| |
| |||||||
Log-Analyse und Auswertung: Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
03.02.2015, 21:47
| #1 |
| |  Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Hallo, mein Laptop ist seit einigen Wochen langsamer (nicht immer). Er bleibt ständig hängen, wenn ich im Internet surfe. Runterfahren funktioniert auch oft nicht. Beim Hochfahren führt er manchmal eine Systemprüfung durch. Der Avira Internet-Security-Suite bleibt beim Scan immer hängen, nach der Neuinstallierung meldet er etwas von Speicherort, was wie ich auf der Hilfeseite von Avira gelesen habe, wohl ein momentanter Programmfehler ist. Ich habe verschiedene kostenlose Virenscanner (Bitdefender, Norton) ausprobiert, aber sie finden nichts. Zuletzt Sophos, aber auch der bleibt hängen. Ich kenne mich leider garnicht aus und hoffe auf eure Unterstützung! Ebenso hoffe ich, dass ich die ersten Schritte richtig ausgeführt habe. Hier die Dateien: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-02-2015
Ran by cécile (administrator) on CÉCILE-HP on 03-02-2015 21:14:11
Running from C:\Users\cécile\Downloads
Loaded Profiles: cécile (Available profiles: cécile)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
( ) C:\Windows\System32\lxctcoms.exe
() C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe
(Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters).
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [184704 2012-03-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-04-03] (DivX, LLC)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\Run: [FreeAC] => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1553688 2014-02-20] (Comfort Software Group)
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\MountPoints2: {55d13acb-b40e-11e3-bb60-b4b52f926e81} - D:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\MountPoints2: {b7d788ce-0fe2-11e3-a71a-b4b52f926e81} - D:\LaunchU3.exe -a
HKU\S-1-5-18\...\Run: [Bitdefender-Geldbörse-Agent] => "C:\Program Files\Bitdefender\Bitdefender 2015\bdwtxag.exe"
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL =
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=Tuguu&dpid=TuguuCR&co=DE&userid=59520f42-dec0-4f91-f401-f5d9b7b29a92&searchtype=ds&q={searchTerms}&installDate=01/11/2013
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKU\.DEFAULT -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-19 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-20 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> 858C55D7AAA74067BE954B0C50E1AE46 URL = hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_17_ch&cd=2XzuyEtN2Y1L1Qzu0ByE0ByDtB0FzytByC0EzztC0CyDtCtCtN0D0Tzu0SzzyEzztN1L2XzutBtFtBtDtFyDtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2SyBtAzytDtAzytCtDtG0D0Fzz0AtG0D0ByBtBtGtC0CzytDtGyDyCyBzzyE0E0C0EyE0E0Ezz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEyD0B0FyE0CtAzytGyCtA0ByEtG0AyE0F0AtG0FyDzztAtGtAtDtBtDyCyD0EyBtBzz0D0B2Q&cr=325223239&ir=
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL =
BHO: SmartSaver+ 15 -> {11111111-1111-1111-1111-110611171196} -> C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-bho64.dll No File
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: ZenSearch -> {EC740D8D-BAA6-4BAF-9183-2406AB943D3A} -> C:\Program Files (x86)\ZenSearch\IeZenSearch_x64.dll (ZenSearch ApS)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: Lexmark Symbolleiste -> {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -> C:\Program Files\Lexmark Toolbar\toolband.dll ()
BHO-x32: SmartSaver+ 15 -> {11111111-1111-1111-1111-110611171196} -> C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-bho.dll No File
BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ZenSearch -> {EC740D8D-BAA6-4BAF-9183-2406AB943D3A} -> C:\Program Files (x86)\ZenSearch\IeZenSearch.dll (ZenSearch ApS)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DA2EA1BF-8971-4A13-9141-7EF004B55DED}: [NameServer] 212.23.115.148 212.23.115.132
FireFox:
========
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\S-1-5-21-527591061-3285833073-1316261535-1001: @jazz-soft.com/JazzPlugin -> C:\Program Files (x86)\Jazz-Soft\Jazz-Plugin\npJazz.dll (Jazz-Soft)
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2013-04-21]
Chrome:
=======
CHR HomePage: Default -> hxxp://www.search.ask.com/?p2=%5EB7J%5EYYYYYY%5EYY%5EDE&gct=hp&o=APN11289&apn_ptnrs=%5EB7J&apn_dtid=%5EYYYYYY%5EYY%5EDE&tpid=CME-V7&apn_dbr=cr_30.0.1599.69&trgb=CR&apn_uid=F9AFB407-2CBD-4E23-B9C4-A300DD6133DC&itbv=12.5.1.1394&doi=2013-10-11&psv=barid%253D201184952758440889612466654719012094104%2526cargo%253DCME%252DV7%2526spr%253Da%2526did%253D10717%2526ppd%253D
CHR StartupUrls: Default -> "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=249C1C3E8429C096&affID=120698&tt=02102013_mx15rbra&tsp=5033", "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-31]
CHR Extension: (Google Docs) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-30]
CHR Extension: (Google Drive) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-29]
CHR Extension: (YouTube) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-29]
CHR Extension: (Google-Suche) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-29]
CHR Extension: (Google Tabellen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-31]
CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl [2015-02-03]
CHR Extension: (Google Wallet) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29]
CHR Extension: (Bitdefender QuickScan) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2015-01-01]
CHR Extension: (Google Mail) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-29]
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-09-30]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1044784 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [807672 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1578496 2012-08-14] (IVT Corporation) [File not signed]
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2012-08-14] (IVT Corporation) [File not signed]
R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [493904 2012-03-15] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [477056 2012-11-19] (Hewlett-Packard Company)
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [365440 2012-03-14] (Hewlett-Packard Company)
R2 lxct_device; C:\windows\system32\lxctcoms.exe [546304 2006-07-13] ( )
R2 lxct_device; C:\windows\SysWOW64\lxctcoms.exe [537520 2006-11-22] ( )
R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1327104 2012-03-21] () [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-03-07] (PDF Complete Inc)
S3 SophosVirusRemovalTool; C:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [153384 2014-11-26] (Sophos Limited)
R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [498352 2012-04-05] (ArcSoft, Inc.)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc [X]
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-01-31] (Advanced Micro Devices, Inc.)
R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [42816 2012-02-03] (ArcSoft, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2014-11-24] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2014-11-24] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-11-24] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23104 2011-08-13] (Ralink Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [51776 2012-04-03] (Ralink Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48320 2012-03-05] (Ralink Corporation)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64832 2012-11-09] (Hewlett-Packard Company)
S3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-02] (Malwarebytes Corporation)
R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [93640 2012-03-22] (McAfee, Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158792 2012-03-22] (McAfee, Inc.)
R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [685152 2012-06-14] (Ralink Technology, Corp.)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1064184 2012-09-22] (Sunplus)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.)
S1 ttnfd; system32\drivers\ttnfd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 21:14 - 2015-02-03 21:14 - 00024343 _____ () C:\Users\cécile\Downloads\FRST.txt
2015-02-03 21:13 - 2015-02-03 21:14 - 00000000 ____D () C:\FRST
2015-02-03 21:13 - 2015-02-03 21:13 - 02131456 _____ (Farbar) C:\Users\cécile\Downloads\FRST64.exe
2015-02-03 21:07 - 2015-02-03 21:09 - 00000474 _____ () C:\Users\cécile\Downloads\defogger_disable.log
2015-02-03 21:07 - 2015-02-03 21:07 - 00000000 _____ () C:\Users\cécile\defogger_reenable
2015-02-03 21:06 - 2015-02-03 21:06 - 00050477 _____ () C:\Users\cécile\Downloads\Defogger.exe
2015-02-03 15:07 - 2015-02-03 15:07 - 00000000 ____D () C:\ProgramData\Sophos
2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk
2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\ProgramData\Desktop\Sophos Virus Removal Tool.lnk
2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos
2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\Program Files (x86)\Sophos
2015-02-03 15:03 - 2015-02-03 15:04 - 109810016 _____ (Sophos Limited) C:\Users\cécile\Downloads\Sophos Virus Removal Tool.exe
2015-02-03 14:53 - 2015-02-03 14:53 - 00000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp
2015-02-03 07:50 - 2015-02-03 07:50 - 00000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E}
2015-01-31 18:36 - 2015-01-31 18:36 - 03077776 ____N (Symantec Corporation) C:\Users\cécile\Downloads\NPE.exe
2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\ProgramData\Desktop\Avira Control Center.lnk
2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\Users\cécile\AppData\Roaming\Avira
2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-01-25 16:56 - 2015-01-25 16:56 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-01-25 16:56 - 2014-11-24 10:31 - 00141376 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwot.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00114608 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwim.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2015-01-25 16:56 - 2014-11-24 10:31 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2015-01-25 16:49 - 2015-01-25 16:51 - 180282552 _____ () C:\Users\cécile\Downloads\avira_internet_security_de.exe
2015-01-23 20:57 - 2015-01-23 20:57 - 00000000 __SHD () C:\found.002
2015-01-14 16:11 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 16:11 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 16:11 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 16:11 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-14 16:11 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-14 16:11 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-14 16:11 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-14 16:11 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-14 16:11 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-14 16:11 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 16:11 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 16:11 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-14 16:11 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-08 23:56 - 2015-01-08 23:56 - 00000000 ____D () C:\windows\SysWOW64\N360_BACKUP
2015-01-07 23:17 - 2015-01-07 23:17 - 00266586 _____ () C:\ProgramData\1420668987.bdinstall.bin
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Users\cécile\AppData\Roaming\Opera Software
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Users\cécile\AppData\Local\Opera Software
2015-01-06 18:15 - 2015-01-06 18:16 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-01-06 16:23 - 2015-01-06 16:23 - 00000000 ____D () C:\Users\cécile\AppData\Local\CrashDumps
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-03 21:11 - 2014-09-30 22:11 - 00003458 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6.job
2015-02-03 21:11 - 2013-07-23 14:54 - 00087008 _____ () C:\Users\cécile\AppData\Local\GDIPFONTCACHEV1.DAT
2015-02-03 21:07 - 2013-07-23 14:49 - 00000000 ____D () C:\Users\cécile
2015-02-03 21:06 - 2014-04-29 17:12 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-03 20:59 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-03 20:59 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-03 20:55 - 2014-09-30 22:11 - 00003802 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00003122 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002760 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002434 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5.job
2015-02-03 20:55 - 2014-09-30 22:11 - 00002098 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2.job
2015-02-03 20:55 - 2014-09-30 22:10 - 00004484 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11.job
2015-02-03 20:55 - 2014-09-30 22:10 - 00003122 _____ () C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3.job
2015-02-03 20:55 - 2014-04-29 17:12 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-03 20:51 - 2014-04-28 22:28 - 00029761 _____ () C:\windows\setupact.log
2015-02-03 20:51 - 2012-08-16 01:46 - 00000787 _____ () C:\windows\SysWOW64\bscs.ini
2015-02-03 20:51 - 2012-04-21 06:43 - 00000000 ____D () C:\ProgramData\PDFC
2015-02-03 20:51 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-03 20:39 - 2012-04-21 06:44 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-03 20:23 - 2014-04-27 03:23 - 00000298 _____ () C:\windows\Tasks\Price Meter Updater.job
2015-02-03 20:21 - 2013-04-21 06:30 - 02044385 _____ () C:\windows\WindowsUpdate.log
2015-02-03 15:01 - 2013-07-23 14:54 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{2CA201FC-5302-4E57-B7B5-319AB671A227}
2015-01-31 19:05 - 2013-09-14 15:26 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-31 18:52 - 2013-09-14 15:25 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-31 18:51 - 2014-10-18 09:52 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2015-01-31 18:51 - 2014-10-18 09:52 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-31 18:51 - 2014-10-18 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-31 18:42 - 2014-12-31 13:40 - 00000000 ____D () C:\Users\cécile\AppData\Local\NPE
2015-01-31 18:38 - 2014-12-31 13:42 - 00000000 ____D () C:\NPE
2015-01-29 20:05 - 2014-09-30 19:56 - 00000000 ____D () C:\Users\cécile\Desktop\Eulen
2015-01-26 21:45 - 2013-11-25 16:48 - 00000000 ____D () C:\Users\cécile\Bewerbung
2015-01-25 17:01 - 2010-11-21 04:47 - 01125082 _____ () C:\windows\PFRO.log
2015-01-25 16:56 - 2013-07-23 18:57 - 00000000 ____D () C:\ProgramData\Avira
2015-01-25 16:43 - 2009-07-14 05:45 - 00344088 _____ () C:\windows\system32\FNTCACHE.DAT
2015-01-25 16:42 - 2014-12-31 13:40 - 00000000 ____D () C:\ProgramData\Norton
2015-01-25 16:29 - 2012-04-21 06:47 - 00049402 _____ () C:\windows\DPINST.LOG
2015-01-25 16:07 - 2012-04-21 06:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 16:07 - 2012-04-21 06:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 16:07 - 2012-04-21 06:44 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-01-24 11:04 - 2013-04-21 06:38 - 00000000 ____D () C:\windows\SysWOW64\ArcVCapRender
2015-01-22 21:39 - 2013-09-18 14:29 - 00000000 ____D () C:\Users\cécile\Documents\voba
2015-01-17 18:27 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2015-01-17 03:56 - 2012-04-21 06:24 - 01676126 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2015-01-17 03:56 - 2012-04-21 04:11 - 00734482 _____ () C:\windows\system32\perfh007.dat
2015-01-17 03:56 - 2012-04-21 04:11 - 00159048 _____ () C:\windows\system32\perfc007.dat
2015-01-17 03:55 - 2009-07-14 06:13 - 01676126 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-15 15:39 - 2012-04-21 06:43 - 00000000 ____D () C:\Program Files (x86)\PDF Complete
2015-01-15 15:31 - 2013-08-11 12:49 - 00000000 ____D () C:\windows\system32\MRT
2015-01-15 15:14 - 2013-08-06 00:42 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-07 23:42 - 2014-05-06 01:54 - 00000000 ____D () C:\Program Files (x86)\FreeAlarmClock
2015-01-07 23:34 - 2014-07-17 09:45 - 00000000 ____D () C:\Program Files\Bitdefender
2015-01-07 23:17 - 2014-05-01 19:58 - 00000000 ____D () C:\ProgramData\Bitdefender
2015-01-07 23:17 - 2014-05-01 19:42 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-01-06 21:14 - 2014-06-19 00:01 - 00000000 ____D () C:\windows\Minidump
2015-01-06 18:18 - 2014-05-01 11:25 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2015-01-06 18:18 - 2013-11-01 10:27 - 00000000 ____D () C:\ProgramData\TEMP
2015-01-06 18:16 - 2013-07-23 14:54 - 00001421 _____ () C:\Users\cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-01-05 01:32 - 2013-07-23 23:17 - 00000000 ____D () C:\Users\cécile\Desktop\Umschulung
2015-01-04 05:25 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\Offline Web Pages
==================== Files in the root of some directories =======
2014-09-01 09:18 - 2014-09-01 09:18 - 0002086 _____ () C:\Users\cécile\AppData\Roaming\AAJJPL
2013-12-21 08:44 - 2013-12-21 08:44 - 0000207 _____ () C:\Users\cécile\AppData\Roaming\removeWinNetData.bat
2014-04-27 21:58 - 2014-04-27 21:58 - 0000046 _____ () C:\Users\cécile\AppData\Roaming\WB.CFG
2015-02-03 14:53 - 2015-02-03 14:53 - 0000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp
2013-12-20 20:08 - 2013-12-20 20:08 - 0010752 _____ () C:\Users\cécile\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-11-03 20:46 - 2013-11-03 20:46 - 0010653 _____ () C:\Users\cécile\AppData\Local\recently-used.xbel
2015-02-03 07:50 - 2015-02-03 07:50 - 0000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E}
2015-01-07 23:17 - 2015-01-07 23:17 - 0266586 _____ () C:\ProgramData\1420668987.bdinstall.bin
Some content of TEMP:
====================
C:\Users\cécile\AppData\Local\Temp\avgnt.exe
C:\Users\cécile\AppData\Local\Temp\jre-8u31-windows-au.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-24 11:34
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-02-2015
Ran by cécile at 2015-02-03 21:15:06
Running from C:\Users\cécile\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: FireWall (Enabled) {753F9273-B322-2907-AC37-03D0F1702F22}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
123 Free Solitaire v9.0 (HKLM-x32\...\123 Free Solitaire_is1) (Version: - TreeCardGames)
Adobe Digital Editions 4.0 (HKLM-x32\...\Adobe Digital Editions 4.0) (Version: 4.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{95AC3836-C8D1-6BE1-C4F0-101061A445E7}) (Version: 8.0.871.0 - Advanced Micro Devices, Inc.)
ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 2.0.39.42 - ArcSoft)
ArcSoft TotalMedia (x32 Version: 1.0.61.25 - ArcSoft) Hidden
ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 2.0.0.39 - ArcSoft)
Avira Internet Security (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
capella 1200 (HKLM-x32\...\{CD5EF311-02B4-4DC1-82D0-4CDC38132F88}) (Version: 6.00.9210 - capella-software)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 7.1.2.0 - Hewlett-Packard Company)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.8 - DivX, LLC)
Drive Encryption For HP ProtectTools (HKLM\...\{27F1E086-5691-4EB8-8BA1-5CBA87D67EB5}) (Version: 7.0.28.30376 - Hewlett-Packard Company)
Dropbox (HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ePub Converter (HKLM-x32\...\ePubConverter) (Version: 1.2.1 - eBook Converter)
Evernote v. 4.5.4 (HKLM-x32\...\{550BFF6E-7376-11E1-99EA-984BE15F174E}) (Version: 4.5.4.6487 - Evernote Corp.)
Face Recognition for HP ProtectTools (HKLM\...\Face Recognition for HP ProtectTools) (Version: 7.01.4525 - Hewlett-Packard Company)
Face Recognition for HP ProtectTools (Version: 7.01.4525 - Hewlett-Packard Company) Hidden
File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 7.0.0.5 - Hewlett-Packard Company)
FLV Player 2.0 (build 25) (HKLM-x32\...\FLV Player) (Version: 2.0 (build 25) - Martijn de Visser)
Free Alarm Clock 3.1.0 (HKLM-x32\...\{8ED5A2F1-338F-4608-8AF7-BCD1ADC1E1F7}_is1) (Version: 3.1 - Comfort Software Group)
Free Video Cutter Joiner 10.0 (HKLM-x32\...\{8C5A4758-C782-4200-B337-DB3466D33ADD}}_is1) (Version: 10.0 - DVDVideoMedia, Inc.)
Free YouTube to MP3 Converter version 3.12.46.923 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.46.923 - DVDVideoSoft Ltd.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.93 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP 3D DriveGuard (HKLM\...\{5B4F3B85-83F0-4BBF-9052-7A38B6B09634}) (Version: 5.0.8.0 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{22706ADC-74A1-43A0-ABAE-47F84966B909}) (Version: 4.2.50.1 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{6357258D-2BF9-49E7-A9EF-0C609D52C46D}) (Version: 2.0.6.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.4.8.16 - SunplusIT)
HP Hotkey Support (HKLM-x32\...\{C97CC14E-4789-4FC5-BC75-79191F7CE009}) (Version: 4.5.9.1 - Hewlett-Packard Company)
HP Power Assistant (HKLM\...\{84642787-58C0-44AE-8B26-E2F544E380A1}) (Version: 2.5.0.16 - Hewlett-Packard Company)
HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 7.0.0.1177 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{223AE3E8-4445-410F-8EDA-13EC137E3BDB}) (Version: 3.4.3.0 - Hewlett-Packard Company)
HP Software Framework (HKLM-x32\...\{962CB079-85E6-405F-8704-1C62365AE46F}) (Version: 4.5.10.1 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{658A8756-7B1E-44FD-A434-D777DD906232}) (Version: 8.5.2.1 - Hewlett-Packard Company)
HP System Default Settings (HKLM-x32\...\{C4E9E8A4-EEC4-4F9E-B140-520A8B75F430}) (Version: 2.4.1.2 - Hewlett-Packard Company)
HP Wallpaper (HKLM-x32\...\{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}) (Version: 3.0.0.1 - Hewlett-Packard Company)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6392.0 - IDT)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Jazz-Plugin (HKLM-x32\...\{1C92BD87-DC1B-4C4E-BFB4-2C79E88FA752}) (Version: 1.1.0 - Jazz-Soft)
JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.68.0 - JMicron Technology Corp.)
Junk Mail filter update (x32 Version: 16.4.3522.0110 - Microsoft Corporation) Hidden
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version: - )
Lexmark 5400 Series (HKLM\...\Lexmark 5400 Series) (Version: - Lexmark International, Inc.)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.93 - PDF Complete, Inc)
PDF Editor 4 (HKLM-x32\...\PDF Editor 4) (Version: - )
Privacy Manager for HP ProtectTools (HKLM\...\{CA2F6FAD-D8CD-42C1-B04D-6E5B1B1CFDCC}) (Version: 7.0.0.865 - Hewlett-Packard Company)
Ralink Bluetooth Stack64 (HKLM\...\{ED818A3C-3DF5-CDCF-3DB2-A646D7B31A16}) (Version: 9.0.717.0 - Ralink Corporation)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.2.0 - Ralink)
Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.50.1123.2011 - Realtek)
SDK (x32 Version: 2.30.042 - Portrait Displays, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Sophos Virus Removal Tool (HKLM-x32\...\{B829E117-D072-41EA-9606-9826A38D34C1}) (Version: 2.5.4 - Sophos Limited)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.0.3.0 - Synaptics Incorporated)
Theft Recovery for HP ProtectTools (HKLM-x32\...\InstallShield_{10F5A72A-1E07-4FAE-A7E7-14B10CC66B17}) (Version: 7.0.0.10 - Hewlett-Packard Company)
Theft Recovery for HP ProtectTools (x32 Version: 7.0.0.10 - Hewlett-Packard Company) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{93581599-ECF1-4DCD-BE36-BD969A6C8DB5}) (Version: 4.4.213.0 - Validity Sensors, Inc.)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VideoPad Video-Editor (HKLM-x32\...\VideoPad) (Version: 3.33 - NCH Software)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3522.0110 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WindowsMangerProtect20.0.0.722 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.722 - WindowsProtect LIMITED) <==== ATTENTION
WinZip 15.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CF}) (Version: 15.0.10039 - WinZip Computing, S.L. )
ZenSearch (HKLM-x32\...\ZenSearch) (Version: - ZenSearch) <==== ATTENTION!
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-527591061-3285833073-1316261535-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
==================== Restore Points =========================
03-02-2015 15:05:03 Installed Sophos Virus Removal Tool.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {02549185-4C13-4229-863B-49F93066A7FE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {12D5C190-37A7-436A-B0C8-E3BD4BF25D9B} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-3.exe <==== ATTENTION
Task: {1F17C60A-B66E-4E2A-B6EA-80680939FCD2} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-2.exe <==== ATTENTION
Task: {2BA31416-3167-4D18-96B1-CC7ECA8933EA} - System32\Tasks\Omiga Plus RunAsStdUser => C:\Program Files (x86)\Omiga Plus\omigaplus.exe <==== ATTENTION
Task: {361FA930-CA20-4CF8-879A-FC7FEBE13C48} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
Task: {39324CDA-731A-4F37-9B23-73987483E0C9} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-7.exe <==== ATTENTION
Task: {3DF0B5A4-1938-4E6C-8B2C-9E232DD51711} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {664B3282-928A-4C1F-A5C7-BBCA26767195} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {68E15A2E-616B-42C9-A5C8-0FEC34A65CEE} - \Optimizer Pro Schedule No Task File <==== ATTENTION
Task: {6D3CDF8D-EDDE-4469-B25A-80C130BBE46F} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-4.exe <==== ATTENTION
Task: {6D623734-B9A7-4777-809B-B55EF108696F} - System32\Tasks\GoforFilesUpdate => C:\Program Files (x86)\GoforFiles\GFFUpdater.exe <==== ATTENTION
Task: {725DA060-3353-48BB-A0B4-631E1856A468} - System32\Tasks\Price Meter Updater => C:\Users\CCILE~1\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {7679DC9F-C53B-43FA-A6A0-359A2F92C313} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {809D4051-8DB7-4F00-AD92-28BAF4B9CFD0} - System32\Tasks\BrowserSafeguard Update Task => C:\Program Files (x86)\Browsersafeguard\uninstall.BrowserSafeguard.exe <==== ATTENTION
Task: {91DC5397-E205-4AFB-9E8E-CAC4B2BCC595} - System32\Tasks\ASP => C:\Program Files (x86)\RCP\systweakasp.exe
Task: {A8FBC4ED-65D3-43BF-A035-FE94CFCC6C3A} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-6.exe <==== ATTENTION
Task: {B1AA7059-5317-4287-A673-F675E3A4420A} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {B2018CEE-9032-4821-877D-82FB2B153C16} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {BBC1E5A5-B799-4A6A-8711-21C857F5C982} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1 => C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-codedownloader.exe <==== ATTENTION
Task: {BE22D775-4AC3-4C68-AAC1-3005E4B33664} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {BEA1D2FF-B0D0-457B-99E4-E601803E383D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Opt-in For HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF_Utils.exe
Task: {C7202DA1-EC28-4029-8C4E-20BCEAEB5ED0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29] (Google Inc.)
Task: {CC42E0FA-9677-41E4-82D6-0708A964A230} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-11.exe <==== ATTENTION
Task: {D110F954-6E59-4124-80E0-4B3F85CC7B54} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {D9F4FD33-567F-4516-918C-4BD4611951EE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-527591061-3285833073-1316261535-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe
Task: {DC082767-C927-42A0-88B2-4F3C43960BBE} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {E06DDA72-15DD-4579-AF27-84410246BE6D} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\Dependencies\RemEngine.exe
Task: {E3708286-3862-41C7-A609-1715A2BC0D8E} - System32\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5 => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: {FB02DA82-2E2B-4824-A05F-14D369A3792A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {FDF51F03-B602-4C93-92A8-D83CAD7035D6} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-1.job => C:\Program Files (x86)\SmartSaver+ 15\SmartSaver+ 15-codedownloader.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-11.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-11.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-2.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-2.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-3.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-3.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-4.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-4.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-5_user.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-5.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-6.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-6.exe <==== ATTENTION
Task: C:\windows\Tasks\14daab82-c8df-4f74-aaec-af56f23e39da-7.job => C:\Program Files (x86)\SmartSaver+ 15\14daab82-c8df-4f74-aaec-af56f23e39da-7.exe <==== ATTENTION
Task: C:\windows\Tasks\AAJJPL.job => C:\Users\cýÿcile\AppData\Roaming\AAJJPL.exe <==== ATTENTION
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\Price Meter Updater.job => C:\Users\CCILE~1\AppData\Roaming\PRICEM~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-01-18 00:57 - 2012-01-18 00:57 - 00298368 _____ () c:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2012-03-22 00:14 - 2012-03-22 00:14 - 03346432 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpFve64.dll
2011-10-12 10:03 - 2011-10-12 10:03 - 00213328 _____ () C:\windows\system32\PassThroughOTP.dll
2010-09-06 21:18 - 2010-09-06 21:18 - 01412608 _____ () C:\windows\system32\LIBEAY32.dll
2013-08-07 20:10 - 2006-07-11 00:54 - 00039424 _____ () C:\windows\System32\lxctpmon.dll
2013-08-07 20:10 - 2006-10-18 04:32 - 00081408 _____ () C:\Program Files (x86)\Lexmark 5400 Series\ipcmt64.dll
2013-08-07 20:10 - 2006-07-11 00:50 - 00004096 _____ () C:\windows\System32\lxctpmrc.dll
2013-08-07 20:12 - 2006-06-21 04:47 - 00142848 _____ () C:\windows\system32\spool\PRTPROCS\x64\lxctdrpp.dll
2012-03-21 23:36 - 2012-03-21 23:36 - 01327104 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe
2012-08-14 22:13 - 2012-08-14 22:13 - 00009728 _____ () C:\windows\system32\BsHelpCSps.dll
2012-02-10 22:26 - 2012-02-10 22:26 - 01083392 _____ () C:\Program Files\Hewlett-Packard\HP Power Assistant\System.Data.SQLite.dll
2012-08-14 22:11 - 2012-08-14 22:11 - 00022528 _____ () C:\windows\system32\BsTrace.dll
2012-03-22 00:00 - 2012-03-22 00:00 - 02846720 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcEncryptionProviderPlugin.dll
2012-03-21 23:34 - 2012-03-21 23:34 - 00126976 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHostInterface.dll
2012-03-21 23:59 - 2012-03-21 23:59 - 03002368 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalEncryptionProviderPlugin.dll
2012-03-22 00:04 - 2012-03-22 00:04 - 02850816 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpDpHostPlugin.dll
2012-03-22 00:02 - 2012-03-22 00:02 - 00053248 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeOpalATASec4SATA.dll
2012-03-21 23:38 - 2012-03-21 23:38 - 02043904 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeCoreEncryptionPlugin.dll
2012-03-21 23:39 - 2012-03-21 23:39 - 01949696 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeProductDetectionPlugin.dll
2012-08-14 22:02 - 2012-08-14 22:02 - 00019456 _____ () C:\windows\SysWOW64\BsTrace.dll
2015-01-27 07:51 - 2015-01-25 07:08 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libglesv2.dll
2015-01-27 07:51 - 2015-01-25 07:08 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\libegl.dll
2015-01-27 07:52 - 2015-01-25 07:08 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.93\pdf.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:373E1720
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SophosVirusRemovalTool => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SophosVirusRemovalTool => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^RealPlayer Cloud Service UI.lnk => C:\windows\pss\RealPlayer Cloud Service UI.lnk.CommonStartup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: AMD AVT => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
MSCONFIG\startupreg: BtTray => "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Download Protect =>
MSCONFIG\startupreg: DTRun => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe
MSCONFIG\startupreg: EzPrint => "C:\Program Files (x86)\Lexmark 5400 Series\ezprint.exe"
MSCONFIG\startupreg: File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
MSCONFIG\startupreg: HPPowerAssistant => C:\Program Files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe /hidden
MSCONFIG\startupreg: Lexmark 5400 Series => "C:\Program Files (x86)\Lexmark 5400 Series\fm3032.exe" /s
MSCONFIG\startupreg: LXCTCATS => rundll32 C:\windows\system32\spool\DRIVERS\x64\3\LXCTtime.dll,RunDLLEntry
MSCONFIG\startupreg: lxctmon.exe => "C:\Program Files (x86)\Lexmark 5400 Series\lxctmon.exe"
MSCONFIG\startupreg: MfeEpePcMonitor =>
MSCONFIG\startupreg: NUSB3MON => "C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe"
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: QLBController => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
MSCONFIG\startupreg: TkBellExe =>
========================= Accounts: ==========================
Administrator (S-1-5-21-527591061-3285833073-1316261535-500 - Administrator - Disabled)
cécile (S-1-5-21-527591061-3285833073-1316261535-1001 - Administrator - Enabled) => C:\Users\cécile
Gast (S-1-5-21-527591061-3285833073-1316261535-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-527591061-3285833073-1316261535-1005 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
Name: ttnfd
Description: ttnfd
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ttnfd
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/03/2015 08:51:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/03/2015 08:51:40 PM) (Source: Microsoft Fax) (EventID: 32112) (User: )
Description: Es können keine Faxe archiviert und keine eingehenden Faxe weitergeleitet werden, da im Faxdienst Probleme mit dem Archivspeicherort aufgetreten sind. Der Dienst kann auf den Ordner "C:\ProgramData\Microsoft\Windows NT\MSFax" oder einige darin enthaltene Unterordner nicht zugreifen.
Sie können den Speicherort des Archivordners auf der Eigenschaftenseite des Faxdruckers oder im Faxdienst-Manager ändern. Weitere Informationen erhalten Sie unter Problembandlung in der Hilfe zum Faxdienst.
Win32-Fehlercode: 5
Dieser Fehlercode gibt die Ursache des Fehlers an.
Ein detaillierter Windows-Fehlerbericht bezüglich des Problems wurde generiert.
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 180056
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 180056
System errors:
=============
Error: (02/03/2015 08:53:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/03/2015 08:51:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
ttnfd
Error: (02/03/2015 08:51:04 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Offlinedateien" wurde mit folgendem Fehler beendet:
%%3
Error: (02/03/2015 08:51:01 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 03.02.2015 um 20:48:49 unerwartet heruntergefahren.
Error: (02/03/2015 08:47:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 08:47:11 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 08:46:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.
Error: (02/03/2015 06:39:53 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Adobe Flash Player Update Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (02/03/2015 06:39:53 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Adobe Flash Player Update Service erreicht.
Error: (02/03/2015 05:11:33 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst hpHotkeyMonitor erreicht.
Microsoft Office Sessions:
=========================
Error: (02/03/2015 08:51:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/03/2015 08:51:40 PM) (Source: Microsoft Fax) (EventID: 32112) (User: )
Description: C:\ProgramData\Microsoft\Windows NT\MSFax5
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1232
Error: (02/03/2015 07:18:05 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 181055
Error: (02/03/2015 05:06:11 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 180056
Error: (02/03/2015 05:06:10 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 180056
==================== Memory info ===========================
Processor: AMD A4-4300M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 48%
Total physical RAM: 3532.11 MB
Available physical RAM: 1830.03 MB
Total Pagefile: 7062.41 MB
Available Pagefile: 4869.26 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:442.86 GB) (Free:365.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.97 GB) FAT32
Drive g: (HP_RECOVERY) (Fixed) (Total:20.61 GB) (Free:3.14 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: A6451A16)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=442.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=20.6 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0C)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-03 21:27:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000065 HGST_HTS rev.GG2O 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\CCILE~1\AppData\Local\Temp\pwdcapod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80003205070 25 bytes [C4, 08, 4C, 89, 64, 24, 50, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 586 fffff8000320508a 6 bytes [00, 00, 00, 80, 05, 00]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe[1956] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe[2096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 0000000070ec11a8 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 248 0000000070ec127d 2 bytes CALL 759914b9 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 395 0000000070ec1310 2 bytes CALL 759914b9 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 0000000070ec13a8 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000070ec1422 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000070ec1498 2 bytes [EC, 70]
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextCreate + 4 0000000070ce1825 2 bytes JMP 77336125 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroy + 4 0000000070ce1830 2 bytes JMP 77336145 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dContextDestroyAll + 4 0000000070ce183b 2 bytes JMP 77336165 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dDrawPrimitives2 + 4 0000000070ce1846 2 bytes JMP 77335a05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkD3dValidateTextureStageState + 4 0000000070ce1851 2 bytes JMP 77336185 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAddAttachedSurface + 4 0000000070ce185c 2 bytes JMP 77336265 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAlphaBlt + 4 0000000070ce1867 2 bytes JMP 77336285 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdAttachSurface + 4 0000000070ce1872 2 bytes JMP 773362a5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBeginMoCompFrame + 4 0000000070ce187d 2 bytes JMP 773362c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdBlt + 4 0000000070ce1888 2 bytes JMP 77335a25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateD3DBuffer + 4 0000000070ce1893 2 bytes JMP 773362e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCanCreateSurface + 4 0000000070ce189e 2 bytes JMP 77335aa5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdColorControl + 4 0000000070ce18a9 2 bytes JMP 77336305 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateD3DBuffer + 4 0000000070ce18b4 2 bytes JMP 77336325 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateDirectDrawObject + 4 0000000070ce18bf 2 bytes JMP 77301fcb C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateMoComp + 4 0000000070ce18ca 2 bytes JMP 77336365 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurface + 4 0000000070ce18d5 2 bytes JMP 77335ac5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceEx + 4 0000000070ce18e0 2 bytes JMP 77335b45 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdCreateSurfaceObject + 4 0000000070ce18eb 2 bytes JMP 77335b65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteDirectDrawObject + 4 0000000070ce18f6 2 bytes JMP 773368c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDeleteSurfaceObject + 4 0000000070ce1901 2 bytes JMP 77335a85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyD3DBuffer + 4 0000000070ce190c 2 bytes JMP 773368e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroyMoComp + 4 0000000070ce1917 2 bytes JMP 77336925 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdDestroySurface + 4 0000000070ce1922 2 bytes JMP 77335ae5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdEndMoCompFrame + 4 0000000070ce192d 2 bytes JMP 77336945 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlip + 4 0000000070ce1938 2 bytes JMP 77336965 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdFlipToGDISurface + 4 0000000070ce1943 2 bytes JMP 77336985 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetAvailDriverMemory + 4 0000000070ce194e 2 bytes JMP 773369a5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetBltStatus + 4 0000000070ce1959 2 bytes JMP 773369c5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDC + 4 0000000070ce1964 2 bytes JMP 773369e5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverInfo + 4 0000000070ce196f 2 bytes JMP 77336a05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDriverState + 4 0000000070ce197a 2 bytes JMP 77336a25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetDxHandle + 4 0000000070ce1985 2 bytes JMP 77336a45 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetFlipStatus + 4 0000000070ce1990 2 bytes JMP 77336a65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetInternalMoCompInfo + 4 0000000070ce199b 2 bytes JMP 77336a85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompBuffInfo + 4 0000000070ce19a6 2 bytes JMP 77336aa5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompFormats + 4 0000000070ce19b1 2 bytes JMP 77336ac5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetMoCompGuids + 4 0000000070ce19bc 2 bytes JMP 77336ae5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdGetScanLine + 4 0000000070ce19c7 2 bytes JMP 77336b05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLock + 4 0000000070ce19d2 2 bytes JMP 77336b25 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdLockD3D + 4 0000000070ce19dd 2 bytes JMP 77335b85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryDirectDrawObject + 4 0000000070ce19e8 2 bytes JMP 77336b65 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdQueryMoCompStatus + 4 0000000070ce19f3 2 bytes JMP 77336b85 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReenableDirectDrawObject + 4 0000000070ce19fe 2 bytes JMP 77336bc3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdReleaseDC + 4 0000000070ce1a09 2 bytes JMP 77336be3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdRenderMoComp + 4 0000000070ce1a14 2 bytes JMP 77336c03 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdResetVisrgn + 4 0000000070ce1a1f 2 bytes JMP 77335b05 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetColorKey + 4 0000000070ce1a2a 2 bytes JMP 77336c23 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetExclusiveMode + 4 0000000070ce1a35 2 bytes JMP 77336c43 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetGammaRamp + 4 0000000070ce1a40 2 bytes JMP 77336c63 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdSetOverlayPosition + 4 0000000070ce1a4b 2 bytes JMP 77336c83 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnattachSurface + 4 0000000070ce1a56 2 bytes JMP 77336ca3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlock + 4 0000000070ce1a61 2 bytes JMP 77336cc3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUnlockD3D + 4 0000000070ce1a6c 2 bytes JMP 77335ba5 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdUpdateOverlay + 4 0000000070ce1a77 2 bytes JMP 77336ce3 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 4 0000000070ce1a82 2 bytes JMP 77336d03 C:\windows\syswow64\GDI32.dll
.text C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe[2608] C:\Windows\SysWOW64\d3d8thk.dll!OsThunkDdWaitForVerticalBlank + 52 0000000070ce1ab2 2 bytes JMP 758fdc75 C:\windows\syswow64\msvcrt.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe[3624] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 0000000077531401 2 bytes JMP 759bb21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumProcessModules + 17 0000000077531419 2 bytes JMP 759bb346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 17 0000000077531431 2 bytes JMP 75a38ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 42 000000007753144a 2 bytes CALL 759948ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 00000000775314dd 2 bytes JMP 75a387a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 00000000775314f5 2 bytes JMP 75a38978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 000000007753150d 2 bytes JMP 75a38698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 0000000077531525 2 bytes JMP 75a38a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 000000007753153d 2 bytes JMP 759afca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!EnumProcesses + 17 0000000077531555 2 bytes JMP 759b68ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 000000007753156d 2 bytes JMP 75a38f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 0000000077531585 2 bytes JMP 75a38ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 000000007753159d 2 bytes JMP 75a3865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 00000000775315b5 2 bytes JMP 759afd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 00000000775315cd 2 bytes JMP 759bb2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 00000000775316b2 2 bytes JMP 75a38e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe[728] C:\windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 00000000775316bd 2 bytes JMP 75a385f1 C:\windows\syswow64\kernel32.dll
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c3e8429c098
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c3e8429c098@f85f2af15c6a 0x06 0xC3 0xEA 0xF1 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c3e8429c098 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c3e8429c098@f85f2af15c6a 0x06 0xC3 0xEA 0xF1 ...
---- EOF - GMER 2.1 ----
|
|
03.02.2015, 21:54
| #2 |
| /// TB-Ausbilder   | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Hallo cecile_dnb
__________________ Mein Name ist Timo und ich werde Dir bei deinem Problem behilflich sein.
 Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist immer der sicherste Weg. Wir arbeiten hier alle freiwillig und meist auch nur in unserer Freizeit. Daher kann es bei Antworten zu Verzögerungen kommen. Solltest du innerhalb 48 Std keine Antwort von mir erhalten, dann schreib mit eine PM Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis ich oder jemand vom Team sagt, dass Du clean bist. Führe sämtliche Tools mit administrativen Rechten aus, Vista, Win7,Win8 User mit Rechtsklick "als Administrator starten". Scan mit Combofix
__________________ |
|
03.02.2015, 22:09
| #3 |
| | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Hallo Timo,
__________________das ist lieb, dass du mir helfen willst. Vielen Dank. Die Schritte in der Anleitung habe ich bereits befolgt. Liebe Grüße |
|
04.02.2015, 08:47
| #4 |
| /// TB-Ausbilder | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Ok - dann bitte wie in der Anleitung beschrieben, die C:\Combofix.txt Datei posten. So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
04.02.2015, 21:17
| #5 |
| | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... ok Code:
ATTFilter ComboFix 15-02-02.01 - cécile 04.02.2015 21:05:30.1.2 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3532.1926 [GMT 1:00]
ausgeführt von:: c:\users\cÚcile\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
FW: FireWall *Disabled* {753F9273-B322-2907-AC37-03D0F1702F22}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\programdata\1420668987.bdinstall.bin
c:\windows\IsUn0407.exe
c:\windows\SysWow64\DEBUG.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-01-04 bis 2015-02-04 ))))))))))))))))))))))))))))))
.
.
2015-02-04 20:13 . 2015-02-04 20:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-02-03 20:13 . 2015-02-03 20:15 -------- d-----w- C:\FRST
2015-02-03 14:07 . 2015-02-03 14:07 -------- d-----w- c:\programdata\Sophos
2015-02-03 14:05 . 2015-02-03 14:05 -------- d-----w- c:\program files (x86)\Sophos
2015-02-03 13:53 . 2015-02-03 13:53 0 ---ha-w- c:\users\cécile\AppData\Local\BIT938B.tmp
2015-01-31 17:51 . 2015-01-31 17:51 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-01-25 15:57 . 2015-01-25 15:57 -------- d-----w- c:\users\cécile\AppData\Roaming\Avira
2015-01-25 15:56 . 2014-11-24 09:31 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-01-25 15:56 . 2014-11-24 09:31 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-01-25 15:56 . 2014-11-24 09:31 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-01-25 15:56 . 2014-11-24 09:31 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-01-25 15:56 . 2014-11-24 09:31 141376 ----a-w- c:\windows\system32\drivers\avfwot.sys
2015-01-25 15:56 . 2014-11-24 09:31 114608 ----a-w- c:\windows\system32\drivers\avfwim.sys
2015-01-25 15:56 . 2015-01-25 15:56 -------- d-----w- c:\program files (x86)\Avira
2015-01-23 19:57 . 2015-01-23 19:57 -------- d-----w- C:\found.002
2015-01-08 22:56 . 2015-01-08 22:56 -------- d-----w- c:\windows\SysWow64\N360_BACKUP
2015-01-07 22:41 . 2015-01-25 15:20 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2015-01-07 22:15 . 2015-01-07 22:15 -------- d-----w- c:\programdata\NortonInstaller
2015-01-06 17:17 . 2015-01-06 17:17 -------- d-----w- c:\programdata\Logs
2015-01-06 17:15 . 2015-01-06 17:16 -------- d-----w- c:\users\cécile\AppData\Roaming\Opera Software
2015-01-06 17:15 . 2015-01-06 17:16 -------- d-----w- c:\users\cécile\AppData\Local\Opera Software
2015-01-06 17:15 . 2015-01-06 17:16 -------- d-----w- c:\program files (x86)\Opera
2015-01-06 15:23 . 2015-01-06 15:23 -------- d-----w- c:\users\cécile\AppData\Local\CrashDumps
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-03 13:53 . 2015-02-03 13:53 0 ---ha-w- c:\users\cécile\AppData\Local\BIT938B.tmp
2015-02-03 13:53 . 2015-02-03 13:53 0 ---ha-w- c:\users\cécile\AppData\Local\BIT938B.tmp
2015-01-31 17:51 . 2014-10-18 08:52 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-01-25 15:07 . 2012-04-21 05:44 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-25 15:07 . 2012-04-21 05:44 701616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-15 14:14 . 2013-08-05 23:42 113365784 ----a-w- c:\windows\system32\MRT.exe
2015-01-01 17:41 . 2015-01-01 17:41 74512 ----a-w- c:\windows\system32\bdsandboxuiskin32.dll
2014-12-13 05:09 . 2014-12-18 14:33 144384 ----a-w- c:\windows\system32\ieUnatt.exe
2014-12-13 03:33 . 2014-12-18 14:33 115712 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2014-12-04 02:50 . 2014-12-11 16:52 413184 ----a-w- c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-11 16:52 741376 ----a-w- c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-11 16:52 396800 ----a-w- c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-11 16:52 830976 ----a-w- c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-11 16:52 192000 ----a-w- c:\windows\system32\aepic.dll
2014-12-04 02:50 . 2014-12-11 16:52 227328 ----a-w- c:\windows\system32\aepdu.dll
2014-12-04 02:44 . 2014-12-11 16:52 1083392 ----a-w- c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-11 16:52 1232040 ----a-w- c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-11 16:52 389296 ----a-w- c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-11 16:52 25059840 ----a-w- c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-11 16:52 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-11 16:52 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-11 16:52 66560 ----a-w- c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-11 16:52 580096 ----a-w- c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-11 16:52 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-11 16:52 2885120 ----a-w- c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-11 16:52 88064 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-11 16:52 54784 ----a-w- c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-11 16:52 34304 ----a-w- c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-11 16:52 633856 ----a-w- c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-11 16:52 114688 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-11 16:52 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-11 16:52 6039552 ----a-w- c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-11 16:52 968704 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-11 16:52 490496 ----a-w- c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-11 16:52 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-11 16:52 77824 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-11 16:52 199680 ----a-w- c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-11 16:52 92160 ----a-w- c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-11 16:52 501248 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-11 16:52 62464 ----a-w- c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-11 16:52 47616 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-11 16:52 64000 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-11 16:52 316928 ----a-w- c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-11 16:52 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-11 16:52 718848 ----a-w- c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-11 16:52 800768 ----a-w- c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-11 16:52 1359360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-11 16:52 2125312 ----a-w- c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-11 16:52 14412800 ----a-w- c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-11 16:52 60416 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-11 16:52 4299264 ----a-w- c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-11 16:52 2358272 ----a-w- c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-11 16:52 2052096 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-11 16:52 1155072 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-11 16:52 1548288 ----a-w- c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-11 16:52 800768 ----a-w- c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-11 16:52 1888256 ----a-w- c:\windows\SysWow64\wininet.dll
2014-11-19 03:31 . 2014-11-19 03:31 1217192 ----a-w- c:\windows\SysWow64\FM20.DLL
2014-11-11 03:09 . 2014-12-11 16:52 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-19 14:15 241152 ----a-w- c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 14:15 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-11 16:52 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-19 14:15 186880 ----a-w- c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 14:15 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-11 16:52 119296 ----a-w- c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-11 16:51 2048 ----a-w- c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-11 16:51 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EC740D8D-BAA6-4BAF-9183-2406AB943D3A}]
2014-04-23 10:02 301752 ----a-w- c:\program files (x86)\ZenSearch\IeZenSearch.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreeAC"="c:\program files (x86)\FreeAlarmClock\FreeAlarmClock.exe" [2014-02-20 1553688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2012-03-15 184704]
"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2014-04-03 450560]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-11-24 702768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SophosVirusRemovalTool]
@="Service"
.
R1 ttnfd;ttnfd;c:\windows\system32\drivers\ttnfd.sys;c:\windows\SYSNATIVE\drivers\ttnfd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
R3 BthL2caScoIfSrv;Bluetooth Profile Interface Driver Service;c:\windows\system32\Drivers\BtL2caScoIf.sys;c:\windows\SYSNATIVE\Drivers\BtL2caScoIf.sys [x]
R3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;c:\windows\system32\Drivers\IvtUrbBtFlt.sys;c:\windows\SYSNATIVE\Drivers\IvtUrbBtFlt.sys [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe;c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
R3 SophosVirusRemovalTool;Sophos Virus Removal Tool;c:\program files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe;c:\program files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R4 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\DRIVERS\amdkmpfd.sys;c:\windows\SYSNATIVE\DRIVERS\amdkmpfd.sys [x]
S0 MfeEpeOpal;MfeEpeOpal; [x]
S0 MfeEpePc;MfeEpePc; [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
S2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys;c:\windows\SYSNATIVE\DRIVERS\amdhub30.sys [x]
S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\amdxhc.sys;c:\windows\SYSNATIVE\DRIVERS\amdxhc.sys [x]
S3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]
S3 BtAudioBusSrv;Ralink Bluetooth Audio Bus Service;c:\windows\system32\Drivers\BtAudioBus.sys;c:\windows\SYSNATIVE\Drivers\BtAudioBus.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 rtbth;RTBTH Bluetooth Device Driver;c:\windows\system32\DRIVERS\rtbth.sys;c:\windows\SYSNATIVE\DRIVERS\rtbth.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-01-27 06:44 1086280 ----a-w- c:\program files (x86)\Google\Chrome\Application\40.0.2214.93\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 15:07]
.
2015-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29 16:12]
.
2015-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-04-29 16:12]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32
uLocal Page = c:\windows\system32\blank.htm
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
mDefault_Page_URL = about:blank
mDefault_Search_URL = about:blank
uInternet Settings,ProxyOverride = <-loopback>
uSearchAssistant = hxxp://www.google.com
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: {{c0e8ae32-0758-4c8d-ab71-23b361fe8964} - c:\users\CCILE~1\AppData\Local\Temp\ie_script.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -
TCP: DhcpNameServer = 192.168.0.1
TCP: Interfaces\{DA2EA1BF-8971-4A13-9141-7EF004B55DED}: NameServer = 212.23.115.148 212.23.115.132
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{11111111-1111-1111-1111-110611171196} - c:\program files (x86)\SmartSaver+ 15\SmartSaver+ 15-bho.dll
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKU-Default-Run-Bitdefender-Geldbörse-Agent - c:\program files\Bitdefender\Bitdefender 2015\bdwtxag.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
HKLM-Run-InstallerLauncher - c:\program files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe
AddRemove-WindowsMangerProtect - c:\programdata\WindowsMangerProtect\ProtectWindowsManager.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_16_0_0_296_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.16"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_16_0_0_296.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-04 21:16:00
ComboFix-quarantined-files.txt 2015-02-04 20:16
.
Vor Suchlauf: 17 Verzeichnis(se), 391.382.851.584 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 391.667.314.688 Bytes frei
.
- - End Of File - - BBFBF8FC44F1ADE1FF09A898D9D83D8D
A36C5E4F47E84449FF07ED3517B43A31
|
|
06.02.2015, 12:05
| #6 |
| /// TB-Ausbilder | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Ok. Dann so weitermachen bitte: Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Downloade Dir bitte  Malwarebytes Anti-Malware
Starte noch einmal FRST.
__________________ --> Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... |
|
06.02.2015, 18:02
| #7 |
| | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen...Code:
ATTFilter # AdwCleaner v4.110 - Bericht erstellt 06/02/2015 um 14:58:08
# Aktualisiert 05/02/2015 von Xplode
# Datenbank : 2015-02-05.2 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : cécile - CÉCILE-HP
# Gestarted von : C:\Users\cécile\Downloads\AdwCleaner_4.110.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : globalUpdatem
[#] Dienst Gelöscht : TTNFD
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\374311380
Ordner Gelöscht : C:\ProgramData\apn
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\DSearchLink
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\WindowsMangerProtect
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLV Player
Ordner Gelöscht : C:\Program Files (x86)\goforfiles
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\WinZipper
Ordner Gelöscht : C:\Program Files (x86)\FLV Player
Ordner Gelöscht : C:\Program Files (x86)\Common Files\337
Ordner Gelöscht : C:\Users\cécile\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\cécile\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\cécile\AppData\Local\PriceMeterLiveUpdate
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\337
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\Advanced System Protector
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\ASP
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\DigitalSites
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\goforfiles
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\istartsurf
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\Windows Net Data
Ordner Gelöscht : C:\Users\cécile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\1clickmoviedownloader.com
Ordner Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage
Datei Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_allin1convert.dl.tb.ask.com_0.localstorage-journal
Datei Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage
Datei Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.audienceinsights.net_0.localstorage-journal
Datei Gelöscht : C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal
***** [ Geplante Tasks ] *****
Task Gelöscht : Advanced System Protector
Task Gelöscht : ASP
Task Gelöscht : BrowserSafeguard Update Task
Task Gelöscht : Desk 365 RunAsStdUser
Task Gelöscht : GoforFilesUpdate
Task Gelöscht : Omiga Plus RunAsStdUser
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iMesh.AudioCD
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\omigaplussvc
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C007DADD-132A-624C-088E-59EE6CF0711F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFC47BB5-5FB5-4AD0-8427-6AA04334A3FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0ADB535-D7B5-4D8B-B15D-578BDD20D76A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110611171196}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622172296}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{95B92D92-8B7D-4A19-A3F1-43113B4DBCAF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655175596}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666176696}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5297E905-1DFB-4A9C-9871-A4F95FD58945}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110611171196}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220622172296}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{95B92D92-8B7D-4A19-A3F1-43113B4DBCAF}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550655175596}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660666176696}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\858C55D7AAA74067BE954B0C50E1AE46
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Schlüssel Gelöscht : HKCU\Software\BrowserSafeguardInstalled
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\GlobalUpdate
Schlüssel Gelöscht : HKCU\Software\GoforFiles
Schlüssel Gelöscht : HKCU\Software\Imesh
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : HKCU\Software\PriceMeterLiveUpdate
Schlüssel Gelöscht : HKCU\Software\PriceMeterUpdater
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\SupHpUISoft
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartSaver+ 15
Schlüssel Gelöscht : HKLM\SOFTWARE\BrowserSafeGuard
Schlüssel Gelöscht : HKLM\SOFTWARE\Delta
Schlüssel Gelöscht : HKLM\SOFTWARE\Desksvc
Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\GoforFiles
Schlüssel Gelöscht : HKLM\SOFTWARE\hdcode
Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : HKLM\SOFTWARE\istartsurfSoftware
Schlüssel Gelöscht : HKLM\SOFTWARE\omigaplusSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\PriceMeterLiveUpdate
Schlüssel Gelöscht : HKLM\SOFTWARE\supWindowsMangerProtect
Schlüssel Gelöscht : HKLM\SOFTWARE\SweetIM
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\V9
Schlüssel Gelöscht : HKLM\SOFTWARE\winzipersvc
Schlüssel Gelöscht : HKLM\SOFTWARE\TermTutor
Schlüssel Gelöscht : HKLM\SOFTWARE\SmartSaver+ 15
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FLV Player
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WindowsMangerProtect
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.de
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <-loopback>
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17496
-\\ Google Chrome v40.0.2214.94
[C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://www.search.ask.com/web?p2=%5EB7J%5EYYYYYY%5EYY%5EDE&gct=&o=APN11289&tpid=CME-V7&itbv=12.5.1.1394&doi=2013-10-11&apn_uid=F9AFB407-2CBD-4E23-B9C4-A300DD6133DC&apn_ptnrs=%5EB7J&apn_dtid=%5EYYYYYY%5EYY%5EDE&apn_dbr=cr_30.0.1599.69&psv=barid%253D201184952758440889612466654719012094104%2526cargo%253DCME%252DV7%2526spr%253Da%2526did%253D10717%2526ppd%253D&trgb=CR&q={searchTerms}
[C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
[C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3319709&octid=EB_ORIGINAL_CTID&ISID=MC5622DBB-E762-484B-8985-76E73F5D26AC&SearchSource=58&CUI=&UM=5&UP=SP6D2C7F13-13D6-4AF8-B8D4-ED51FB539D53&q={searchTerms}&SSPV=Control21220_sp_ch
[C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://nortonsafe.search.ask.com/web?q={searchTerms}&o=APN10506&l=dis&prt=360&chn=o0&geo=DE&ver=21&locale=de_DE&gct=sb&qsrc=2869
*************************
AdwCleaner[R0].txt - [13549 Bytes] - [06/02/2015 14:55:31]
AdwCleaner[S0].txt - [12142 Bytes] - [06/02/2015 14:58:08]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12202 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by c‚cile on 06.02.2015 at 15:13:41,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.02.2015 at 15:17:24,20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.02.2015 Suchlauf-Zeit: 15:26:30 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.06.04 Rootkit Datenbank: v2015.02.03.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: cécile Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 346936 Verstrichene Zeit: 1 Std, 41 Min, 45 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 7 PUP.Optional.ZenSearch.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{EC740D8D-BAA6-4BAF-9183-2406AB943D3A}, In Quarantäne, [2b11f724e3a71a1ccf56d130f310926e], PUP.Optional.ZenSearch.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{EC740D8D-BAA6-4BAF-9183-2406AB943D3A}, In Quarantäne, [2b11f724e3a71a1ccf56d130f310926e], PUP.Optional.ZenSearch.A, HKU\S-1-5-21-527591061-3285833073-1316261535-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{EC740D8D-BAA6-4BAF-9183-2406AB943D3A}, In Quarantäne, [2b11f724e3a71a1ccf56d130f310926e], PUP.Optional.ZenSearch.A, HKU\S-1-5-21-527591061-3285833073-1316261535-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{EC740D8D-BAA6-4BAF-9183-2406AB943D3A}, In Quarantäne, [2b11f724e3a71a1ccf56d130f310926e], PUP.Optional.SmartSaver.A, HKLM\SOFTWARE\WOW6432NODE\SmartSaver+ 15-nv, In Quarantäne, [50ec1308dcae4aecd72021a6cd36c838], PUP.Optional.SmartSaver.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\SmartSaver+ 15, Löschen bei Neustart, [df5de635d8b2eb4b658fcdfa020141bf], PUP.Optional.ZenSearch.A, HKU\S-1-5-21-527591061-3285833073-1316261535-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\ZENSEARCH\ZenSearch, In Quarantäne, [8daff229fa901e1800b93d7cea198f71], Registrierungswerte: 1 PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Mysearchdial\1.8.29.0\, In Quarantäne, [43f95bc008822115b24b28dada2b18e8] Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 2 PUP.Optional.ZenSearch.A, C:\Program Files (x86)\ZenSearch\IeZenSearch.dll, In Quarantäne, [2b11f724e3a71a1ccf56d130f310926e], PUP.Optional.ZenSearch.A, C:\Program Files (x86)\ZenSearch\IeZenSearch_x64.dll, In Quarantäne, [72ca7e9da2e86ec8ce762a1835cb44bc], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end)  FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-02-2015 Ran by cécile (administrator) on CÉCILE-HP on 06-02-2015 17:59:32 Running from C:\Users\cécile\Downloads Loaded Profiles: cécile (Available profiles: cécile) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Hewlett-Packard Company) C:\Windows\System32\hpservice.exe (Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe (AMD) C:\Windows\System32\atieclxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe ( ) C:\Windows\System32\lxctcoms.exe () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe (PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe (ArcSoft, Inc.) C:\Windows\SysWOW64\ArcVCapRender\uArcCapture.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Comfort Software Group) C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [InstallerLauncher] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-4159-A75F-CFD0C7EA4FBF}\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\{6F57816A-791A-41 (the data entry has 36 more characters). HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [184704 2012-03-15] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2014-04-03] (DivX, LLC) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-11-24] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-527591061-3285833073-1316261535-1001\...\Run: [FreeAC] => C:\Program Files (x86)\FreeAlarmClock\FreeAlarmClock.exe [1553688 2014-02-20] (Comfort Software Group) Lsa: [Notification Packages] DPPassFilter scecli ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\cécile\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-527591061-3285833073-1316261535-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32 HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32 HKU\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=N360&pvid=21.6.0.32 HKU\S-1-5-21-527591061-3285833073-1316261535-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL = SearchScopes: HKU\S-1-5-21-527591061-3285833073-1316261535-1001 -> {e4a1ece8-ed94-4f93-80ea-75f978ceaf24} URL = BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Lexmark Symbolleiste -> {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -> C:\Program Files\Lexmark Toolbar\toolband.dll () BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard) BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll () Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{DA2EA1BF-8971-4A13-9141-7EF004B55DED}: [NameServer] 212.23.115.148 212.23.115.132 FireFox: ======== FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\S-1-5-21-527591061-3285833073-1316261535-1001: @jazz-soft.com/JazzPlugin -> C:\Program Files (x86)\Jazz-Soft\Jazz-Plugin\npJazz.dll (Jazz-Soft) FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt FF Extension: DigitalPersona Extension - c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2013-04-21] Chrome: ======= CHR HomePage: Default -> hxxp://www.google.de/ CHR StartupUrls: Default -> "hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=249C1C3E8429C096&affID=120698&tt=02102013_mx15rbra&tsp=5033", "hxxp://www.google.de/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Präsentationen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-01-31] CHR Extension: (Google Docs) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-01-30] CHR Extension: (Google Drive) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-29] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-05] CHR Extension: (YouTube) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-29] CHR Extension: (Google-Suche) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-29] CHR Extension: (Google Tabellen) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-01-31] CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl [2015-02-06] CHR Extension: (Google Wallet) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-29] CHR Extension: (Bitdefender QuickScan) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pdnkcidphdcakpkheohlhocaicfamjie [2015-01-01] CHR Extension: (Google Mail) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-29] CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-09-30] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [1044784 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [807672 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-11-24] (Avira Operations GmbH & Co. KG) R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [993584 2014-11-24] (Avira Operations GmbH & Co. KG) R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1578496 2012-08-14] (IVT Corporation) [File not signed] R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2012-08-14] (IVT Corporation) [File not signed] R2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [493904 2012-03-15] (DigitalPersona, Inc.) S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [477056 2012-11-19] (Hewlett-Packard Company) R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [365440 2012-03-14] (Hewlett-Packard Company) R2 lxct_device; C:\windows\system32\lxctcoms.exe [546304 2006-07-13] ( ) R2 lxct_device; C:\windows\SysWOW64\lxctcoms.exe [537520 2006-11-22] ( ) R2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1327104 2012-03-21] () [File not signed] R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1134584 2012-03-07] (PDF Complete Inc) S3 SophosVirusRemovalTool; C:\Program Files (x86)\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [153384 2014-11-26] (Sophos Limited) R2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [498352 2012-04-05] (ArcSoft, Inc.) R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-21] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [31872 2012-01-31] (Advanced Micro Devices, Inc.) R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [42816 2012-02-03] (ArcSoft, Inc.) R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2014-11-24] (Avira GmbH) R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2014-11-24] (Avira GmbH) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-11-24] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-11-24] (Avira Operations GmbH & Co. KG) R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [43064 2014-11-24] (Avira Operations GmbH & Co. KG) U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.) R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23104 2011-08-13] (Ralink Corporation) S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [51776 2012-04-03] (Ralink Corporation) S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48320 2012-03-05] (Ralink Corporation) S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64832 2012-11-09] (Hewlett-Packard Company) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-06] (Malwarebytes Corporation) R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [93640 2012-03-22] (McAfee, Inc.) R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158792 2012-03-22] (McAfee, Inc.) R3 rtbth; C:\Windows\System32\DRIVERS\rtbth.sys [685152 2012-06-14] (Ralink Technology, Corp.) R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1064184 2012-09-22] (Sunplus) U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [34880 2011-08-13] (Ralink Corporation.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-06 17:59 - 2015-02-06 17:59 - 00000000 ____D () C:\Users\cécile\Downloads\FRST-OlderVersion 2015-02-06 17:54 - 2015-02-06 17:54 - 00002987 _____ () C:\Users\cécile\Desktop\mbam.txt 2015-02-06 15:25 - 2015-02-06 15:25 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-06 15:25 - 2015-02-06 15:25 - 00001102 _____ () C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-06 15:25 - 2015-02-06 15:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-06 15:25 - 2015-02-06 15:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-06 15:25 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2015-02-06 15:25 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2015-02-06 15:25 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2015-02-06 15:17 - 2015-02-06 15:17 - 00000774 _____ () C:\Users\cécile\Desktop\JRT.txt 2015-02-06 15:08 - 2015-02-06 15:08 - 01388274 _____ (Thisisu) C:\Users\cécile\Downloads\JRT.exe 2015-02-06 14:55 - 2015-02-06 14:58 - 00000000 ____D () C:\AdwCleaner 2015-02-06 14:54 - 2015-02-06 14:54 - 02112512 _____ () C:\Users\cécile\Downloads\AdwCleaner_4.110.exe 2015-02-04 21:16 - 2015-02-04 21:16 - 00029326 _____ () C:\ComboFix.txt 2015-02-04 21:03 - 2015-02-04 21:16 - 00000000 ____D () C:\Qoobox 2015-02-04 21:03 - 2015-02-04 21:14 - 00000000 ____D () C:\windows\erdnt 2015-02-04 21:03 - 2011-06-26 07:45 - 00256000 _____ () C:\windows\PEV.exe 2015-02-04 21:03 - 2010-11-07 18:20 - 00208896 _____ () C:\windows\MBR.exe 2015-02-04 21:03 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2015-02-04 21:03 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2015-02-04 21:03 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2015-02-04 21:03 - 2000-08-31 01:00 - 00098816 _____ () C:\windows\sed.exe 2015-02-04 21:03 - 2000-08-31 01:00 - 00080412 _____ () C:\windows\grep.exe 2015-02-04 21:03 - 2000-08-31 01:00 - 00068096 _____ () C:\windows\zip.exe 2015-02-04 21:01 - 2015-02-04 21:01 - 05611380 ____R (Swearware) C:\Users\cécile\Downloads\ComboFix.exe 2015-02-03 21:31 - 2015-02-03 21:31 - 00050477 _____ () C:\Users\cécile\Downloads\Defogger (1).exe 2015-02-03 21:27 - 2015-02-03 21:27 - 00032143 _____ () C:\Users\cécile\Desktop\Gmer.txt 2015-02-03 21:18 - 2015-02-03 21:18 - 00380416 _____ () C:\Users\cécile\Downloads\Gmer-19357.exe 2015-02-03 21:16 - 2015-02-03 21:16 - 00037837 _____ () C:\Users\cécile\Desktop\FRST.txt 2015-02-03 21:16 - 2015-02-03 21:16 - 00035144 _____ () C:\Users\cécile\Desktop\Addition.txt 2015-02-03 21:15 - 2015-02-03 21:15 - 00035144 _____ () C:\Users\cécile\Downloads\Addition.txt 2015-02-03 21:14 - 2015-02-06 17:59 - 00020140 _____ () C:\Users\cécile\Downloads\FRST.txt 2015-02-03 21:13 - 2015-02-06 17:59 - 02131968 _____ (Farbar) C:\Users\cécile\Downloads\FRST64.exe 2015-02-03 21:13 - 2015-02-06 17:59 - 00000000 ____D () C:\FRST 2015-02-03 21:07 - 2015-02-03 21:31 - 00000474 _____ () C:\Users\cécile\Downloads\defogger_disable.log 2015-02-03 21:07 - 2015-02-03 21:07 - 00000000 _____ () C:\Users\cécile\defogger_reenable 2015-02-03 21:06 - 2015-02-03 21:06 - 00050477 _____ () C:\Users\cécile\Downloads\Defogger.exe 2015-02-03 15:07 - 2015-02-03 15:07 - 00000000 ____D () C:\ProgramData\Sophos 2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\Users\Public\Desktop\Sophos Virus Removal Tool.lnk 2015-02-03 15:05 - 2015-02-03 15:05 - 00002759 _____ () C:\ProgramData\Desktop\Sophos Virus Removal Tool.lnk 2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos 2015-02-03 15:05 - 2015-02-03 15:05 - 00000000 ____D () C:\Program Files (x86)\Sophos 2015-02-03 15:03 - 2015-02-03 15:04 - 109810016 _____ (Sophos Limited) C:\Users\cécile\Downloads\Sophos Virus Removal Tool.exe 2015-02-03 14:53 - 2015-02-03 14:53 - 00000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp 2015-02-03 07:50 - 2015-02-03 07:50 - 00000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E} 2015-01-31 18:36 - 2015-01-31 18:36 - 03077776 ____N (Symantec Corporation) C:\Users\cécile\Downloads\NPE.exe 2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk 2015-01-25 16:57 - 2015-01-25 16:57 - 00002066 _____ () C:\ProgramData\Desktop\Avira Control Center.lnk 2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\Users\cécile\AppData\Roaming\Avira 2015-01-25 16:57 - 2015-01-25 16:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-01-25 16:56 - 2015-01-25 16:56 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-01-25 16:56 - 2014-11-24 10:31 - 00141376 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwot.sys 2015-01-25 16:56 - 2014-11-24 10:31 - 00131608 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys 2015-01-25 16:56 - 2014-11-24 10:31 - 00119272 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys 2015-01-25 16:56 - 2014-11-24 10:31 - 00114608 _____ (Avira GmbH) C:\windows\system32\Drivers\avfwim.sys 2015-01-25 16:56 - 2014-11-24 10:31 - 00043064 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys 2015-01-25 16:56 - 2014-11-24 10:31 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys 2015-01-25 16:49 - 2015-01-25 16:51 - 180282552 _____ () C:\Users\cécile\Downloads\avira_internet_security_de.exe 2015-01-23 20:57 - 2015-01-23 20:57 - 00000000 ____D () C:\found.002 2015-01-14 16:11 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll 2015-01-14 16:11 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys 2015-01-14 16:11 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe 2015-01-14 16:11 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll 2015-01-14 16:11 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe 2015-01-14 16:11 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll 2015-01-14 16:11 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe 2015-01-14 16:11 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe 2015-01-14 16:11 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll 2015-01-14 16:11 - 2014-12-11 18:47 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe 2015-01-14 16:11 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll 2015-01-14 16:11 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll 2015-01-14 16:11 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll 2015-01-08 23:56 - 2015-01-08 23:56 - 00000000 ____D () C:\windows\SysWOW64\N360_BACKUP ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-06 17:52 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-06 17:52 - 2009-07-14 05:45 - 00031312 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-06 17:51 - 2014-04-29 17:24 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-06 17:44 - 2014-04-29 17:12 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-06 17:44 - 2014-04-28 22:28 - 00030041 _____ () C:\windows\setupact.log 2015-02-06 17:44 - 2012-08-16 01:46 - 00000787 _____ () C:\windows\SysWOW64\bscs.ini 2015-02-06 17:44 - 2012-04-21 06:43 - 00000000 ____D () C:\ProgramData\PDFC 2015-02-06 17:44 - 2010-11-21 04:47 - 01126480 _____ () C:\windows\PFRO.log 2015-02-06 17:44 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2015-02-06 17:43 - 2013-04-21 06:30 - 01071974 _____ () C:\windows\WindowsUpdate.log 2015-02-06 17:38 - 2014-06-19 22:32 - 00000000 ____D () C:\Program Files (x86)\ZenSearch 2015-02-06 17:38 - 2012-04-21 06:44 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2015-02-06 17:38 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\registration 2015-02-06 17:12 - 2014-04-29 17:12 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-06 14:57 - 2013-07-23 14:54 - 00003938 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{2CA201FC-5302-4E57-B7B5-319AB671A227} 2015-02-05 21:07 - 2014-04-29 17:12 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-05 21:07 - 2014-04-29 17:12 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-04 21:16 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-02-04 21:13 - 2009-07-14 03:34 - 00000215 _____ () C:\windows\system.ini 2015-02-04 21:09 - 2013-11-01 10:27 - 00000000 ____D () C:\ProgramData\TEMP 2015-02-04 21:03 - 2013-07-23 23:17 - 00000000 ____D () C:\Users\cécile\Desktop\Umschulung 2015-02-03 23:24 - 2013-07-23 14:49 - 00000000 ____D () C:\Users\cécile 2015-02-03 21:11 - 2013-07-23 14:54 - 00087008 _____ () C:\Users\cécile\AppData\Local\GDIPFONTCACHEV1.DAT 2015-01-31 19:05 - 2013-09-14 15:26 - 00000000 ____D () C:\ProgramData\Oracle 2015-01-31 18:52 - 2013-09-14 15:25 - 00000000 ____D () C:\Program Files (x86)\Java 2015-01-31 18:51 - 2014-10-18 09:52 - 00272296 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe 2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe 2015-01-31 18:51 - 2014-10-18 09:52 - 00176552 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe 2015-01-31 18:51 - 2014-10-18 09:52 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll 2015-01-31 18:51 - 2014-10-18 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-01-31 18:42 - 2014-12-31 13:40 - 00000000 ____D () C:\Users\cécile\AppData\Local\NPE 2015-01-31 18:38 - 2014-12-31 13:42 - 00000000 ____D () C:\NPE 2015-01-29 20:05 - 2014-09-30 19:56 - 00000000 ____D () C:\Users\cécile\Desktop\Eulen 2015-01-26 21:45 - 2013-11-25 16:48 - 00000000 ____D () C:\Users\cécile\Bewerbung 2015-01-25 16:56 - 2013-07-23 18:57 - 00000000 ____D () C:\ProgramData\Avira 2015-01-25 16:43 - 2009-07-14 05:45 - 00344088 _____ () C:\windows\system32\FNTCACHE.DAT 2015-01-25 16:42 - 2014-12-31 13:40 - 00000000 ____D () C:\ProgramData\Norton 2015-01-25 16:29 - 2012-04-21 06:47 - 00049402 _____ () C:\windows\DPINST.LOG 2015-01-25 16:07 - 2012-04-21 06:44 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2015-01-25 16:07 - 2012-04-21 06:44 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-25 16:07 - 2012-04-21 06:44 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater 2015-01-24 11:04 - 2013-04-21 06:38 - 00000000 ____D () C:\windows\SysWOW64\ArcVCapRender 2015-01-22 21:39 - 2013-09-18 14:29 - 00000000 ____D () C:\Users\cécile\Documents\voba 2015-01-17 18:27 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF 2015-01-17 03:56 - 2012-04-21 06:24 - 01676126 _____ () C:\windows\SysWOW64\PerfStringBackup.INI 2015-01-17 03:56 - 2012-04-21 04:11 - 00734482 _____ () C:\windows\system32\perfh007.dat 2015-01-17 03:56 - 2012-04-21 04:11 - 00159048 _____ () C:\windows\system32\perfc007.dat 2015-01-17 03:55 - 2009-07-14 06:13 - 01676126 _____ () C:\windows\system32\PerfStringBackup.INI 2015-01-15 15:39 - 2012-04-21 06:43 - 00000000 ____D () C:\Program Files (x86)\PDF Complete 2015-01-15 15:31 - 2013-08-11 12:49 - 00000000 ____D () C:\windows\system32\MRT 2015-01-15 15:14 - 2013-08-06 00:42 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2015-01-07 23:42 - 2014-05-06 01:54 - 00000000 ____D () C:\Program Files (x86)\FreeAlarmClock 2015-01-07 23:34 - 2014-07-17 09:45 - 00000000 ____D () C:\Program Files\Bitdefender 2015-01-07 23:17 - 2014-05-01 19:58 - 00000000 ____D () C:\ProgramData\Bitdefender 2015-01-07 23:17 - 2014-05-01 19:42 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender ==================== Files in the root of some directories ======= 2014-09-01 09:18 - 2014-09-01 09:18 - 0002086 _____ () C:\Users\cécile\AppData\Roaming\AAJJPL 2013-12-21 08:44 - 2013-12-21 08:44 - 0000207 _____ () C:\Users\cécile\AppData\Roaming\removeWinNetData.bat 2014-04-27 21:58 - 2014-04-27 21:58 - 0000046 _____ () C:\Users\cécile\AppData\Roaming\WB.CFG 2015-02-03 14:53 - 2015-02-03 14:53 - 0000000 ____H () C:\Users\cécile\AppData\Local\BIT938B.tmp 2013-12-20 20:08 - 2013-12-20 20:08 - 0010752 _____ () C:\Users\cécile\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-11-03 20:46 - 2013-11-03 20:46 - 0010653 _____ () C:\Users\cécile\AppData\Local\recently-used.xbel 2015-02-03 07:50 - 2015-02-03 07:50 - 0000000 _____ () C:\Users\cécile\AppData\Local\{59F0B1EF-6EBB-4408-892A-BF2C77637D3E} Some content of TEMP: ==================== C:\Users\cécile\AppData\Local\Temp\avgnt.exe C:\Users\cécile\AppData\Local\Temp\Quarantine.exe C:\Users\cécile\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-03 22:04 ==================== End Of Log ============================ --- --- --- |
|
09.02.2015, 09:13
| #8 |
| /// TB-Ausbilder | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Entschuldigung das meine Antwort etwas gedauert hat, ich war leider kränklich  Geht der Chrome wieder ? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter HKU\S-1-5-21-527591061-3285833073-1316261535-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-09-30]
emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Downloade Dir bitte  SecurityCheck und:
Der ESET Scan dauert länger: ESET Online Scanner
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
09.02.2015, 21:38
| #9 |
| | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... hallo, kein problem. bin ja sehr dankbar, dass du mir hilfst. dann wünsche ich mal gute besserung. chrome geht nach der fixlist wieder  Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-02-2015
Ran by cécile at 2015-02-09 21:28:36 Run:1
Running from C:\Users\cécile\Desktop
Loaded Profiles: cécile (Available profiles: cécile)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
HKU\S-1-5-21-527591061-3285833073-1316261535-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2014-09-30]
emptytemp:
*****************
"HKU\S-1-5-21-527591061-3285833073-1316261535-1001\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
CHR Extension: (Allin1Convert) - C:\Users\cécile\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcncagkkhfoombgbihckkccmkjemhohl directory not found.
"HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj" => Key deleted successfully.
C:\Users\cécile\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx => Moved successfully.
EmptyTemp: => Removed 605.5 MB temporary data.
The system needed a reboot.
==== End of Fixlog 21:29:00 ====
Code:
ATTFilter Results of screen317's Security Check version 0.99.96
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 31
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Google Chrome (40.0.2214.111)
Google Chrome (40.0.2214.94)
````````Process Check: objlist.exe by Laurent````````
Avira Antivir avgnt.exe
Avira Antivir avguard.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
|
|
20.02.2015, 18:47
| #10 |
| | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... den eset scanner hab ich noch nicht deinstalliert, da er bei 3% hängen geblieben ist, nach einer weiteren halben stunde, habe ich ihn dann beendet. bis dahin hatte er 4 infizierte daten gefunden. hier der bericht: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=648e62b1b6a0c143a4b2e611f8db0f12
# engine=22572
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-20 05:41:03
# local_time=2015-02-20 06:41:03 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1805 16777213 100 99 273963 7636171 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 2256235 176083913 0 0
# scanned=4073
# found=4
# cleaned=0
# scan_time=2570
sh=A889B44F50FB1B90F6A9D95231C626D147A6B5CC ft=1 fh=463911e16fbbccad vn="Variante von Win32/ExpressDownloader.H evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\goforfiles\uninstall.exe.vir"
sh=B18492E77EBDA4977135FC2F76F7291DF3C77BA1 ft=1 fh=2f90d3f2fdd0653e vn="Variante von Win32/Adware.Synatix.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\cécile\AppData\Local\DownloadGuide\Offers\vis-freeware.exe.vir"
sh=476063885747EDD774A6B8CB2790703503A75A55 ft=1 fh=d7bb79193adaee2e vn="Win32/Systweak.G evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\cécile\AppData\Roaming\Systweak\ssd\SSDPTstub.exe.vir"
sh=93F0172E398465FE8830AB01A70FDCA12EB11C4C ft=1 fh=4084d826ec2cd038 vn="Variante von Win32/Adware.Synatix.A Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\cécile\AppData\Roaming\Windows Net Data\uninstaller.exe.vir"
|
|
21.02.2015, 16:50
| #11 |
| /// TB-Ausbilder | Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... Ok, dann schwenken wir um auf EEK: Lade Dir bitte von hier  Emsisoft Emergency Kit herunter.
__________________ Lerne, zurück zu schlagen und unterstütze uns! TB Akademie | Spende | Lob & Kritik |
|
| Themen zu Windows 7, vermutlich Virus, hängt sich oft beim Suren auf, fährt manchmal nicht runter, Virenscan bleibt hängen... |
| bitdefender 2015, converter, device driver, dvdvideosoft ltd., fehlercode 0x0, fehlercode 24, fehlercode 5, fehlercode windows, flash player, internet, pup.optional.mysearchdial.a, pup.optional.smartsaver.a, pup.optional.zensearch.a, registry, services.exe, software, svchost.exe, windowsmangerprotect20.0.0.722 entfernen, zensearch entfernen |
Linear-Darstellung
