.11.1206.1 - Vimicro)
Lenovo pointing device (HKLM\...\Elantech) (Version: 10.4.2.8 - ELAN Microelectronic Corp.)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme (HKLM-x32\...\{90120000-00B2-0407-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUS) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.5 (x86 de)) (Version: 38.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Paragon Software PONS-CD 7 (HKLM-x32\...\Paragon Software PONS-CD 7) (Version: - )
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Radio.fx (HKLM-x32\...\Tobit Radio.fx Server) (Version: - Tobit.Software)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39016 - Realtek Semiconductor Corp.)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\...\Spotify) (Version: 1.0.8.59.gee82e7e6 - Spotify AB)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version: - Nadeo)
TomTom HOME (HKLM-x32\...\{7A2BB1C8-903D-4585-9F3B-CADD67D07D37}) (Version: 2.9.8 - Ihr Firmenname)
TomTom HOME Visual Studio Merge Modules (HKLM-x32\...\{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}) (Version: 1.0.2 - TomTom International B.V.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROPLUS_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROPLUS_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROPLUS_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROPLUS_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
Wartung Samsung CLP-320 Series (HKLM-x32\...\Samsung CLP-320 Series) (Version: - Samsung Electronics Co., Ltd.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) (HKLM\...\99841829BE839365AA67B2AD0E50D371F59F8A1E) (Version: 12/15/2011 7.1.0.1 - Lenovo)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
23-06-2015 13:12:29 Windows Update
26-06-2015 21:45:40 Windows Update
30-06-2015 14:38:08 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {559A1B5A-A01E-44EA-97F6-7033A89E9DF4} - System32\Tasks\{48907F76-35F5-4A62-B747-6576A7E7BC97} => pcalua.exe -a "C:\Drivers\Camera Driver (Bison, Chicony)\Bison\1.12.204.1\setup.exe" -d "C:\Drivers\Camera Driver (Bison, Chicony)\Bison\1.12.204.1"
Task: {63EA8F3F-476D-4AF7-A2C1-0FCF961C922F} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG)
Task: {64CC8197-532D-4EFF-A614-65467CE4A1AD} - System32\Tasks\{2A411514-1A08-4A80-8B45-E13B6664067C} => pcalua.exe -a C:\Users\Julia\Downloads\0zca03ww(1).exe -d C:\Users\Julia\Downloads
Task: {64EDACA4-2CEE-4313-BC5F-F8C0F75DF0A1} - System32\Tasks\{389A87CB-3803-4BA7-A587-AD1C056AA250} => pcalua.exe -a C:\Users\Julia\Downloads\epson375782eu(1).exe -d C:\Users\Julia\Downloads
Task: {722CA4F6-3A7E-4275-9284-56D44566E93F} - System32\Tasks\{EE2FE40A-CD69-461B-AF47-4C23E666A395} => pcalua.exe -a "C:\Drivers\Camera Driver (Bison, Chicony)\Setup.exe" -d "C:\Drivers\Camera Driver (Bison, Chicony)"
Task: {9D303FBC-19CC-4407-8C4D-47AEEAE2FC53} - System32\Tasks\{798C46A0-5F80-47B7-8A05-4361B72769F8} => pcalua.exe -a C:\Users\Julia\Downloads\0zca03ww.exe -d C:\Users\Julia\Downloads
Task: {BDEA842A-DDEA-4FA4-BC67-93702F897FC0} - System32\Tasks\{E4FC5148-0476-4098-9AC6-CDDEA6913E1C} => pcalua.exe -a C:\Users\Julia\Downloads\vpnclient-win-msi-5.0.07.0290-k9\vpnclient_setup.exe -d C:\Users\Julia\Downloads\vpnclient-win-msi-5.0.07.0290-k9
Task: {D0D7D87B-C13C-48F4-BD4B-1F96D6495628} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {E4B8E261-7322-486E-9C5C-AFAD337EECF4} - System32\Tasks\{8E5AAD55-B9B0-4E95-8D63-07B0A6FED3A7} => pcalua.exe -a C:\Users\Julia\Downloads\epson375776eu(1).exe -d C:\Users\Julia\Downloads
Task: {FBB3DFD8-C425-4F47-ABEC-6269745B27BE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-01] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2013-01-01 22:03 - 2009-09-12 02:48 - 00027648 _____ () C:\Windows\System32\sst3cl6.dll
2012-10-05 16:09 - 2013-06-03 13:06 - 03999512 _____ () C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
2008-12-20 03:20 - 2012-09-27 22:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2012-03-10 16:30 - 2012-09-27 22:02 - 01509936 _____ () C:\Program Files (x86)\Lenovo\Energy Management\EMWpfUI.dll
2012-03-10 16:31 - 2012-09-27 22:02 - 00012336 _____ () C:\Program Files (x86)\Lenovo\Energy Management\de-DE\EMWpfUI.resources.dll
2008-12-20 03:20 - 2012-09-27 22:02 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-09-27 22:04 - 2012-02-17 18:21 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 20:50 - 2013-05-22 20:50 - 00400704 _____ () C:\Users\Julia\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2013-01-01 22:03 - 2010-06-08 05:15 - 00618496 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2012-02-02 15:17 - 2012-02-02 15:17 - 05878272 _____ () C:\Program Files (x86)\Paragon Software\PONS\PONS-CD.exe
2013-01-01 22:03 - 2009-09-30 23:51 - 00306688 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2009-10-09 16:08 - 2009-10-09 16:08 - 00125952 _____ () C:\Windows\SysWOW64\ResStub.exe
2010-03-23 13:26 - 2010-03-23 13:26 - 00201512 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-10-05 16:09 - 2013-06-03 13:06 - 09907712 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\TOBITCLT.dll
2012-10-05 16:09 - 2013-05-16 14:28 - 00242688 _____ () C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client$.ger
2015-03-08 10:28 - 2015-07-01 18:37 - 41287224 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libcef.dll
2012-01-19 12:35 - 2012-01-19 12:35 - 00479744 _____ () C:\Program Files (x86)\Paragon Software\PONS\Engine.dll
2012-01-19 12:35 - 2012-01-19 12:35 - 00124928 _____ () C:\Program Files (x86)\Paragon Software\PONS\morphology.dll
2006-11-27 20:26 - 2006-11-27 20:26 - 04349952 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtGui4.dll
2007-09-12 13:44 - 2007-09-12 13:44 - 01191936 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtCore4.dll
2006-11-27 20:20 - 2006-11-27 20:20 - 00172032 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtXml4.dll
2006-11-27 20:31 - 2006-11-27 20:31 - 00225280 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtNetwork4.dll
2006-11-27 20:38 - 2006-11-27 20:38 - 00032768 _____ () C:\Program Files (x86)\Paragon Software\PONS\iconengines\qsvg1.dll
2006-11-27 20:32 - 2006-11-27 20:32 - 00172032 _____ () C:\Program Files (x86)\Paragon Software\PONS\QtSvg4.dll
2015-03-08 10:28 - 2015-07-01 18:37 - 01488440 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libglesv2.dll
2015-03-08 10:28 - 2015-07-01 18:37 - 00079928 _____ () C:\Users\Julia\AppData\Roaming\Spotify\libegl.dll
2015-03-08 10:28 - 2015-03-23 11:03 - 09305656 _____ () C:\Users\Julia\AppData\Roaming\Spotify\pdf.dll
2014-10-15 19:22 - 2014-10-15 19:22 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\92a1650dbe9fad5f46633b835420e1a8\IsdiInterop.ni.dll
2012-09-27 22:05 - 2011-11-29 20:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2315325413-3490006923-2595072304-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Julia\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [{6AC23DF8-D5F3-496D-AC25-0BD74A4FB75B}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{F60E3CEA-5E09-4E3A-BF5E-70879A8051EE}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{2D1DE809-C988-40FA-85F1-787A7ACE763F}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [{97BF04EE-237C-4E5E-B4AF-6ACA6C1B06AD}] => (Allow) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [TCP Query User{9036CA5E-8D33-4BAA-AEC0-51EC8170E799}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{F4F453BA-8FEE-4ADE-BCB6-84D530192F15}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [TCP Query User{099995C7-6BF4-4DDB-BC84-E06FBC5AF16B}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [UDP Query User{FF3ACC0F-DF94-448D-B562-3360936CC67A}C:\program files (x86)\tmnationsforever\tmforever.exe] => (Allow) C:\program files (x86)\tmnationsforever\tmforever.exe
FirewallRules: [TCP Query User{DC30C68F-B1A0-4A7B-AAFF-B5925A216BEF}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [UDP Query User{D16445F7-98E2-420C-BA74-9578153DEFDA}C:\program files (x86)\mozilla firefox\plugin-container.exe] => (Block) C:\program files (x86)\mozilla firefox\plugin-container.exe
FirewallRules: [TCP Query User{2FED4120-015A-440A-AAF6-5C5EDDC9C43F}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{62D8752E-F7D8-43C3-85D1-7ADB8A167C34}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{87FB96AD-FCC9-4324-839A-BDE805C06E95}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{FB604C08-60A3-46B4-8E3E-2768EF2C5DEB}C:\users\julia\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\julia\appdata\roaming\spotify\spotify.exe
FirewallRules: [{4FB68F9C-1CD4-4196-8E93-0E0F6F30D740}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{22B7B5AB-6895-4EA6-82E6-2B427F68A6B6}] => (Allow) LPort=2869
FirewallRules: [{32C563D4-5807-4420-9B3A-E9BB77CA263A}] => (Allow) LPort=1900
FirewallRules: [{4A4D60D2-1D5B-4C50-A854-92869D732645}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{DE0A2BD3-D7EA-4289-9374-A3046D932350}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{AAC656B1-43E4-4094-842C-198837260FB7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5FA5283C-B44B-4BEE-A19B-B7C277C3C245}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B27CF9D3-B837-47ED-9CE3-DFD9387FCE72}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (07/03/2015 08:42:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/03/2015 07:50:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/02/2015 07:08:16 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/02/2015 06:50:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/02/2015 06:09:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/02/2015 10:14:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 11:49:19 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 10:37:13 PM) (Source: Radio.fx) (EventID: 100) (User: )
Description: ERROR: Not enough free disk space
Error: (07/01/2015 09:51:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (07/01/2015 06:33:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (07/03/2015 08:41:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/03/2015 08:40:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/03/2015 08:40:54 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (07/03/2015 07:48:39 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/03/2015 07:48:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (07/03/2015 07:48:33 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.
Error: (07/02/2015 07:18:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (07/02/2015 07:18:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/02/2015 07:18:54 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (07/02/2015 07:18:53 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "ZAtheros Bt&Wlan Coex Agent" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office:
=========================
Error: (05/16/2015 05:26:51 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6720.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time. This session ended with a crash.
Error: (03/11/2015 09:37:51 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6715.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 309 seconds with 60 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Processor: Intel(R) Pentium(R) CPU B970 @ 2.30GHz
Percentage of memory in use: 40%
Total physical RAM: 3993.28 MB
Available physical RAM: 2391.32 MB
Total Pagefile: 7984.77 MB
Available Pagefile: 5909.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.54 GB) (Free:389.36 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: C3FFC3FF)
Partition: GPT Partition Type.
==================== End of log ============================
|
|
04.07.2015, 15:03
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
EmptyTemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
05.07.2015, 11:12
| #10 |
| | Avira meldet Pua Somoto Gen 2 Erledigt  Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:28-06-2015 01
Ran by Julia at 2015-07-05 12:00:44 Run:1
Running from C:\Users\Julia\Downloads
Loaded Profiles: Julia (Available Profiles: Julia)
Boot Mode: Normal
==============================================
fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
EmptyTemp:
*****************
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
EmptyTemp: => 2.6 GB temporary data Removed.
The system needed a reboot..
==== End of Fixlog 12:05:59 ====
|
|
05.07.2015, 22:17
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 22:16
| #12 |
| | Avira meldet Pua Somoto Gen 2Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 06.07.2015 Suchlaufzeit: 21:13 Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.06.06 Rootkit-Datenbank: v2015.07.05.03 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Julia Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 386030 Abgelaufene Zeit: 22 Min., 22 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) LG Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b4d45879509a7449a9020dba2eacdaea
# end=init
# utc_time=2015-07-06 07:53:36
# local_time=2015-07-06 09:53:36 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24668
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=b4d45879509a7449a9020dba2eacdaea
# end=updated
# utc_time=2015-07-06 07:57:44
# local_time=2015-07-06 09:57:44 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=b4d45879509a7449a9020dba2eacdaea
# engine=24668
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-07-06 09:04:57
# local_time=2015-07-06 11:04:57 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 447545 187846547 0 0
# scanned=166046
# found=1
# cleaned=0
# scan_time=4032
sh=FED7CAA2E24771B66065C8D30131FC8037B6BD2A ft=1 fh=b41296876ed186e5 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Julia\AppData\Local\Temp\OCS\ocs_v71b.exe.vir"
|
|
06.07.2015, 22:22
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 Nur ein hysterischer Fund in TEMP. Sieht soweit ok aus  Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern. Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
06.07.2015, 22:28
| #14 |
| | Avira meldet Pua Somoto Gen 2 Alles klar, das mit den Cookies werde ich dann machen, danke! Und vielen Dank für die tolle Hilfe. Wenn du das auch sagst dann ist wohl wieder alles paletti, es wurde nichts mehr geunden und gab auch sonst keine Auffälligkeiten. |
|
06.07.2015, 22:42
| #15 | ||||||||||
| /// Winkelfunktion /// TB-Süch-Tiger™ | Avira meldet Pua Somoto Gen 2 Dann wären wir durch! Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...  und/oder das Forum mit einer kleinen Spende  unterstützen.  Abschließend müssen wir noch ein paar Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.  Cleanup: (Die Reihenfolge ist hier entscheidend) Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken. Falls Combofix verwendet wurde:  Combofix deinstallieren
Alle Logs gepostet? Dann lade Dir bitte  DelFix herunter.
Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst. Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.  Absicherung: Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen: Browser Java Flash-Player PDF-Reader Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen. Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig. Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:
Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen. Optional:  NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.Lade Software von einem sauberen Portal wie  .Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen. Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner . Abschließend noch ein paar grundsätzliche Bemerkungen: Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems. Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden. Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
+ R Taste und schreibe Combofix /Uninstall in das 
Linear-Darstellung
