| |
| |||||||
Log-Analyse und Auswertung: Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
02.10.2014, 05:40
| #1 |
| |  Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Hallo zusamen, ich bin neu hier in diesem Netzwerk und wäre wirklich sehr dankbar, wenn jemand mir bei meinem Virenbefall helfen könnte. Leider bin ich zudem weniger IT-affin, weshalb ich ebenalls sehr dankbar wäre, wenn sich jemand die Mühe machen könnte, die Schritte so einfach wie möglich zu erklären. Bei meinem heutigen Durchlauf des Antivir Pro wurde ein Java/Lamar.gtq.35 identifiziert und in die Quarantäne verbannt. Ich habe daraufhin die Schritte Eurer ersten Anleitung durchgeführt und nachfolgende Infos zusammengetragen. Hierzu nur eine Frage: Leider habe ich erst nach Fertigstellung der FRST.txt-Datei bemerkt, dass das mit dem Defogger nicht richtig geklappt hat, so dass bei mir erst der FRST-Scan und dann im zweiten Schritt die Abschaltung der Laufwerksemulationen erfolgte. Führt dies zu einer fehlerhaften Analyse? Falls ja, wie kann ich das korrigieren? Ich würde mich so freuen, wenn mir jemand nach dieser schlaflosen Nacht helfen könnte und bedanke mich vorab schon ganz herzlich für jede Hilfe! Viele Grüße Lilo Antivir Pro Report: Code:
ATTFilter
Antivirus Pro
Erstellungsdatum der Reportdatei: Donnerstag, 2. Oktober 2014 02:11
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Lilo
Seriennummer : XXX
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : FILOU-PC
Versionsinformationen:
BUILD.DAT : 14.0.6.570 94332 Bytes 15.08.2014 10:30:00
AVSCAN.EXE : 14.0.6.548 1046608 Bytes 04.09.2014 14:44:49
AVSCANRC.DLL : 14.0.6.522 62544 Bytes 04.09.2014 14:44:50
LUKE.DLL : 14.0.6.522 57936 Bytes 04.09.2014 14:45:06
AVSCPLR.DLL : 14.0.6.548 92752 Bytes 04.09.2014 14:44:50
AVREG.DLL : 14.0.6.522 262224 Bytes 04.09.2014 14:44:48
avlode.dll : 14.0.6.526 603728 Bytes 04.09.2014 14:44:46
avlode.rdf : 14.0.4.46 64835 Bytes 10.09.2014 18:37:24
XBV00010.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:13
XBV00011.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:13
XBV00012.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00013.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00014.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00015.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00016.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00017.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:14
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:45:15
XBV00056.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00057.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00058.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00059.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00060.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00061.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00062.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00063.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00064.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00065.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00066.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00067.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00068.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00069.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00070.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:47
XBV00071.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00072.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00073.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00074.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00075.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00076.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00077.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00078.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00079.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00080.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00081.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00082.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00083.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00084.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00085.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00086.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00087.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00088.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00089.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00090.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00091.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00092.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00093.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00094.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00095.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:48
XBV00096.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00097.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00098.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00099.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00100.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00101.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00102.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00103.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00104.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00105.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00106.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00107.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00108.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00109.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00110.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00111.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00112.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00113.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00114.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00115.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00116.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00117.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00118.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00119.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00120.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00121.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00122.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00123.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:49
XBV00124.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00125.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00126.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00127.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00128.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00129.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00130.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00131.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00132.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00133.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00134.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00135.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00136.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00137.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00138.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00139.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00140.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00141.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00142.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00143.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00144.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00145.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00146.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00147.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00148.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00149.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00150.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00151.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00152.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00153.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00154.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00155.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00156.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00157.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00158.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:50
XBV00159.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00160.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00161.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00162.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00163.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00164.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00165.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00166.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00167.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00168.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00169.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00170.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00171.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00172.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00173.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00174.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00175.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00176.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00177.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00178.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00179.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00180.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00181.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00182.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00183.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00184.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00185.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00186.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00187.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00188.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:51
XBV00189.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00190.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00191.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00192.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00193.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00194.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00195.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00196.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00197.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00198.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00199.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00200.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00201.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00202.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00203.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00204.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00205.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00206.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00207.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00208.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00209.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00210.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00211.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00212.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00213.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00214.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00215.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00216.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00217.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00218.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00219.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00220.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00221.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00222.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00223.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:52
XBV00224.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00225.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00226.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00227.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00228.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00229.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00230.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00231.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00232.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00233.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00234.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00235.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00236.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00237.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00238.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00239.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00240.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00241.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00242.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00243.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00244.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00245.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00246.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00247.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00248.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00249.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00250.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00251.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00252.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00253.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00254.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00255.VDF : 8.11.175.172 2048 Bytes 30.09.2014 17:19:53
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 17:42:45
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 12:32:20
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 21:51:00
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 21:20:28
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 15:30:21
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 13:13:02
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 11:37:32
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 18:29:04
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 14:45:13
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 17:27:14
XBV00042.VDF : 8.11.175.172 1208832 Bytes 30.09.2014 17:19:46
XBV00043.VDF : 8.11.175.174 36864 Bytes 30.09.2014 17:19:46
XBV00044.VDF : 8.11.175.178 5632 Bytes 30.09.2014 17:19:46
XBV00045.VDF : 8.11.175.180 11264 Bytes 30.09.2014 17:19:46
XBV00046.VDF : 8.11.175.194 9728 Bytes 30.09.2014 17:19:46
XBV00047.VDF : 8.11.175.206 3072 Bytes 30.09.2014 17:19:46
XBV00048.VDF : 8.11.175.218 2560 Bytes 30.09.2014 17:19:47
XBV00049.VDF : 8.11.175.222 24576 Bytes 01.10.2014 17:19:47
XBV00050.VDF : 8.11.175.224 28160 Bytes 01.10.2014 17:19:47
XBV00051.VDF : 8.11.175.230 3072 Bytes 01.10.2014 17:19:47
XBV00052.VDF : 8.11.175.232 17408 Bytes 01.10.2014 17:19:47
XBV00053.VDF : 8.11.175.234 19456 Bytes 01.10.2014 17:19:47
XBV00054.VDF : 8.11.175.236 11264 Bytes 01.10.2014 17:19:47
XBV00055.VDF : 8.11.175.238 12288 Bytes 01.10.2014 19:21:58
LOCAL001.VDF : 8.11.175.238 111414784 Bytes 01.10.2014 19:22:13
Engineversion : 8.3.24.30
AEVDF.DLL : 8.3.1.6 133992 Bytes 04.09.2014 14:44:42
AESCRIPT.DLL : 8.2.0.26 436136 Bytes 28.09.2014 12:48:23
AESCN.DLL : 8.3.2.2 139456 Bytes 21.07.2014 19:10:37
AESBX.DLL : 8.2.20.24 1409224 Bytes 11.05.2014 13:06:53
AERDL.DLL : 8.2.0.138 704888 Bytes 30.12.2013 21:32:53
AEPACK.DLL : 8.4.0.54 788392 Bytes 24.09.2014 21:43:11
AEOFFICE.DLL : 8.3.0.26 223144 Bytes 28.09.2014 12:48:23
AEHEUR.DLL : 8.1.4.1310 7564144 Bytes 28.09.2014 12:48:23
AEHELP.DLL : 8.3.1.0 278728 Bytes 29.05.2014 11:43:12
AEGEN.DLL : 8.1.7.30 453480 Bytes 28.09.2014 12:48:20
AEEXP.DLL : 8.4.2.32 247712 Bytes 04.09.2014 14:44:43
AEEMU.DLL : 8.1.3.4 399264 Bytes 04.09.2014 14:44:39
AEDROID.DLL : 8.4.2.24 442568 Bytes 09.06.2014 18:28:38
AECORE.DLL : 8.3.2.6 243712 Bytes 04.09.2014 14:44:39
AEBB.DLL : 8.1.2.0 60448 Bytes 04.09.2014 14:44:39
AVWINLL.DLL : 14.0.6.522 24144 Bytes 04.09.2014 14:44:38
AVPREF.DLL : 14.0.6.522 50256 Bytes 04.09.2014 14:44:47
AVREP.DLL : 14.0.6.522 219216 Bytes 04.09.2014 14:44:48
AVARKT.DLL : 14.0.5.368 226384 Bytes 06.07.2014 11:46:39
AVEVTLOG.DLL : 14.0.6.522 182352 Bytes 04.09.2014 14:44:45
SQLITE3.DLL : 14.0.6.522 452176 Bytes 04.09.2014 14:45:09
AVSMTP.DLL : 14.0.6.522 76368 Bytes 04.09.2014 14:44:50
NETNT.DLL : 14.0.6.522 13392 Bytes 04.09.2014 14:45:06
RCIMAGE.DLL : 14.0.6.544 4886096 Bytes 04.09.2014 14:44:38
RCTEXT.DLL : 14.0.6.558 76536 Bytes 04.09.2014 14:44:39
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\program files (x86)\avira\antivir desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 2. Oktober 2014 02:11
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '139' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '183' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'devmonsrv.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'HeciServer.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'IntelMeFWService.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'jhi_service.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'SwiCardDetect64.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'SWIService.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApplePhotoStreams.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'iCloudServices.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'WTGService.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'ZeroConfigService.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'obexsrv.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'ONENOTEM.EXE' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'TRUUpdater.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'pcee4.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'iusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '105' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdf24.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcWnd.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'brccMCtl.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcmon.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'APSDaemon.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorIcon.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'mediasrv.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTPlayerCtrl.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'SYNTPHELPER.EXE' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTHSAmpPalService.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTHSSecurityMgr.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'IAStorDataMgrSvc.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wuauclt.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '2569' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\'
[0] Archivtyp: RSRC
--> C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe
[1] Archivtyp: RSRC
--> C:\Program Files (x86)\HW Gobi 3000 Driver\X64\WUDFUpdate_01009.dll
[2] Archivtyp: RSRC
--> C:\Program Files (x86)\HW Gobi 3000 Driver\X86\WUDFUpdate_01009.dll
[3] Archivtyp: RSRC
--> C:\Users\Filou\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2X3STQSE\Dropbox_2.6.31data[1].exe
[4] Archivtyp: 7-Zip SFX (self extracting)
--> C:\Users\Filou\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
[5] Archivtyp: Runtime Packed
--> C:\Users\Filou\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6baa197f-417d2bcb
[6] Archivtyp: ZIP
--> gumjl/gnvmmefcrhe.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gta.17
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/gqwbbgdrtghtrkqwhd.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.31
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/hvypvrkksuqgdpm.class
[FUND] Enthält Erkennungsmuster des Exploits EXP/CVE-2012-1723.PB
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/lmauyam.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.32
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/mfpgdmjvekvdjtarneups.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gta.18
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/pcfywvvnngsawyjw.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.33
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/pnhffyrnrnhhhpmpbthy.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gta.19
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/qlrbuctfskhnffvahndmyvbu.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.34
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> gumjl/tryufqcvlsbdukcjueqfed.class
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.35
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Filou\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6baa197f-417d2bcb
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.35
Beginne mit der Suche in 'D:\'
Beginne mit der Desinfektion:
C:\Users\Filou\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63\6baa197f-417d2bcb
[FUND] Enthält Erkennungsmuster des Java-Virus JAVA/Lamar.gtq.35
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '528e0de0.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 2. Oktober 2014 03:49
Benötigte Zeit: 1:32:57 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
32154 Verzeichnisse wurden überprüft
527529 Dateien wurden geprüft
10 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
527519 Dateien ohne Befall
9121 Archive wurden durchsucht
9 Warnungen
1 Hinweise
824775 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
Defogger_disable.txt Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 04:52 on 02/10/2014 (Filou)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Filou (administrator) on FILOU-PC on 02-10-2014 04:25:26
Running from C:\Users\Filou\Desktop\Trojaner Board
Loaded Profile: Filou (Available profiles: Filou)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\QMIPackage\Utils\SwiService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
() C:\Program Files (x86)\OneClickInternet\WTGService.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Dropbox, Inc.) C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-04-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-04-30] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-05-01] (Synaptics Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [TRUUpdater] => C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [329072 2011-11-03] (Sierra Wireless, Inc.)
HKLM-x32\...\Run: [WatcherHelper] => C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe [140656 2011-08-04] (Sierra Wireless Inc.)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-05-01] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
Startup: C:\Users\Filou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Filou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1A1A102C6A09CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Filou\AppData\Roaming\Mozilla\Firefox\Profiles\n26v23ut.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [802384 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-05-01] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-05-01] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 SwiCardDetectSvc; C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe [323952 2012-03-08] (Sierra Wireless, Inc.)
R2 SwiService; C:\Program Files (x86)\Sierra Wireless Inc\QMIPackage\Utils\SWIService.exe [152944 2012-01-13] (Sierra Wireless, Inc.)
R2 WTGService; C:\Program Files (x86)\OneClickInternet\WTGService.exe [342984 2011-03-09] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-06] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-30] (Avira Operations GmbH & Co. KG)
U5 gobi3kserial; C:\Windows\System32\Drivers\gobi3kserial.sys [233984 2010-12-13] (QUALCOMM Incorporated)
S3 OXSDIDRV_x64; C:\Windows\System32\DRIVERS\OXSDIDRV_x64.sys [51760 2009-09-28] ()
S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X64.sys [31280 2010-05-25] ()
S3 SWUMX20; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 04:24 - 2014-10-02 04:25 - 00000000 ____D () C:\FRST
2014-10-02 04:21 - 2014-10-02 04:25 - 00000000 ____D () C:\Users\Filou\Desktop\Trojaner Board
2014-10-02 04:18 - 2014-10-02 04:18 - 00000472 _____ () C:\Users\Filou\Downloads\defogger_disable.log
2014-10-02 04:18 - 2014-10-02 04:18 - 00000000 _____ () C:\Users\Filou\defogger_reenable
2014-10-02 04:16 - 2014-10-02 04:16 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger(2).exe
2014-10-02 04:13 - 2014-10-02 04:15 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger(1).exe
2014-10-02 04:13 - 2014-10-02 04:14 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger.exe
2014-10-02 04:01 - 2014-10-02 04:01 - 00000000 ____D () C:\Trojaner Board
2014-10-01 19:25 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 19:25 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 23:58 - 2014-09-24 23:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 23:48 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 23:48 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-23 15:02 - 2014-09-23 17:33 - 00000000 ____D () C:\Lilo Bloomburg
2014-09-22 13:54 - 2014-09-22 13:54 - 00000000 _____ () C:\Users\Filou\Sti_Trace.log
2014-09-16 20:55 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-16 20:55 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-16 20:55 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-16 20:55 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-16 20:55 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-16 20:55 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-16 20:55 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-16 20:55 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-16 20:55 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-16 20:55 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-16 20:55 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-16 20:55 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-16 20:55 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-16 20:55 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-16 20:55 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-16 20:55 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-16 20:55 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-16 20:55 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-16 20:55 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-16 20:55 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-16 20:55 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-16 20:55 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-16 20:55 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-16 20:55 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-16 20:55 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-16 20:55 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-16 20:55 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-16 20:55 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-16 20:55 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-16 20:55 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-16 20:55 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-16 20:55 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-16 20:55 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-16 20:55 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-16 20:55 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-16 20:55 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-16 20:55 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-16 20:55 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-16 20:55 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-16 20:55 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-16 20:55 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-16 20:55 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-16 20:55 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-16 20:55 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-16 20:55 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-16 20:54 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-16 20:54 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-16 20:54 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-16 20:54 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-16 20:54 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-16 20:54 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-16 20:54 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-16 20:54 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-16 20:41 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-16 20:41 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-15 19:41 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-15 19:41 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-15 19:41 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-15 19:41 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-15 19:41 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-15 19:41 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-15 19:41 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-15 19:41 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-15 19:41 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-15 19:41 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-15 19:41 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 17:03 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-04 17:03 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-09-04 17:03 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-04 16:50 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-04 16:50 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-09-04 16:50 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-04 16:50 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-04 16:50 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-09-04 16:50 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-09-04 16:49 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-09-04 16:49 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 04:26 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-02 04:26 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-02 04:18 - 2013-02-12 21:18 - 00000000 ____D () C:\Users\Filou
2014-10-02 04:07 - 2013-02-12 21:06 - 01113589 _____ () C:\Windows\WindowsUpdate.log
2014-10-02 03:38 - 2013-02-21 16:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 02:08 - 2014-05-01 22:51 - 00000000 ___RD () C:\Users\Filou\Dropbox
2014-10-02 02:08 - 2014-05-01 22:48 - 00000000 ____D () C:\Users\Filou\AppData\Roaming\Dropbox
2014-10-02 02:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-02 02:06 - 2009-07-14 06:51 - 00037998 _____ () C:\Windows\setupact.log
2014-09-28 16:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-28 15:13 - 2013-02-17 17:22 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-25 14:27 - 2013-02-13 21:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-24 23:48 - 2013-02-17 17:46 - 00000000 ____D () C:\Users\Filou\Documents\Outlook-Dateien
2014-09-24 23:44 - 2014-04-05 15:59 - 00000000 ____D () C:\Users\Filou\AppData\Local\140A6CB7-1884-4CD9-B6A9-4C0705B90E48.aplzod
2014-09-24 23:43 - 2009-07-14 19:58 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-09-24 23:43 - 2009-07-14 19:58 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-09-24 23:43 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-23 15:00 - 2013-02-24 22:44 - 00000000 ____D () C:\Belladine
2014-09-22 13:57 - 2013-03-10 15:42 - 00000000 ____D () C:\Generali
2014-09-22 13:51 - 2014-05-01 22:51 - 00000979 _____ () C:\Users\Filou\Desktop\Dropbox.lnk
2014-09-22 13:51 - 2014-05-01 22:50 - 00000000 ____D () C:\Users\Filou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-09-16 20:54 - 2013-02-17 17:09 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-16 20:53 - 2013-12-30 20:38 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-16 20:52 - 2013-09-26 17:15 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-16 20:42 - 2013-02-13 19:52 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-16 20:41 - 2014-05-25 23:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-15 20:08 - 2009-07-14 06:45 - 00408392 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-10 20:39 - 2013-02-21 16:44 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 20:39 - 2013-02-21 16:44 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 20:39 - 2013-02-21 16:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-04 17:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
Some content of TEMP:
====================
C:\Users\Filou\AppData\Local\Temp\AskSLib.dll
C:\Users\Filou\AppData\Local\Temp\avgnt.exe
C:\Users\Filou\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpebofsn.dll
C:\Users\Filou\AppData\Local\Temp\GLF1F8.EXE
C:\Users\Filou\AppData\Local\Temp\GLF2320.EXE
C:\Users\Filou\AppData\Local\Temp\GLF2E45.EXE
C:\Users\Filou\AppData\Local\Temp\GLF3335.EXE
C:\Users\Filou\AppData\Local\Temp\GLF34BC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF3FC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF4501.EXE
C:\Users\Filou\AppData\Local\Temp\GLF458D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5A1.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5B9C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5DBE.EXE
C:\Users\Filou\AppData\Local\Temp\GLF659A.EXE
C:\Users\Filou\AppData\Local\Temp\GLF66B3.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7073.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7258.EXE
C:\Users\Filou\AppData\Local\Temp\GLF746A.EXE
C:\Users\Filou\AppData\Local\Temp\GLF767C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7BF9.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7D8D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7E1B.EXE
C:\Users\Filou\AppData\Local\Temp\GLF801C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF81A3.EXE
C:\Users\Filou\AppData\Local\Temp\GLF81A4.EXE
C:\Users\Filou\AppData\Local\Temp\GLF825D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF83C4.EXE
C:\Users\Filou\AppData\Local\Temp\GLF85C7.EXE
C:\Users\Filou\AppData\Local\Temp\GLF8B15.EXE
C:\Users\Filou\AppData\Local\Temp\GLF98AC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF9C83.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA345.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA5A7.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA662.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA98C.EXE
C:\Users\Filou\AppData\Local\Temp\GLFADD.EXE
C:\Users\Filou\AppData\Local\Temp\GLFB408.EXE
C:\Users\Filou\AppData\Local\Temp\GLFBEE0.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC1DD.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC5B4.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC74B.EXE
C:\Users\Filou\AppData\Local\Temp\GLFCA46.EXE
C:\Users\Filou\AppData\Local\Temp\GLFCB30.EXE
C:\Users\Filou\AppData\Local\Temp\GLFD08D.EXE
C:\Users\Filou\AppData\Local\Temp\GLFDC20.EXE
C:\Users\Filou\AppData\Local\Temp\GLFEC48.EXE
C:\Users\Filou\AppData\Local\Temp\GLFED5F.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF0BA.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF0D8.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF5E8.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF673.EXE
C:\Users\Filou\AppData\Local\Temp\GLFFFD.EXE
C:\Users\Filou\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Filou\AppData\Local\Temp\ose00000.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-28 16:00
==================== End Of Log ============================
Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-10-2014 01
Ran by Filou at 2014-10-02 04:27:13
Running from C:\Users\Filou\Desktop\Trojaner Board
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-235C (HKLM-x32\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.7000.4 - Dolby Laboratories Inc)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
HW Gobi 3000 Driver 1.08.00.00 (HKLM-x32\...\HW Gobi 3000 Driver) (Version: 1.08.00.00 - Huawei technologies Co., Ltd.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{F0932859-AA60-459E-B843-0BDECA34E2C7}) (Version: 2.0.0.0086 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{E97F409F-9E1C-42A0-B72D-765A78DF3696}) (Version: 15.01.0000.0830 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Iomega Encryption (HKLM\...\{578831A8-CB47-471F-A552-907EC3E9E040}) (Version: 1.03.0001 - Iomega an EMC Company)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.210 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
OneClick Internet (HKLM-x32\...\OneClickInternet) (Version: 3.0 - OneClick Internet)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{E727B31A-8B24-4C1C-934A-69634E0D2C0B}) (Version: 9.2 - Qualcomm Atheros)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)
RemoteComms External Disk Access (HKLM-x32\...\{04FCD5DE-1662-4F99-BDA9-C57212113EF2}) (Version: 1.25.0003 - PLX Technology)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Sierra Wireless AirCard Watcher (HKLM-x32\...\{A12F8C2E-765C-4589-8DC6-82C3D7A8709B}) (Version: 6.0.3411.7504 - Sierra Wireless Inc.)
Sierra Wireless QMI Driver Package (HKLM-x32\...\SWIQMIDrvInstaller) (Version: 1.0.34.0 - Sierra Wireless Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.0.5 - Synaptics Incorporated)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
15-09-2014 17:30:59 Windows Update
16-09-2014 18:38:40 Windows Update
25-09-2014 01:00:26 Windows Update
02-10-2014 01:00:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {13F66F93-DEE2-48C2-8AF6-7FAEEA954E26} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3EE8796C-6FE8-45E8-87DA-7D32ECA45ABE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-12 22:49 - 2012-05-01 02:05 - 00127320 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-12 22:14 - 2011-03-09 12:40 - 00342984 ____N () C:\Program Files (x86)\OneClickInternet\WTGService.exe
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-10-02 02:08 - 2014-10-02 02:08 - 00043008 _____ () c:\users\filou\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpebofsn.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Filou\AppData\Roaming\Dropbox\bin\libcef.dll
2011-11-03 18:39 - 2011-11-03 18:39 - 00251248 _____ () C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\WebUpdtAPI.dll
2013-03-29 21:11 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-09-16 21:25 - 2014-09-16 21:25 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\27372090b75ca919048606aad2206bf4\IsdiInterop.ni.dll
2013-02-12 22:40 - 2012-02-01 17:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-02-12 22:43 - 2012-05-01 02:06 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-09-24 23:58 - 2014-09-24 23:59 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-3005798335-2976664300-485891405-500 - Administrator - Disabled)
Filou (S-1-5-21-3005798335-2976664300-485891405-1000 - Administrator - Enabled) => C:\Users\Filou
Gast (S-1-5-21-3005798335-2976664300-485891405-501 - Limited - Disabled)
==================== Faulty Device Manager Devices =============
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (09/28/2014 03:13:15 PM) (Source: MsiInstaller) (EventID: 1024) (User: Filou-PC)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (09/25/2014 02:30:48 PM) (Source: MsiInstaller) (EventID: 1024) (User: Filou-PC)
Description: Produkt: Adobe Reader XI - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011009}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127
Error: (09/24/2014 11:48:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: iCloudServices.exe, Version: 3.1.0.3, Zeitstempel: 0x516e136b
Name des fehlerhaften Moduls: iCloudServices_main.dll, Version: 3.1.0.3, Zeitstempel: 0x528c1c05
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000fff7
ID des fehlerhaften Prozesses: 0x9e8
Startzeit der fehlerhaften Anwendung: 0xiCloudServices.exe0
Pfad der fehlerhaften Anwendung: iCloudServices.exe1
Pfad des fehlerhaften Moduls: iCloudServices.exe2
Berichtskennung: iCloudServices.exe3
Error: (09/22/2014 04:42:11 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:11.510]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:09 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:09.988]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:08 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:08.050]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:06 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:06.505]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:04 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:04.961]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:03 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:03.416]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:01 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMW BrtWDLMW: [2014/09/22 16:42:01.872]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
System errors:
=============
Error: (10/01/2014 10:26:11 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (09/24/2014 11:39:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/24/2014 11:38:46 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E28EE682-E406-4254-8CEB-736616138E89}
Error: (09/15/2014 08:10:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/15/2014 08:10:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst iPod-Dienst erreicht.
Error: (09/15/2014 08:10:21 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053iPod Service{063D34A4-BF84-4B8D-B699-E8CA06504DDE}
Error: (09/15/2014 07:28:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.
Error: (09/15/2014 07:28:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X86 erreicht.
Error: (09/15/2014 07:26:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/15/2014 07:26:20 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.
Microsoft Office Sessions:
=========================
Error: (09/28/2014 03:13:15 PM) (Source: MsiInstaller) (EventID: 1024) (User: Filou-PC)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (09/25/2014 02:30:48 PM) (Source: MsiInstaller) (EventID: 1024) (User: Filou-PC)
Description: Adobe Reader XI - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011009}1625(NULL)(NULL)(NULL)
Error: (09/24/2014 11:48:53 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iCloudServices.exe3.1.0.3516e136biCloudServices_main.dll3.1.0.3528c1c05c00000050000fff79e801cfd83fd8072840C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exeC:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices_main.dll9326139f-4434-11e4-b314-c485088ddd5c
Error: (09/22/2014 04:42:11 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:11.510]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:09 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:09.988]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:08 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:08.050]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:06 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:06.505]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:04 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:04.961]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:03 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:03.416]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
Error: (09/22/2014 04:42:01 PM) (Source: Brother BrLog) (EventID: 1001) (User: )
Description: WDLMWBrtWDLMW: [2014/09/22 16:42:01.872]: [00003084]: lperrcode->api = 1 , lperrcode->code = 2
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 49%
Total physical RAM: 3996.36 MB
Available physical RAM: 2009.6 MB
Total Pagefile: 7990.9 MB
Available Pagefile: 5857.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:244.04 GB) (Free:141.54 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:221.62 GB) (Free:221.52 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D61AB77A)
Partition 1: (Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Gmer.txt Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-02 05:10:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Filou\AppData\Local\Temp\pgloypog.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fa4000 58 bytes [48, 8B, 71, 18, 48, F7, C6, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 587 fffff80002fa403b 7 bytes [89, 4C, 24, 08, 55, 56, 57]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075cc1465 2 bytes [CC, 75]
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2536] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075cc14bb 2 bytes [CC, 75]
.text ... * 2
.text C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe[3260] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000075cc1465 2 bytes [CC, 75]
.text C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe[3260] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 0000000075cc14bb 2 bytes [CC, 75]
.text ... * 2
.text C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe[3432] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075cc1465 2 bytes [CC, 75]
.text C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe[3432] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075cc14bb 2 bytes [CC, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075cc1465 2 bytes [CC, 75]
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075cc14bb 2 bytes [CC, 75]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\Users\Filou\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe [3260](2014-09-13 00:20:58) 00000000040e0000
Library c:\users\filou\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpebofsn.dll (*** suspicious ***) @ C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe [3260](2014-10-02 00:08:17) 0000000002470000
Library C:\Users\Filou\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe [3260](2013-08-23 19:01:44) 0000000065d60000
Library C:\Users\Filou\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe [3260] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 00000000647f0000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c485088ddd5c
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c485088ddd5c (not active ControlSet)
---- EOF - GMER 2.1 ----
|
|
02.10.2014, 06:34
| #2 |
| /// the machine /// TB-Ausbilder    | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? hi,
__________________Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ |
|
02.10.2014, 13:51
| #3 |
| | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Hallo,
__________________ich danke Dir so sehr für Deine schnelle Hilfe! Ich denke, dass dürfte doch wieder ok ausschauen, oder? (bitte siehe nachfolgende txt-Dateien) Ich würde mich sehr freuen, wenn ich mich für Deine Hilfe und Mühe mit einer kleinen Spende bei Euch bedanken kann... Viele Grüße Lilo Eset Logfile Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=4076914d9f7d784cb01b211a68b409f9
# engine=20403
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-02 12:05:49
# local_time=2014-10-02 02:05:49 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 38442611 163881399 0 0
# scanned=187629
# found=0
# cleaned=0
# scan_time=3845
Checkup.txt Code:
ATTFilter Results of screen317's Security Check version 0.99.87
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 7 Update 21
Java version out of Date!
Adobe Flash Player 15.0.0.152
Adobe Reader XI
Mozilla Firefox (32.0.3)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Filou (administrator) on FILOU-PC on 02-10-2014 14:23:49
Running from C:\Users\Filou\Desktop\Trojaner Board\Analyse
Loaded Profile: Filou (Available profiles: Filou)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\QMIPackage\Utils\SwiService.exe
() C:\Program Files (x86)\OneClickInternet\WTGService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Sierra Wireless, Inc.) C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-04-30] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-04-30] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2884880 2012-05-01] (Synaptics Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [TRUUpdater] => C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe [329072 2011-11-03] (Sierra Wireless, Inc.)
HKLM-x32\...\Run: [WatcherHelper] => C:\Program Files (x86)\Sierra Wireless Inc\3G Watcher\WaHelper.exe [140656 2011-08-04] (Sierra Wireless Inc.)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Program Files (x86)\Dolby Home Theater v4\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-05-01] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-09-04] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
HKU\S-1-5-21-3005798335-2976664300-485891405-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
Startup: C:\Users\Filou\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1A1A102C6A09CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Filou\AppData\Roaming\Mozilla\Firefox\Profiles\n26v23ut.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [804944 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1021520 2014-09-04] (Avira Operations GmbH & Co. KG)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-05-01] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-05-01] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 SwiCardDetectSvc; C:\Program Files (x86)\Sierra Wireless Inc\Common\SwiCardDetect64.exe [323952 2012-03-08] (Sierra Wireless, Inc.)
R2 SwiService; C:\Program Files (x86)\Sierra Wireless Inc\QMIPackage\Utils\SWIService.exe [152944 2012-01-13] (Sierra Wireless, Inc.)
R2 WTGService; C:\Program Files (x86)\OneClickInternet\WTGService.exe [342984 2011-03-09] ()
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-06] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-30] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [42040 2014-07-24] (Avira Operations GmbH & Co. KG)
U5 gobi3kserial; C:\Windows\System32\Drivers\gobi3kserial.sys [233984 2010-12-13] (QUALCOMM Incorporated)
S3 OXSDIDRV_x64; C:\Windows\System32\DRIVERS\OXSDIDRV_x64.sys [51760 2009-09-28] ()
S3 OXUDIDRV; C:\Windows\system32\Drivers\OXUDIDRV_X64.sys [31280 2010-05-25] ()
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 SWUMX20; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 12:50 - 2014-10-02 12:50 - 508018185 _____ () C:\Windows\MEMORY.DMP
2014-10-02 12:50 - 2014-10-02 12:50 - 00280192 _____ () C:\Windows\Minidump\100214-14367-01.dmp
2014-10-02 12:50 - 2014-10-02 12:50 - 00000000 ____D () C:\Windows\Minidump
2014-10-02 05:40 - 2014-10-02 05:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-10-02 04:24 - 2014-10-02 14:23 - 00000000 ____D () C:\FRST
2014-10-02 04:21 - 2014-10-02 12:44 - 00000000 ____D () C:\Users\Filou\Desktop\Trojaner Board
2014-10-02 04:18 - 2014-10-02 04:18 - 00000472 _____ () C:\Users\Filou\Downloads\defogger_disable.log
2014-10-02 04:18 - 2014-10-02 04:18 - 00000000 _____ () C:\Users\Filou\defogger_reenable
2014-10-02 04:16 - 2014-10-02 04:16 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger(2).exe
2014-10-02 04:13 - 2014-10-02 04:15 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger(1).exe
2014-10-02 04:13 - 2014-10-02 04:14 - 00050477 _____ () C:\Users\Filou\Downloads\Defogger.exe
2014-10-02 04:01 - 2014-10-02 04:01 - 00000000 ____D () C:\Trojaner Board
2014-10-01 19:25 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 19:25 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 23:58 - 2014-09-24 23:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 23:48 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 23:48 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-23 15:02 - 2014-09-23 17:33 - 00000000 ____D () C:\Lilo Bloomburg
2014-09-22 13:54 - 2014-09-22 13:54 - 00000000 _____ () C:\Users\Filou\Sti_Trace.log
2014-09-16 20:55 - 2014-08-19 20:05 - 00374968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-16 20:55 - 2014-08-19 19:39 - 00327872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-16 20:55 - 2014-08-19 01:01 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-16 20:55 - 2014-08-19 00:29 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-16 20:55 - 2014-08-19 00:29 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-16 20:55 - 2014-08-19 00:20 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-16 20:55 - 2014-08-19 00:19 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-16 20:55 - 2014-08-19 00:15 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-16 20:55 - 2014-08-19 00:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-16 20:55 - 2014-08-19 00:14 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-16 20:55 - 2014-08-19 00:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-16 20:55 - 2014-08-19 00:08 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-16 20:55 - 2014-08-19 00:08 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-16 20:55 - 2014-08-19 00:05 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-16 20:55 - 2014-08-19 00:03 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-16 20:55 - 2014-08-19 00:03 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-16 20:55 - 2014-08-19 00:03 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-16 20:55 - 2014-08-18 23:57 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-16 20:55 - 2014-08-18 23:56 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-09-16 20:55 - 2014-08-18 23:51 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-16 20:55 - 2014-08-18 23:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-16 20:55 - 2014-08-18 23:45 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-16 20:55 - 2014-08-18 23:45 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-16 20:55 - 2014-08-18 23:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-16 20:55 - 2014-08-18 23:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-16 20:55 - 2014-08-18 23:42 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-16 20:55 - 2014-08-18 23:40 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-16 20:55 - 2014-08-18 23:39 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-16 20:55 - 2014-08-18 23:38 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-16 20:55 - 2014-08-18 23:37 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-16 20:55 - 2014-08-18 23:36 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-16 20:55 - 2014-08-18 23:35 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-16 20:55 - 2014-08-18 23:27 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-16 20:55 - 2014-08-18 23:25 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-16 20:55 - 2014-08-18 23:25 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-16 20:55 - 2014-08-18 23:23 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-09-16 20:55 - 2014-08-18 23:22 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-16 20:55 - 2014-08-18 23:19 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-16 20:55 - 2014-08-18 23:17 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-16 20:55 - 2014-08-18 23:17 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-16 20:55 - 2014-08-18 23:15 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-16 20:55 - 2014-08-18 23:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-16 20:55 - 2014-08-18 23:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-09-16 20:55 - 2014-08-18 22:46 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-16 20:55 - 2014-08-18 22:38 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-16 20:55 - 2014-08-18 22:36 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-16 20:54 - 2014-08-19 00:26 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-16 20:54 - 2014-08-19 00:08 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-16 20:54 - 2014-08-18 23:23 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-16 20:54 - 2014-08-18 23:16 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-16 20:54 - 2014-08-18 23:15 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-16 20:54 - 2014-08-18 23:08 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-16 20:54 - 2014-08-18 22:55 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-16 20:54 - 2014-08-18 22:38 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-16 20:41 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-16 20:41 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-15 19:41 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-15 19:41 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-15 19:41 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-15 19:41 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-15 19:41 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-15 19:41 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-15 19:41 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-15 19:41 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-15 19:41 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-15 19:41 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-15 19:41 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 17:03 - 2014-08-23 04:07 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-09-04 17:03 - 2014-08-23 03:45 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-09-04 17:03 - 2014-08-23 02:59 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-04 16:50 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-09-04 16:50 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-09-04 16:50 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-09-04 16:50 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-09-04 16:50 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-09-04 16:50 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-09-04 16:49 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-09-04 16:49 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 14:13 - 2013-02-12 21:06 - 01134148 _____ () C:\Windows\WindowsUpdate.log
2014-10-02 13:39 - 2013-02-21 16:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 12:58 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-02 12:58 - 2009-07-14 06:45 - 00022368 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-02 12:50 - 2013-02-13 22:00 - 00169454 _____ () C:\Windows\PFRO.log
2014-10-02 12:50 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-02 12:50 - 2009-07-14 06:51 - 00038222 _____ () C:\Windows\setupact.log
2014-10-02 12:32 - 2014-04-05 15:59 - 00000000 ____D () C:\Users\Filou\AppData\Local\140A6CB7-1884-4CD9-B6A9-4C0705B90E48.aplzod
2014-10-02 12:17 - 2014-05-01 22:48 - 00000000 ____D () C:\Users\Filou\AppData\Roaming\Dropbox
2014-10-02 11:49 - 2014-05-01 22:51 - 00000000 ___RD () C:\Users\Filou\Dropbox
2014-10-02 05:48 - 2009-07-14 19:58 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-10-02 05:48 - 2009-07-14 19:58 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-10-02 05:48 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-02 05:40 - 2013-02-17 17:01 - 00002066 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-10-02 04:18 - 2013-02-12 21:18 - 00000000 ____D () C:\Users\Filou
2014-09-28 16:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-28 15:13 - 2013-02-17 17:22 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-25 14:27 - 2013-02-13 21:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-24 23:48 - 2013-02-17 17:46 - 00000000 ____D () C:\Users\Filou\Documents\Outlook-Dateien
2014-09-23 15:00 - 2013-02-24 22:44 - 00000000 ____D () C:\Belladine
2014-09-22 13:57 - 2013-03-10 15:42 - 00000000 ____D () C:\Generali
2014-09-16 20:54 - 2013-02-17 17:09 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-16 20:53 - 2013-12-30 20:38 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-16 20:52 - 2013-09-26 17:15 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-16 20:42 - 2013-02-13 19:52 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-16 20:41 - 2014-05-25 23:03 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-15 20:08 - 2009-07-14 06:45 - 00408392 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-10 20:39 - 2013-02-21 16:44 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-10 20:39 - 2013-02-21 16:44 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-10 20:39 - 2013-02-21 16:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-04 17:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
Some content of TEMP:
====================
C:\Users\Filou\AppData\Local\Temp\AskSLib.dll
C:\Users\Filou\AppData\Local\Temp\avgnt.exe
C:\Users\Filou\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp4kgjx0.dll
C:\Users\Filou\AppData\Local\Temp\GLF1F8.EXE
C:\Users\Filou\AppData\Local\Temp\GLF2320.EXE
C:\Users\Filou\AppData\Local\Temp\GLF2E45.EXE
C:\Users\Filou\AppData\Local\Temp\GLF3335.EXE
C:\Users\Filou\AppData\Local\Temp\GLF34BC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF3FC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF4501.EXE
C:\Users\Filou\AppData\Local\Temp\GLF458D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5A1.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5B9C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF5DBE.EXE
C:\Users\Filou\AppData\Local\Temp\GLF659A.EXE
C:\Users\Filou\AppData\Local\Temp\GLF66B3.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7073.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7258.EXE
C:\Users\Filou\AppData\Local\Temp\GLF746A.EXE
C:\Users\Filou\AppData\Local\Temp\GLF767C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7BF9.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7D8D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF7E1B.EXE
C:\Users\Filou\AppData\Local\Temp\GLF801C.EXE
C:\Users\Filou\AppData\Local\Temp\GLF81A3.EXE
C:\Users\Filou\AppData\Local\Temp\GLF81A4.EXE
C:\Users\Filou\AppData\Local\Temp\GLF825D.EXE
C:\Users\Filou\AppData\Local\Temp\GLF83C4.EXE
C:\Users\Filou\AppData\Local\Temp\GLF85C7.EXE
C:\Users\Filou\AppData\Local\Temp\GLF8B15.EXE
C:\Users\Filou\AppData\Local\Temp\GLF98AC.EXE
C:\Users\Filou\AppData\Local\Temp\GLF9C83.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA345.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA5A7.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA662.EXE
C:\Users\Filou\AppData\Local\Temp\GLFA98C.EXE
C:\Users\Filou\AppData\Local\Temp\GLFADD.EXE
C:\Users\Filou\AppData\Local\Temp\GLFB408.EXE
C:\Users\Filou\AppData\Local\Temp\GLFBEE0.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC1DD.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC5B4.EXE
C:\Users\Filou\AppData\Local\Temp\GLFC74B.EXE
C:\Users\Filou\AppData\Local\Temp\GLFCA46.EXE
C:\Users\Filou\AppData\Local\Temp\GLFCB30.EXE
C:\Users\Filou\AppData\Local\Temp\GLFD08D.EXE
C:\Users\Filou\AppData\Local\Temp\GLFDC20.EXE
C:\Users\Filou\AppData\Local\Temp\GLFEC48.EXE
C:\Users\Filou\AppData\Local\Temp\GLFED5F.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF0BA.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF0D8.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF5E8.EXE
C:\Users\Filou\AppData\Local\Temp\GLFF673.EXE
C:\Users\Filou\AppData\Local\Temp\GLFFFD.EXE
C:\Users\Filou\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Filou\AppData\Local\Temp\ose00000.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-28 16:00
==================== End Of Log ============================
--- --- --- Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-10-2014 01
Ran by Filou at 2014-10-02 14:24:19
Running from C:\Users\Filou\Desktop\Trojaner Board\Analyse
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite MFC-235C (HKLM-x32\...\{A3FEC306-FBFF-4B0D-95B9-F9C67C65079E}) (Version: 1.0.2.0 - Brother Industries, Ltd.)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.7000.4 - Dolby Laboratories Inc)
HW Gobi 3000 Driver 1.08.00.00 (HKLM-x32\...\HW Gobi 3000 Driver) (Version: 1.08.00.00 - Huawei technologies Co., Ltd.)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.4.1441 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (HKLM\...\{37EC048A-81A2-452A-8D1F-3BE2018E767D}) (Version: 15.1.0.0096 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{F0932859-AA60-459E-B843-0BDECA34E2C7}) (Version: 2.0.0.0086 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{E97F409F-9E1C-42A0-B72D-765A78DF3696}) (Version: 15.01.0000.0830 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Iomega Encryption (HKLM\...\{578831A8-CB47-471F-A552-907EC3E9E040}) (Version: 1.03.0001 - Iomega an EMC Company)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217021FF}) (Version: 7.0.210 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.5 - Sun Microsystems, Inc.) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
OneClick Internet (HKLM-x32\...\OneClickInternet) (Version: 3.0 - OneClick Internet)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{E727B31A-8B24-4C1C-934A-69634E0D2C0B}) (Version: 9.2 - Qualcomm Atheros)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.61.612.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)
RemoteComms External Disk Access (HKLM-x32\...\{04FCD5DE-1662-4F99-BDA9-C57212113EF2}) (Version: 1.25.0003 - PLX Technology)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Sierra Wireless AirCard Watcher (HKLM-x32\...\{A12F8C2E-765C-4589-8DC6-82C3D7A8709B}) (Version: 6.0.3411.7504 - Sierra Wireless Inc.)
Sierra Wireless QMI Driver Package (HKLM-x32\...\SWIQMIDrvInstaller) (Version: 1.0.34.0 - Sierra Wireless Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.0.5 - Synaptics Incorporated)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3005798335-2976664300-485891405-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Filou\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
==================== Restore Points =========================
15-09-2014 17:30:59 Windows Update
16-09-2014 18:38:40 Windows Update
25-09-2014 01:00:26 Windows Update
02-10-2014 01:00:23 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {13F66F93-DEE2-48C2-8AF6-7FAEEA954E26} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3EE8796C-6FE8-45E8-87DA-7D32ECA45ABE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-10] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (whitelisted) =============
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-02-12 22:49 - 2012-05-01 02:05 - 00127320 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2013-02-12 22:14 - 2011-03-09 12:40 - 00342984 ____N () C:\Program Files (x86)\OneClickInternet\WTGService.exe
2012-12-14 03:42 - 2012-12-14 03:42 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 21:58 - 2014-02-12 21:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2011-11-03 18:39 - 2011-11-03 18:39 - 00251248 _____ () C:\Program Files (x86)\Sierra Wireless Inc\WebUpdater\WebUpdtAPI.dll
2013-03-29 21:11 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-09-16 21:25 - 2014-09-16 21:25 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\27372090b75ca919048606aad2206bf4\IsdiInterop.ni.dll
2013-02-12 22:40 - 2012-02-01 17:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2013-02-12 22:43 - 2012-05-01 02:06 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-3005798335-2976664300-485891405-500 - Administrator - Disabled)
Filou (S-1-5-21-3005798335-2976664300-485891405-1000 - Administrator - Enabled) => C:\Users\Filou
Gast (S-1-5-21-3005798335-2976664300-485891405-501 - Limited - Disabled)
==================== Faulty Device Manager Devices =============
Name: PCI-Gerät
Description: PCI-Gerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/02/2014 02:11:18 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:55:09 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:55:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:55:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:53:32 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:53:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:53:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:53:04 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (10/02/2014 00:50:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: ZeroConfigService.exe, Version: 15.1.0.2, Zeitstempel: 0x4f4a262d
Name des fehlerhaften Moduls: MurocApi.dll, Version: 15.1.0.1, Zeitstempel: 0x4f4a2503
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002084b
ID des fehlerhaften Prozesses: 0x928
Startzeit der fehlerhaften Anwendung: 0xZeroConfigService.exe0
Pfad der fehlerhaften Anwendung: ZeroConfigService.exe1
Pfad des fehlerhaften Moduls: ZeroConfigService.exe2
Berichtskennung: ZeroConfigService.exe3
Error: (10/02/2014 00:47:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
System errors:
=============
Error: (10/02/2014 00:51:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (10/02/2014 00:50:14 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x000000f4 (0x0000000000000006, 0xfffffa80089a3b50, 0xfffffa80089aae10, 0xfffff80003183240)C:\Windows\MEMORY.DMP100214-14367-01
Error: (10/02/2014 00:50:09 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.10.2014 um 12:48:55 unerwartet heruntergefahren.
Error: (10/02/2014 05:20:20 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet:
%%-2147196306
Error: (10/02/2014 05:18:09 AM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 02.10.2014 um 05:16:29 unerwartet heruntergefahren.
Error: (10/01/2014 10:26:11 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Error: (09/24/2014 11:39:31 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Capability Licensing Service Interface" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
Error: (09/24/2014 11:38:46 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E28EE682-E406-4254-8CEB-736616138E89}
Error: (09/15/2014 08:10:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "iPod-Dienst" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (09/15/2014 08:10:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst iPod-Dienst erreicht.
Microsoft Office Sessions:
=========================
Error: (10/02/2014 02:11:18 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (10/02/2014 00:55:09 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:55:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:55:03 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:53:32 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:53:21 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:53:20 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:53:04 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
Error: (10/02/2014 00:50:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: ZeroConfigService.exe15.1.0.24f4a262dMurocApi.dll15.1.0.14f4a2503c0000005000000000002084b92801cfde2eaed2d61aC:\Program Files\Intel\WiFi\bin\ZeroConfigService.exeC:\Program Files\Intel\WiFi\bin\MurocApi.dllfd2902e6-4a21-11e4-997e-c485088ddd5c
Error: (10/02/2014 00:47:00 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Filou\Desktop\Trojaner Board\Problembehebung\esetsmartinstaller_deu.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 38%
Total physical RAM: 3996.36 MB
Available physical RAM: 2442.02 MB
Total Pagefile: 7990.9 MB
Available Pagefile: 6271.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:244.04 GB) (Free:140.62 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: () (Fixed) (Total:221.62 GB) (Free:221.52 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D61AB77A)
Partition 1: (Active) - (Size=244 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=221.6 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
03.10.2014, 11:10
| #4 |
| /// the machine /// TB-Ausbilder | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Gerne kannste spenden, schau mal in meine Signatur Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.10.2014, 12:56
| #5 |
| | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Hallo Schrauber, danke Dir vielmals für Deine Antwort! Ich habe soeben versucht, den letzten Schritt mit FRST zu starten, aber irgendwie funktioniert es bei mir nicht mehr. Ich habe drei Versuche gestartet aber es kommt immer die Fehlermeldung: Farbar Recovery Scan Tool funktioniert nicht mehr - Das Programm wird aufgrund eines Problems nicht richtig ausgeführt. Das Programm wird geschlossen und Sie werden benachrichtigt, wenn eine Lösung verfügbar ist. Schaue ich im Windows Explorer nach, so finde ich jetzt weitere FRST.exe-Dateien und einen Ordner mit FRST-Older Version. Was tun? Danke für Deine Hilfe! Lilo |
|
04.10.2014, 13:46
| #6 |
| /// the machine /// TB-Ausbilder | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Lösch FRST und lade es mal neu.
__________________ --> Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? |
|
05.10.2014, 21:27
| #7 |
| | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Hallo Schrauber, alle Schritte sind nun erledigt und die Fixlog-Datei sieht wie folgt aus: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 05-10-2014
Ran by Filou at 2014-10-05 19:07:56 Run:5
Running from C:\Users\Filou\Desktop\Trojaner Board\Problembehebung
Loaded Profile: Filou (Available profiles: Filou)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
Emptytemp:
*****************
Der Rechner dürfte nun clean sein, oder? Danke Dir auch für all Deine zusätzlichen Tipps und Hinweise, die ich gerne befolge... Bin wirklich so froh, dass Du mir mit so viel Geduld geholfen hast!  Viele Grüße Lilo |
|
06.10.2014, 18:31
| #8 |
| /// the machine /// TB-Ausbilder | Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Antivir Pro hat Java/Lamar.gtq.35 entdeckt - wie entfernen? |
| bluescreen 0x000000f4, bonjour, browser, desktop, device driver, entfernen, fehlercode 0xc0000005, fehlercode 1, fehlercode 28, fehlercode windows, flash player, hdd0(c:, installation, internet, java/lamar.gta.19, java/lamar.gtq.33, java/lamar.gtq.34, java/lamar.gtq.35, netzwerk, programm, registry, sierra, software, svchost.exe, trojaner, warnung, wie entfernen?, windows, wuauclt.exe |
Linear-Darstellung
