| |
| |||||||
Log-Analyse und Auswertung: Windows 8 - Audio-Werbung im Hintergrund!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
26.01.2015, 15:23
| #1 |
| |  Windows 8 - Audio-Werbung im Hintergrund! Hallo!! Seid zwei Tagen erscheinen bei mir immer zwischendurch im Hintergrund Werbe-Audios, die ungefähr 20 Sek dauern und dann wieder verschwinden. Außerdem poppen immer wieder kurz Fenster auf, die dann aber sofort wieder verschwinden, sie sind ohne Inhalt, es sieht nur kurz so aus, als würde sich etwas öffnen, der Laptop arbeitet, geschiehen tut dann aber nichts. Ich habe mit dem Programm Revo Uninstaller schon einige unerwünschte Programme deinstalliert und gelöscht (Namen wie QuickDeaaaal und ähnliche), das Problem besteht aber weiterhin. Kann mir jemand helfen? Liebe Grüße. Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 24-01-2015 01
Ran by Friederike Volkmann at 2015-01-26 15:08:23
Running from C:\Users\Rike Volkmann\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Absolute Reminder (HKLM-x32\...\{40F4FF7A-B214-4453-B973-080B09CED019}) (Version: 2.1.0.8 - Absolute Software)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Amazon Browser App (HKLM-x32\...\{0A7D6F3C-F2AB-48ED-BE23-99791BFF87D6}) (Version: 1.0.0.0 - Amazon)
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audible Download Manager (HKLM-x32\...\AudibleDownloadManager) (Version: 6.6.0.15 - Audible, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon MG5100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5100_series) (Version: - )
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.4.0.28 - Swiss Academic Software)
CyberLink Media Suite Essentials (HKLM-x32\...\InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}) (Version: 10.0 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dell Digital Delivery (HKLM-x32\...\{D9ED3EFC-AB00-4CE0-ADED-80EE6B1158A7}) (Version: 2.2.2000.0 - Dell Products, LP)
Dell Support Center (HKLM\...\PC-Doctor for Windows) (Version: 3.2.6032.39 - PC-Doctor, Inc.)
Dell Touchpad (HKLM\...\SynTPDeinstKey) (Version: 16.2.10.3 - Synaptics Incorporated)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Dell Inc.)
Dropbox (HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
DSC/AA Factory Installer (Version: 3.2.6032.39 - PC-Doctor, Inc.) Hidden
Fotogalerie (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Free YouTube to MP3 Converter version 3.12.0.128 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.0.128 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.91 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 15.0.4675.1003 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3503.0728 - Microsoft Corporation) Hidden
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 32.0.2 - Mozilla)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4675.1003 - Microsoft Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.204 - Ihr Firmenname)
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.1.003 - Dell Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 6.20 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.20.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3503.0728 - Microsoft Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> "C:\WINDOWS\system32\igfxEM.exe" No File
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
09-01-2015 18:52:34 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
14-01-2015 12:54:12 Windows Update
25-01-2015 15:48:22 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
25-01-2015 15:48:22 Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1BB470E8-A6A7-4F76-88DB-50264437D833} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2D3F9691-403B-48F7-AF7A-E24AD50A1996} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {470B5DF2-1AE6-4959-9F79-56AAEBA293A3} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2012-07-17] (PC-Doctor, Inc.)
Task: {48E675D8-EC88-4413-8EA8-9FE090588C81} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-11-04] (Microsoft Corporation)
Task: {4A4A753D-DC9C-45DE-A6CA-73D50169FF8F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)
Task: {51BEC15D-43AC-45BD-B955-221F1F2DC980} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {9AFFCCB4-E19A-4EDF-845D-64BE8BD6DD50} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2012-07-17] (PC-Doctor, Inc.)
Task: {A708129B-BE01-4E48-BB61-9DE88562B6D0} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-11-12] (Microsoft Corporation)
Task: {A7C93678-CBAE-4AEB-BE43-C8AC66BDD86C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-10-07] (Microsoft Corporation)
Task: {BB130F91-88B8-47DA-8491-D9F9874B6628} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: {BB2D4F5D-A0F2-4610-8D71-79BB5C82C549} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {EFBC7B51-4683-43B0-86C8-4215E739E0EB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-25] (Google Inc.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2014-09-25 11:04 - 2014-05-20 08:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-10-29 20:36 - 2012-04-25 03:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2014-08-23 13:06 - 2014-08-23 13:06 - 00709120 _____ () C:\Program Files\005\vulsrsebjh64.exe
2015-01-25 15:31 - 2015-01-25 15:31 - 01169920 _____ () c:\windows\temp\db24.exe
2015-01-09 18:52 - 2015-01-12 13:55 - 00091304 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
2012-08-01 01:10 - 2012-08-01 01:10 - 00384128 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\ContactsApi.dll
2012-08-01 01:05 - 2012-08-01 01:05 - 00020992 _____ () C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\L10n\de-DE\BtTray.de-DE.dll
2012-10-06 00:12 - 2012-10-06 00:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-05-22 19:50 - 2013-05-22 19:50 - 00400704 _____ () C:\Users\Rike Volkmann\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
2015-01-26 15:05 - 2015-01-26 15:05 - 00050477 _____ () C:\Users\Rike Volkmann\Downloads\Defogger.exe
2012-10-29 20:34 - 2012-06-08 04:34 - 00627216 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2012-06-08 17:34 - 2012-06-08 17:34 - 00016400 _____ () C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00750080 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-01-26 11:18 - 2015-01-26 11:18 - 00043008 _____ () c:\Users\Rike Volkmann\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyvqmkj.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00047616 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\libEGL.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00863744 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2014-10-22 01:22 - 2014-10-22 01:22 - 00200704 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2012-08-10 16:51 - 2012-08-10 16:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2015-01-25 16:44 - 2015-01-21 04:50 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libglesv2.dll
2015-01-25 16:44 - 2015-01-21 04:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\libegl.dll
2015-01-25 16:44 - 2015-01-21 04:50 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.91\pdf.dll
2015-01-09 18:52 - 2015-01-19 17:22 - 51542184 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe
2015-01-09 18:52 - 2015-01-07 22:22 - 01360552 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\libglesv2.dll
2015-01-09 18:52 - 2015-01-07 22:22 - 00214184 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\libegl.dll
2015-01-09 18:52 - 2015-01-07 22:22 - 00985768 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\ffmpegsumo.dll
2015-01-09 18:52 - 2015-01-07 22:22 - 16827048 _____ () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\NPSWF32_15_0_0_189.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Rike Volkmann\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Administrator (S-1-5-21-3189138124-3710648530-2942340369-500 - Administrator - Disabled)
Friederike Volkmann (S-1-5-21-3189138124-3710648530-2942340369-1001 - Administrator - Enabled) => C:\Users\Rike Volkmann
Gast (S-1-5-21-3189138124-3710648530-2942340369-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3189138124-3710648530-2942340369-1003 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/26/2015 11:39:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (01/26/2015 11:36:09 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Rikes-Laptop)
Description: Die Anwendung oder der Dienst "Apple Mobile Device" konnte nicht neu gestartet werden.
Error: (01/26/2015 11:19:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0x1698
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 11:00:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0x464
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 10:24:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0x1554
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 10:20:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0xa2c
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 10:15:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0xfa8
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 09:58:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0x6cc
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 09:54:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0x874
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
Error: (01/25/2015 09:28:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Name des fehlerhaften Moduls: compatibilitycheck.exe, Version: 0.0.0.0, Zeitstempel: 0x54bd82c9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0009587e
ID des fehlerhaften Prozesses: 0xaac
Startzeit der fehlerhaften Anwendung: 0xcompatibilitycheck.exe0
Pfad der fehlerhaften Anwendung: compatibilitycheck.exe1
Pfad des fehlerhaften Moduls: compatibilitycheck.exe2
Berichtskennung: compatibilitycheck.exe3
Vollständiger Name des fehlerhaften Pakets: compatibilitycheck.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: compatibilitycheck.exe5
System errors:
=============
Error: (01/26/2015 11:36:09 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (01/26/2015 11:36:09 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (01/26/2015 11:16:32 AM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "O2",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{E6FD7EBC-9C00-4639-B029-DD9EE0E92A6E}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.
Error: (01/25/2015 06:11:31 PM) (Source: DCOM) (EventID: 10010) (User: Rikes-Laptop)
Description: {1B1F472E-3221-4826-97DB-2C2324D389AE}
Error: (01/25/2015 06:10:59 PM) (Source: DCOM) (EventID: 10010) (User: Rikes-Laptop)
Description: {BF6C1E47-86EC-4194-9CE5-13C15DCB2001}
Error: (01/25/2015 04:22:10 PM) (Source: DCOM) (EventID: 10010) (User: Rikes-Laptop)
Description: {ED1D0FDF-4414-470A-A56D-CFB68623FC58}
Error: (01/25/2015 03:48:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Compatibility Verify" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/25/2015 03:33:06 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Dell Digital Delivery Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (01/25/2015 03:30:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CouponarificService64" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (01/25/2015 03:30:53 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 24.01.2015 um 15:06:51 unerwartet heruntergefahren.
Microsoft Office Sessions:
=========================
Error: (01/26/2015 11:39:06 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005
Error: (01/26/2015 11:36:09 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Rikes-Laptop)
Description: 0AppleMobileDeviceService.exeApple Mobile Device03026217815520
Error: (01/26/2015 11:19:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587e169801d039510b03c49fC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exed0f522a8-a544-11e4-bea6-7845c4b78f96
Error: (01/25/2015 11:00:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587e46401d038e9ef03d6ffC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe8489b641-a4dd-11e4-bea6-7845c4b78f96
Error: (01/25/2015 10:24:29 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587e155401d038e4edceec7bC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe8b3c7aaf-a4d8-11e4-bea6-7845c4b78f96
Error: (01/25/2015 10:20:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587ea2c01d038e4374e6076C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe019e4b29-a4d8-11e4-bea6-7845c4b78f96
Error: (01/25/2015 10:15:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587efa801d038e38123c3f4C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe393b3286-a4d7-11e4-bea6-7845c4b78f96
Error: (01/25/2015 09:58:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587e6cc01d038e1576c1923C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exef4637f4d-a4d4-11e4-bea6-7845c4b78f96
Error: (01/25/2015 09:54:07 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587e87401d038e0a0b8739eC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exe4d6cb6eb-a4d4-11e4-bea6-7845c4b78f96
Error: (01/25/2015 09:28:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: compatibilitycheck.exe0.0.0.054bd82c9compatibilitycheck.exe0.0.0.054bd82c9c00000050009587eaac01d038dd0b47fd27C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeC:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitycheck.exeb413b5f8-a4d0-11e4-bea6-7845c4b78f96
CodeIntegrity Errors:
===================================
Date: 2015-01-26 15:08:13.395
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imthx64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:08:13.335
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:08:13.147
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imthx64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:08:13.083
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:04.917
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imthx64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:04.834
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:04.628
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imthx64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:04.569
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imapo64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:02.593
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imthx64.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-01-26 15:07:02.530
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\Windows\System32\imapo64.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-3217U CPU @ 1.80GHz
Percentage of memory in use: 58%
Total physical RAM: 3962.51 MB
Available physical RAM: 1639.5 MB
Total Pagefile: 4666.51 MB
Available Pagefile: 2355.58 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:452.3 GB) (Free:380.26 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 361FCE16)
Partition: GPT Partition Type.
========================================================
Disk: 1 (Size: 8 GB) (Disk ID: FA6B946E)
Partition: GPT Partition Type.
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Friederike Volkmann (administrator) on RIKES-LAPTOP on 26-01-2015 15:07:17
Running from C:\Users\Rike Volkmann\Downloads
Loaded Profiles: Friederike Volkmann (Available profiles: Friederike Volkmann)
Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
() C:\Program Files\005\vulsrsebjh64.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Windows\Temp\db24.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Qualcomm Atheros) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe
(Atheros Communications) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Users\Rike Volkmann\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe
(Spotify Ltd) C:\Users\Rike Volkmann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Audible, Inc.) C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Dropbox, Inc.) C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Rike Volkmann\Downloads\Defogger.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [QuickSet] => c:\Program Files\Dell\QuickSet\QuickSet.exe [3759504 2012-07-20] (Dell Inc.)
HKLM\...\Run: [BtTray] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe [763520 2012-08-01] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] => C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe [127616 2012-08-01] (Atheros Communications)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-15] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-07-24] (IDT, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] => C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] => C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-02] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\...\Run: [AmazonMP3DownloaderHelper] => C:\Users\Rike Volkmann\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-22] ()
HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\...\Run: [Spotify Web Helper] => C:\Users\Rike Volkmann\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-13] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
Startup: C:\Users\Rike Volkmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Rike Volkmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKU\S-1-5-21-3189138124-3710648530-2942340369-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSE1
SearchScopes: HKU\S-1-5-21-3189138124-3710648530-2942340369-1001 -> {C60BBC6C-479C-412A-8EC3-E49FD91564AF} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: deaal4me -> {b9d6317b-646f-4e9e-85fd-dcf04ac1d4d0} -> C:\ProgramData\deaal4me\VjTf1AW77z5IuY.x64.dll No File
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\WINDOWS\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Rike Volkmann\AppData\Roaming\Mozilla\Firefox\Profiles\e5w1e129.default-1410297490929
FF Homepage: hxxp://www.ecosia.org/
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3189138124-3710648530-2942340369-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Rike Volkmann\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF Extension: Adblock Plus - C:\Users\Rike Volkmann\AppData\Roaming\Mozilla\Firefox\Profiles\e5w1e129.default-1410297490929\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-09-23]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2014-11-10]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR StartupUrls: Default -> "hxxp://www.ecosia.de/"
CHR Profile: C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-25]
CHR Extension: (Google Docs) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-25]
CHR Extension: (Google Drive) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-01-25]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-25]
CHR Extension: (YouTube) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-01-25]
CHR Extension: (Google-Suche) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-01-25]
CHR Extension: (Google Tabellen) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-25]
CHR Extension: (Google Wallet) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-25]
CHR Extension: (Google Mail) - C:\Users\Rike Volkmann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-01-25]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [207488 2012-08-01] (Qualcomm Atheros Commnucations)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [321024 2013-08-22] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2449592 2014-11-12] (Microsoft Corporation)
S2 DellDigitalDelivery; c:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe [173056 2012-06-19] (Dell Products, LP.) [File not signed]
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [321536 2012-07-24] (IDT, Inc.) [File not signed]
R4 Verifies and fixes application compatibility issues; C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier\compatibilitychecksvc.exe [91304 2015-01-12] ()
R2 vulsrsebjh64; C:\Program Files\005\vulsrsebjh64.exe [709120 2014-08-23] () [File not signed]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [77824 2012-07-23] (Atheros) [File not signed]
S2 CouponarificService64; C:\Program Files (x86)\0892CCEA-3029-46F2-BD98-F3177431F5F8\xtloowpkjv64.exe [X]
S3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-01] (Qualcomm Atheros)
S3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [131584 2013-08-22] (Microsoft Corporation)
S3 BthHFAud; C:\Windows\system32\DRIVERS\BthHfAud.sys [32640 2013-08-22] (Microsoft Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
S3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [41168 2014-11-19] (NetFilterSDK.com)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-15] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-15] (Synaptics Incorporated)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-26 15:07 - 2015-01-26 15:07 - 00016840 _____ () C:\Users\Rike Volkmann\Downloads\FRST.txt
2015-01-26 15:07 - 2015-01-26 15:07 - 00000000 ____D () C:\FRST
2015-01-26 15:06 - 2015-01-26 15:07 - 02129920 _____ (Farbar) C:\Users\Rike Volkmann\Downloads\FRST64.exe
2015-01-26 15:06 - 2015-01-26 15:06 - 01120768 _____ (Farbar) C:\Users\Rike Volkmann\Downloads\FRST.exe
2015-01-26 15:05 - 2015-01-26 15:05 - 00050477 _____ () C:\Users\Rike Volkmann\Downloads\Defogger.exe
2015-01-26 15:05 - 2015-01-26 15:05 - 00000500 _____ () C:\Users\Rike Volkmann\Downloads\defogger_disable.log
2015-01-26 15:05 - 2015-01-26 15:05 - 00000000 _____ () C:\Users\Rike Volkmann\defogger_reenable
2015-01-26 11:21 - 2015-01-26 11:21 - 00001286 _____ () C:\Users\Rike Volkmann\Desktop\Revo Uninstaller.lnk
2015-01-26 11:21 - 2015-01-26 11:21 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2015-01-26 11:20 - 2015-01-26 11:20 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Rike Volkmann\Downloads\revosetup95.exe
2015-01-26 11:16 - 2015-01-26 11:16 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2015-01-26 11:16 - 2015-01-26 11:16 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Adobe
2015-01-26 11:16 - 2015-01-26 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2015-01-26 11:16 - 2015-01-26 11:16 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Adobe
2015-01-25 16:44 - 2015-01-25 16:44 - 00002273 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-25 16:44 - 2015-01-25 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-01-25 16:39 - 2015-01-26 14:44 - 00001162 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-25 16:39 - 2015-01-26 11:18 - 00001158 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-25 16:39 - 2015-01-25 16:39 - 00004134 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-01-25 16:39 - 2015-01-25 16:39 - 00003898 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-01-25 16:38 - 2015-01-25 16:38 - 00880784 _____ (Google Inc.) C:\Users\Rike Volkmann\Downloads\ChromeSetup.exe
2015-01-25 16:25 - 2015-01-26 14:58 - 00000112 _____ () C:\ProgramData\8fAo0362.dat
2015-01-14 12:38 - 2014-12-19 07:26 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxdav.sys
2015-01-14 12:38 - 2014-12-12 03:04 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWbPrxy.exe
2015-01-14 12:38 - 2014-12-12 01:51 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ahcache.sys
2015-01-14 12:38 - 2014-12-09 02:50 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00535640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00531616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ci.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00448792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00413248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00372408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00108944 _____ (Microsoft Corporation) C:\WINDOWS\system32\EncDump.dll
2015-01-14 12:38 - 2014-12-08 20:42 - 00038264 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFaultSecure.exe
2015-01-14 12:38 - 2014-12-08 20:42 - 00033584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFaultSecure.exe
2015-01-14 12:38 - 2014-12-06 04:17 - 00360448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncsi.dll
2015-01-14 12:38 - 2014-12-06 02:41 - 00391680 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlasvc.dll
2015-01-14 12:38 - 2014-12-06 02:35 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEndpointBuilder.dll
2015-01-14 12:38 - 2014-10-29 05:00 - 00465320 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2015-01-14 12:38 - 2014-10-29 05:00 - 00139984 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe
2015-01-14 12:38 - 2014-10-29 04:52 - 00500016 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioSes.dll
2015-01-14 12:38 - 2014-10-29 04:52 - 00482872 _____ (Microsoft Corporation) C:\WINDOWS\system32\AudioEng.dll
2015-01-14 12:38 - 2014-10-29 04:52 - 00394120 _____ (Microsoft Corporation) C:\WINDOWS\system32\AUDIOKSE.dll
2015-01-14 12:38 - 2014-10-29 04:52 - 00272248 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiodg.exe
2015-01-14 12:38 - 2014-10-29 04:12 - 00413136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2015-01-14 12:38 - 2014-10-29 04:12 - 00136296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe
2015-01-14 12:38 - 2014-10-29 04:07 - 00424544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioEng.dll
2015-01-14 12:38 - 2014-10-29 04:07 - 00370424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AudioSes.dll
2015-01-14 12:38 - 2014-10-29 04:07 - 00344536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AUDIOKSE.dll
2015-01-14 12:38 - 2014-10-29 03:44 - 00037888 _____ (Microsoft Corporation) C:\WINDOWS\system32\werdiagcontroller.dll
2015-01-14 12:38 - 2014-10-29 02:59 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werdiagcontroller.dll
2015-01-14 12:38 - 2014-10-29 02:24 - 00086016 _____ (Microsoft Corporation) C:\WINDOWS\system32\nlaapi.dll
2015-01-14 12:38 - 2014-10-29 02:02 - 00911360 _____ (Microsoft Corporation) C:\WINDOWS\system32\audiosrv.dll
2015-01-14 12:38 - 2014-10-29 02:01 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nlaapi.dll
2015-01-09 18:52 - 2015-01-26 15:07 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Roaming\Compatibility Verifier
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-26 15:05 - 2014-06-24 13:01 - 00000000 ____D () C:\Users\Rike Volkmann
2015-01-26 15:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-26 14:57 - 2014-06-24 13:12 - 01609208 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-26 14:40 - 2014-03-18 11:03 - 01780340 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-26 14:40 - 2014-03-18 10:25 - 00766620 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-26 14:40 - 2014-03-18 10:25 - 00159902 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-26 11:48 - 2013-01-12 20:11 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3189138124-3710648530-2942340369-1001
2015-01-26 11:36 - 2013-01-14 11:31 - 00000000 ____D () C:\ProgramData\Apple
2015-01-26 11:33 - 2014-09-22 08:02 - 00000000 ____D () C:\ProgramData\8c1ffd0d0da0099d
2015-01-26 11:18 - 2014-08-11 15:01 - 00000000 ___RD () C:\Users\Rike Volkmann\Dropbox
2015-01-26 11:18 - 2014-08-11 14:42 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Roaming\Dropbox
2015-01-25 23:13 - 2014-01-03 19:21 - 00000000 ____D () C:\Users\Rike Volkmann\Documents\FreundeFamilie
2015-01-25 18:12 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-25 16:44 - 2013-01-24 18:11 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Local\Google
2015-01-25 16:44 - 2013-01-24 18:10 - 00000000 ____D () C:\Program Files (x86)\Google
2015-01-25 15:31 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-25 15:30 - 2014-03-18 02:50 - 00036492 _____ () C:\WINDOWS\PFRO.log
2015-01-25 15:30 - 2013-08-22 15:46 - 00306072 _____ () C:\WINDOWS\setupact.log
2015-01-25 15:30 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-23 22:03 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2015-01-21 17:20 - 2013-01-12 20:05 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Local\Packages
2015-01-19 22:32 - 2013-08-22 16:38 - 00714720 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-01-19 22:32 - 2013-08-22 16:38 - 00106976 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-16 17:15 - 2014-10-15 11:01 - 00000000 ____D () C:\Users\Rike Volkmann\Documents\Bluetooth Folder
2015-01-16 08:45 - 2013-07-29 10:53 - 00000000 ____D () C:\Users\Rike Volkmann\Desktop\Uni
2015-01-14 17:16 - 2013-09-04 09:41 - 00000000 ____D () C:\WINDOWS\system32\MRT
2015-01-14 17:09 - 2013-01-14 12:45 - 113365784 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-01-14 13:06 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-14 10:44 - 2014-08-11 17:24 - 00275968 ___SH () C:\Users\Rike Volkmann\Downloads\Thumbs.db
2015-01-13 21:01 - 2014-02-17 17:58 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Roaming\Spotify
2015-01-13 15:11 - 2014-02-17 17:58 - 00000000 ____D () C:\Users\Rike Volkmann\AppData\Local\Spotify
2014-12-31 12:14 - 2013-01-14 12:45 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-12-30 15:56 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-28 16:29 - 2013-01-12 20:06 - 00000000 ____D () C:\ProgramData\Atheros
==================== Files in the root of some directories =======
2014-11-22 22:29 - 2014-12-09 03:02 - 0004163 _____ () C:\Users\Rike Volkmann\AppData\Local\Citavi Picker Internet Explorer Protocol.txt
2013-12-16 19:39 - 2014-01-20 17:50 - 0004608 _____ () C:\Users\Rike Volkmann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-25 16:25 - 2015-01-26 14:58 - 0000112 _____ () C:\ProgramData\8fAo0362.dat
2012-10-29 20:38 - 2012-10-29 20:38 - 0000119 _____ () C:\ProgramData\{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}.log
2012-10-29 20:34 - 2012-10-29 20:35 - 0000106 _____ () C:\ProgramData\{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}.log
2012-10-29 20:35 - 2012-10-29 20:36 - 0000111 _____ () C:\ProgramData\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}.log
2012-10-29 20:33 - 2012-10-29 20:34 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2012-10-29 20:36 - 2012-10-29 20:38 - 0000108 _____ () C:\ProgramData\{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}.log
Files to move or delete:
====================
C:\ProgramData\8fAo0362.dat
Some content of TEMP:
====================
C:\Users\Rike Volkmann\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyvqmkj.dll
C:\Users\Rike Volkmann\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe
C:\Users\Rike Volkmann\AppData\Local\Temp\nsj8EBF.tmp.exe
C:\Users\Rike Volkmann\AppData\Local\Temp\optprosetup.exe
C:\Users\Rike Volkmann\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-25 18:10
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-26 15:14:16
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002e rev.A110 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\RIKEVO~1\AppData\Local\Temp\fgldqpob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Windows Defender\MsMpEng.exe[1980] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1980] C:\WINDOWS\system32\psapi.dll!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1980] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1980] C:\WINDOWS\system32\psapi.dll!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Dell\QuickSet\quickset.exe[5904] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Dell\QuickSet\quickset.exe[5904] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Dell\QuickSet\quickset.exe[5904] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Dell\QuickSet\quickset.exe[5904] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe[5232] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff988231f6a 4 bytes [23, 88, F9, 7F]
.text C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe[5232] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff988231f82 4 bytes [23, 88, F9, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1056] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1056] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1056] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1056] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5848] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5848] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5848] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5848] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
.text C:\Windows\System32\igfxpers.exe[5368] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\Windows\System32\igfxpers.exe[5368] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\Windows\System32\igfxpers.exe[5368] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\Windows\System32\igfxpers.exe[5368] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff988231f6a 4 bytes [23, 88, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff988231f82 4 bytes [23, 88, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff9abb5169a 4 bytes [B5, AB, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff9abb516a2 4 bytes [B5, AB, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff9abb5181a 4 bytes [B5, AB, F9, 7F]
.text C:\Users\Rike Volkmann\Downloads\FRST64.exe[668] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff9abb51832 4 bytes [B5, AB, F9, 7F]
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [352:4760] fffff960008abb90
---- Processes - GMER 2.1 ----
Process C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (FILE NOT FOUND) 0000000000400000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46) 000000006caf0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 000000006c7f0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 000000006c400000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324](2014-10-22 00:22:50) 000000006d150000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (ICU I18N DLL/The ICU Project)(2014-10-22 00:22:50) 000000004a900000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (ICU Common DLL/The ICU Project)(2014-10-22 00:22:50) 0000000003fc0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (ICU Data DLL/The ICU Project)(2014-10-22 00:22:50) 000000004ad00000
Library c:\users\rikevo~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyvqmkj.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324](2015-01-26 10:18:37) 0000000003a30000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 000000006ab40000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 0000000069b50000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 0000000069930000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 00000000696d0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 00000000696a0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324](2014-10-22 00:22:50) 0000000069690000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46) 0000000069660000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 0000000069620000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 00000000695d0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324](2014-10-22 00:22:48) 00000000694f0000
Library C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Rike Volkmann\AppData\Roaming\Dropbox\bin\Dropbox.exe [5324](2014-10-22 00:22:46) 0000000069230000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 8 - Audio-Werbung im Hintergrund! |
| .dll, adware, browser, computer, converter, cpu, defender, desktop, dvdvideosoft ltd., explorer, helper, homepage, installation, office 365, onedrive, problem, programm, revo uninstaller, scan, security, server, services.exe, software, svchost.exe, temp, updates, windows, winlogon.exe, wlan |
Baum-Darstellung