| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spysoftware auf PC?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.02.2015, 00:23
| #1 |
| |  Spysoftware auf PC? Hallo! Ich hoffe, dass Sie mir helfen können. Ich habe die Befürchtung, dass heimlich Spionagesoftware (ähnlich mspy/rootkits?) auf meinem PC installiert wurde, mit der ohne mein Wissen auf meinen PC zugegriffen werden kann. Ich habe meinen PC mit GMER gescannt, oben als Anhang der logfile, da ich das logfile leider nicht kopieren konnte. Könnte jemand das logfile ansehen und mir sagen, ob etwas verdächtiges zu sehen ist? Vielen Dank im Voraus! |
|
13.02.2015, 06:11
| #2 |
| /// the machine /// TB-Ausbilder    | Spysoftware auf PC? Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
13.02.2015, 13:31
| #3 |
| | Spysoftware auf PC? Hallo,
__________________hier sind die Logfiles: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-13 00:08:56
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0011 465,76GB
Running: gdfp1i10.exe; Driver: C:\Users\sunias\AppData\Local\Temp\uwdiqpod.sys
---- User code sections - GMER 2.1 ----
.text C:\windows\system32\Dwm.exe[1376] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefddb8ef0 5 bytes JMP 000007fffdda00b8
.text C:\windows\system32\Dwm.exe[1376] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA 000007fefddbbfd0 5 bytes JMP 000007fffdda0038
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefddb8ef0 5 bytes JMP 000007fffdd600b8
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\KERNELBASE.dll!LoadLibraryExA 000007fefddbbfd0 5 bytes JMP 000007fffdd60038
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\ole32.dll!CoCreateInstance 000007feffc87490 5 bytes JMP 000007fffdd60138
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutReset 000007fefb70a38c 5 bytes JMP 000007fefdd602b8
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutPause 000007fefb724b60 5 bytes JMP 000007fefdd60238
.text C:\windows\system32\taskhost.exe[2100] C:\windows\system32\WINMM.dll!waveOutRestart 000007fefb724ba0 5 bytes JMP 000007fefdd601b8
.text C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe[2520] C:\windows\syswow64\ADVAPI32.dll!RegOpenKeyExA 0000000077164887 5 bytes JMP 0000000100d22de0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[1052] C:\windows\system32\kernel32.dll!LoadLibraryW 0000000077b96440 5 bytes JMP 0000000169ff0038
.text C:\Program Files (x86)\Lenovo\Energy Management\utility.exe[3372] C:\windows\system32\ole32.dll!CoCreateInstance 000007feffc87490 5 bytes JMP 000007fffdda0138
.text C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000110002710
.text C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001100027f0
.text C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000110002780
.text C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe[3936] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076bd9d0b 5 bytes JMP 0000000110002850
.text C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000110002710
.text C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001100027f0
.text C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000110002780
.text C:\Program Files (x86)\Salaat Time\SalaatTime.exe[3252] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076bd9d0b 5 bytes JMP 0000000110002850
.text C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe[3788] C:\windows\system32\kernel32.dll!LoadLibraryW 0000000077b96440 5 bytes JMP 0000000169ff0038
.text C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000110002710
.text C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001100027f0
.text C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE[3244] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000110002780
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000110002710
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001100027f0
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000110002780
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[5008] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076bd9d0b 5 bytes JMP 0000000110002850
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 00000001002a2710
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001002a27f0
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 00000001002a2780
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076bd9d0b 5 bytes JMP 00000001002a2850
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076b81401 2 bytes JMP 7787b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076b81419 2 bytes JMP 7787b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076b81431 2 bytes JMP 778f8ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076b8144a 2 bytes CALL 778548ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076b814dd 2 bytes JMP 778f87a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076b814f5 2 bytes JMP 778f8978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076b8150d 2 bytes JMP 778f8698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076b81525 2 bytes JMP 778f8a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076b8153d 2 bytes JMP 7786fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076b81555 2 bytes JMP 778768ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076b8156d 2 bytes JMP 778f8f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076b81585 2 bytes JMP 778f8ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076b8159d 2 bytes JMP 778f865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076b815b5 2 bytes JMP 7786fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076b815cd 2 bytes JMP 7787b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076b816b2 2 bytes JMP 778f8e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[5016] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076b816bd 2 bytes JMP 778f85f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000100302710
.text C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001003027f0
.text C:\Program Files (x86)\Brother\Brmfcmon\BrMfcmon.exe[5100] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000100302780
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE!wdGetApplicationObject + 166 000000002f111afc 2 bytes [11, 2F]
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryExA 00000000778548db 5 bytes JMP 0000000110002710
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryW 00000000778548f3 5 bytes JMP 00000001100027f0
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!LoadLibraryExW 0000000077854925 5 bytes JMP 0000000110002780
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000077858791 5 bytes JMP 00000001526553fc
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\ole32.dll!OleLoadFromStream 0000000076b96143 5 bytes JMP 000000015311f68e
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076bd9d0b 5 bytes JMP 0000000110002850
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!SysFreeString 00000000770c3e59 5 bytes JMP 00000001526810b7
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!VariantClear 00000000770c3eae 5 bytes JMP 000000015268b0be
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!SysAllocStringByteLen 00000000770c4731 5 bytes JMP 00000001526bb5dc
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\OLEAUT32.dll!VariantChangeType 00000000770c5dee 5 bytes JMP 00000001526bc50f
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076b81401 2 bytes JMP 7787b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076b81419 2 bytes JMP 7787b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076b81431 2 bytes JMP 778f8ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076b8144a 2 bytes CALL 778548ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076b814dd 2 bytes JMP 778f87a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076b814f5 2 bytes JMP 778f8978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076b8150d 2 bytes JMP 778f8698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076b81525 2 bytes JMP 778f8a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076b8153d 2 bytes JMP 7786fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076b81555 2 bytes JMP 778768ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076b8156d 2 bytes JMP 778f8f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076b81585 2 bytes JMP 778f8ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076b8159d 2 bytes JMP 778f865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076b815b5 2 bytes JMP 7786fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076b815cd 2 bytes JMP 7787b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076b816b2 2 bytes JMP 778f8e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE[6960] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076b816bd 2 bytes JMP 778f85f1 C:\windows\syswow64\kernel32.dll
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\mmc.exe [6404:5476] 000007feee7efe98
Thread C:\windows\system32\mmc.exe [6404:4272] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:5500] 000007fefbd12bf8
Thread C:\windows\system32\mmc.exe [6404:3316] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:6840] 000007feee939cc0
Thread C:\windows\system32\mmc.exe [6404:6632] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:1108] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:5816] 000007feee81d9ac
Thread C:\windows\system32\mmc.exe [6404:1564] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:1204] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:4808] 000007feee9300bc
Thread C:\windows\system32\mmc.exe [6404:6064] 000007feee9300bc
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076fc1a13
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5@78f5fd30d664 0x78 0xA3 0x27 0x44 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273788b6b5@fcc73433af4b 0xF1 0xFB 0x97 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0c6076fc1a13 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5@78f5fd30d664 0x78 0xA3 0x27 0x44 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273788b6b5@fcc73433af4b 0xF1 0xFB 0x97 0xC9 ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-02-2015
Ran by sunias at 2015-02-13 13:27:06
Running from C:\Users\sunias\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: ZoneAlarm Antivirus (Disabled - Up to date) {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: ZoneAlarm Anti-Spyware (Disabled - Up to date) {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
FW: ZoneAlarm Firewall (Disabled) {E6380B7E-D4B2-19F1-083E-56486607704B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 15.0.0.293 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3-Downloader 1.0.18 (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
AntiToolbar (HKLM\...\AntiToolbar) (Version: 1.0.0.5 - Reimage)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{bd538030-07d4-4999-a525-7fafa2483f56}) (Version: 1.1.30.21727 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.30.21727 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.7.468 - Avira)
Benutzerhandbuch (x32 Version: 1.0.0.6 - Lenovo) Hidden
Biet-O-Matic v2.14.8 (HKLM-x32\...\Biet-O-Matic v2.14.8) (Version: 2.14.8 - BOM Development Team)
Brother MFL-Pro Suite DCP-195C (HKLM-x32\...\{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
CdCoverCreator 2.5.3 (HKLM-x32\...\CdCoverCreator) (Version: 2.5.3 - thyanté Software)
Cool Edit Pro 2.1 (HKLM-x32\...\Cool Edit Pro 2.1) (Version: - )
CyberLink PhotoDirector 2011 (HKLM-x32\...\InstallShield_{4862344A-A39C-4897-ACD4-A1BED5163C5A}) (Version: 2.0.3523 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DVD Shrink 3.2 deutsch (DeCSS-frei) (HKLM-x32\...\DVD Shrink DE_is1) (Version: - DVD Shrink)
Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.2.1 - Lenovo)
Energy Management (x32 Version: 6.0.2.1 - Lenovo) Hidden
File Type Advisor 1.4 (HKLM-x32\...\File Type Advisor_is1) (Version: - filetypeadvisor.com)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free M4a to MP3 Converter 8.1 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com)
Free Studio version 6.4.0.1122 (HKLM-x32\...\Free Studio_is1) (Version: 6.4.0.1122 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.42.716 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.42.716 - DVDVideoSoft Ltd.)
GIMP 2.8.4 (HKLM\...\GIMP-2_is1) (Version: 2.8.4 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Google+ Auto Backup (HKLM-x32\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)
Iminent (x32 Version: 6.42.32.0 - Iminent) Hidden <==== ATTENTION
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation)
Java 7 Update 21 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.210 - Oracle)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Key Maker v2.0.072203 (HKLM-x32\...\Key Maker_is1) (Version: 2.0 - Softnik Technologies)
LEGO® Star Wars™ III: The Clone Wars™ (HKLM-x32\...\{6C0A6B81-0D00-453F-B220-E1F7931B3C2A}) (Version: 1.0.0.0 - LucasArts)
Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.8000 - Broadcom Corporation)
Lenovo EasyCamera (HKLM-x32\...\{ADE16A9D-FBDC-4ECC-B6BD-9C31E51D0333}) (Version: 1.11.0209.1 - Lenovo EasyCamera)
Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.5 - Lenovo)
Lenovo Games Console (HKLM-x32\...\Lenovo Games Console) (Version: 1.2.6.436 - Oberon Media Inc.)
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden
Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3603 - CyberLink Corp.)
Lenovo YouCam (x32 Version: 3.1.3603 - CyberLink Corp.) Hidden
Lenovo_Wireless_Driver (HKLM-x32\...\{28ABE740-47F3-441B-9437-852F6A64EFF8}) (Version: 1.02.01 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\OneDriveSetup.exe) (Version: 17.0.4029.0217 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 7 Premium (HKLM-x32\...\{70AB1576-7883-2313-C650-7A71270B1031}) (Version: 7.01.0735 - Nero AG)
NVIDIA Grafiktreiber 267.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 267.54 - NVIDIA Corporation)
Onekey Theater (HKLM-x32\...\InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}) (Version: 2.0.2.7 - Lenovo)
Onekey Theater (x32 Version: 2.0.2.7 - Lenovo) Hidden
PamFax (HKLM-x32\...\{6432B21C-CA95-46CA-87D4-178CC2E58F84}_is1) (Version: 3.5.0.14 - Scendix Software GmbH)
PaperPort Image Printer 64-bit (HKLM\...\{ABA4FAF1-6389-45F9-92CE-3914A4E5C471}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )
Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.21.531.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6505 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10008 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.44 - Piriform)
Salaat Time 2.7 (HKLM\...\{F993F285-0F98-4E13-9421-41DB36806EE3}) (Version: 2.7 - Salaat Time - www.salaattime.com)
ScanSoft PaperPort 11 (HKLM-x32\...\{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}) (Version: 11.2.0000 - Nuance Communications, Inc.)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
SRS Control Panel (HKLM\...\{25EE6AF4-8FD6-4E09-AD9B-3ACC0B81D902}) (Version: 1.11.4800 - SRS Labs, Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.2.7.0 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo)
VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.0.1206 - Lenovo)
VIS (HKLM-x32\...\VIS) (Version: - ) <==== ATTENTION
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.65 - Nullsoft, Inc)
Winamp Erkennungs-Plug-in (HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo)
WinHex (HKLM-x32\...\WinHex) (Version: - )
WinRAR 5.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
ZoneAlarm Antivirus (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Firewall (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden
ZoneAlarm Free Antivirus + Firewall (HKLM-x32\...\ZoneAlarm Free Antivirus + Firewall) (Version: 13.0.208.000 - Check Point)
ZoneAlarm Security (x32 Version: 13.0.208.000 - Check Point Software Technologies Ltd.) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\sunias\AppData\Local\Microsoft\SkyDrive\17.0.4029.0217\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
27-01-2015 12:01:12 Windows Update
30-01-2015 18:47:25 Windows Update
04-02-2015 07:26:23 Windows Update
10-02-2015 10:51:16 Windows Update
12-02-2015 00:46:35 Windows Update
13-02-2015 02:02:12 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1E9C810C-280A-4AE0-8E76-77D1DAF8C5A7} - System32\Tasks\FileAdvisorUpdate => C:\Program Files (x86)\File Type Advisor\fileadvisor.exe [2013-09-04] (File Type Advisor)
Task: {47EF3E5D-D6CE-4B5F-B051-CBCF7919A414} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {49B2E7A3-2EB4-4E7E-BE83-4057D73F2D58} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {702F028F-5711-457D-B821-D5EC059AF3A2} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {90556584-549F-4B3E-AF20-D993E795A5F1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A587CCF5-32A8-4311-967D-A942E88F9188} - System32\Tasks\FileAdvisorCheck => C:\Program Files (x86)\File Type Advisor\file-type-advisor.exe [2013-09-04] (filetypeadvisor.com )
Task: {C9DCF277-2EC2-421F-9884-49CC6F3BCFD4} - System32\Tasks\{482C501C-B190-4BD4-9F07-394AAF0CF979} => pcalua.exe -a "F:\Driver\Windows Driver\Setup.exe" -d "F:\Driver\Windows Driver"
Task: {CC0A1A8E-6A18-4668-AEC6-5037350A7C97} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2010-12-05] (CyberLink)
Task: {D6B5D4E2-3292-4858-9BCB-37B300C5ED46} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: {FA520359-00D7-4B6B-A949-7400FEC70955} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-18] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2010-11-11 11:42 - 2010-11-11 11:42 - 00202144 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect64.dll
2010-11-11 11:44 - 2010-11-11 11:44 - 00156576 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll64.dll
2012-02-17 13:17 - 2012-02-17 13:17 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2011-02-15 13:26 - 2011-02-15 13:26 - 00205088 _____ () C:\Program Files\Lenovo\Bluetooth Software\btkeyind.dll
2011-04-14 04:01 - 2011-03-25 10:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2008-12-20 04:20 - 2012-02-17 13:32 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2008-12-20 04:20 - 2012-02-17 13:32 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2012-07-02 08:11 - 2012-07-02 08:11 - 02498048 _____ () C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
2012-02-17 13:20 - 2012-02-17 13:20 - 00100256 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
2015-01-31 16:44 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2015-01-31 16:44 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2015-01-31 16:44 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2015-01-31 16:44 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2015-01-31 16:44 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2010-11-11 11:38 - 2010-11-11 11:38 - 00161696 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll
2010-11-11 11:39 - 2010-11-11 11:39 - 00133024 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll
2012-05-16 20:01 - 2012-05-16 20:01 - 00140800 _____ () C:\Program Files (x86)\Rainlendar2\lua52.dll
2012-07-02 08:11 - 2012-07-02 08:11 - 00198144 _____ () C:\Program Files (x86)\Rainlendar2\plugins\iCalendarPlugin.dll
2012-06-17 14:22 - 2012-06-17 14:22 - 00012800 _____ () C:\Program Files (x86)\Rainlendar2\lfs.dll
2012-02-17 13:17 - 2012-02-17 13:17 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2012-09-06 16:26 - 2009-02-27 15:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-01-27 12:13 - 2015-01-27 12:13 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\uni\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Control Panel\Desktop\\Wallpaper -> C:\Users\Elias\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.10.112.1 - 134.76.63.248
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1621219649-1687009001-4096927769-500 - Administrator - Disabled)
Elias (S-1-5-21-1621219649-1687009001-4096927769-1003 - Limited - Enabled) => C:\Users\Elias
Gast (S-1-5-21-1621219649-1687009001-4096927769-501 - Limited - Disabled)
sunias (S-1-5-21-1621219649-1687009001-4096927769-1001 - Administrator - Enabled) => C:\Users\sunias
uni (S-1-5-21-1621219649-1687009001-4096927769-1002 - Limited - Enabled) => C:\Users\uni
UpdatusUser (S-1-5-21-1621219649-1687009001-4096927769-1000 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/13/2015 01:10:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x17f0
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:10:05 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x16f8
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:09:44 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x192c
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:06:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x598
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:04:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0xb60
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:03:56 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x16e0
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:02:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x1be0
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 00:51:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 1.0.21.0, Zeitstempel: 0x4d736e78
Name des fehlerhaften Moduls: daemonu.exe, Version: 1.0.21.0, Zeitstempel: 0x4d736e78
Ausnahmecode: 0xc000000d
Fehleroffset: 0x0004ddc6
ID des fehlerhaften Prozesses: 0x7dc
Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0
Pfad der fehlerhaften Anwendung: daemonu.exe1
Pfad des fehlerhaften Moduls: daemonu.exe2
Berichtskennung: daemonu.exe3
Error: (02/13/2015 01:57:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Name des fehlerhaften Moduls: RootkitRevealer.exe, Version: 1.71.0.0, Zeitstempel: 0x44e255aa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000040cd
ID des fehlerhaften Prozesses: 0x1080
Startzeit der fehlerhaften Anwendung: 0xRootkitRevealer.exe0
Pfad der fehlerhaften Anwendung: RootkitRevealer.exe1
Pfad des fehlerhaften Moduls: RootkitRevealer.exe2
Berichtskennung: RootkitRevealer.exe3
Error: (02/13/2015 01:57:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm mbar.exe, Version 1.8.3.1004 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: a54
Startzeit: 01d04720a18059c2
Endzeit: 0
Anwendungspfad: C:\Users\sunias\Desktop\mbar\mbar.exe
Berichts-ID: 3acb55b9-b31b-11e4-a6e2-64273788b6b5
System errors:
=============
Error: (02/13/2015 01:23:52 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 01:16:46 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 01:15:09 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: 10.10.118.53192.168.137.0255.255.255.0
Error: (02/13/2015 01:15:08 PM) (Source: ipnathlp) (EventID: 30013) (User: )
Description: 169.254.85.69192.168.137.0255.255.255.0
Error: (02/13/2015 01:15:05 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 01:13:41 PM) (Source: ipnathlp) (EventID: 1233) (User: )
Description:
Error: (02/13/2015 01:04:29 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 01:02:59 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 01:01:31 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Error: (02/13/2015 00:58:47 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0
Microsoft Office Sessions:
=========================
Error: (01/30/2014 09:09:14 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6690.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 265164 seconds with 4980 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-09-11 04:53:07.313
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 04:53:07.313
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 04:53:05.784
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 04:53:05.784
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 04:51:13.745
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-11 04:51:11.015
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-14 03:57:34.125
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-14 03:57:34.125
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x86\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-14 03:57:33.096
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-08-14 03:57:33.096
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files (x86)\CheckPoint\ZoneAlarm\avsys\install\instdrivers\kl1\x64\win8\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 58%
Total physical RAM: 4010.14 MB
Available physical RAM: 1659.57 MB
Total Pagefile: 8018.47 MB
Available Pagefile: 5251.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:421.81 GB) (Free:304.71 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:25.71 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 959FB4A7)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=421.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=14.8 GB) - (Type=12)
==================== End Of Log ============================
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2015
Ran by sunias (administrator) on SUNIAS-PC on 13-02-2015 13:25:27
Running from C:\Users\sunias\Downloads
Loaded Profiles: UpdatusUser & sunias & uni & Elias (Available profiles: UpdatusUser & sunias & uni & Elias)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Reimage®) C:\Program Files\AntiToolbar\ReiGuard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe
() C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe
() C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe
(Salaat Time - www.salaattime.com) C:\Program Files (x86)\Salaat Time\SalaatTime.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Windows\System32\consent.exe
(Alexander Roshal) C:\Program Files\WinRAR\WinRAR.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWelcome.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDRootAlyzer.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13353064 2011-11-14] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2538280 2010-12-22] (Synaptics Incorporated)
HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2012-02-17] (Lenovo)
HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-02-17] (Lenovo)
HKLM\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9769888 2012-02-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2012-02-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [fssui] => C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2013-02-05] (Microsoft Corporation)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2010-12-05] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [224352 2010-12-05] (CyberLink Corp.)
HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-02-17] (Lenovo)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SSBkgdUpdate] => C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] => C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [702768 2014-12-20] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [NeroFilterCheck] => C:\Program Files (x86)\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [137352 2014-03-18] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\...\Run: [FactoryTest] => C:\Windows\Test.bat
HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\...\Run: [Power2GoExpress] => NA
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [Rainlendar2] => C:\Program Files (x86)\Rainlendar2\Rainlendar2.exe [2498048 2012-07-02] ()
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [GoogleChromeAutoLaunch_20F96BC222F97C2FF595FCC10AC512E8] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\RunOnce: [Application Restart #0] => C:\Program Files (x86)\Windows Live\Family Safety\fsui.exe [892416 2013-02-05] (Microsoft Corporation)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE [409768 2015-01-14] (Microsoft Corporation)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\...\MountPoints2: {bae10d51-595c-11e1-bbda-806e6f6e6963} - F:\Launcher.exe
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Run: [SalaatTime] => C:\Program Files (x86)\Salaat Time\SalaatTime.exe [17199104 2013-03-10] (Salaat Time - www.salaattime.com)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\...\MountPoints2: {bae10d51-595c-11e1-bbda-806e6f6e6963} - Skillstraining_2 Installer.exe
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [226920 2011-03-06] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll => C:\windows\SysWOW64\nvinit.dll [192616 2011-03-06] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers: [VeriFace Enc] -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicyUsers\S-1-5-21-1621219649-1687009001-4096927769-1003\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1621219649-1687009001-4096927769-1002\User: Group Policy restriction detected <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lenovo.com
HKU\S-1-5-21-1621219649-1687009001-4096927769-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-1621219649-1687009001-4096927769-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-1621219649-1687009001-4096927769-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> DefaultScope {7F595925-1C4E-430B-B712-DEE63B233526} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=HFA5&Lan=de&q={searchTerms}&gu=724592469b2345e2bf7853a962eda41c&tu=10G9z00DW1D03M0&sku=&tstsId=&ver=&&r=355
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN_deDE498DE499
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> {7F595925-1C4E-430B-B712-DEE63B233526} URL = hxxp://search.zonealarm.com/search?src=sp&tbid=HFA5&Lan=de&q={searchTerms}&gu=724592469b2345e2bf7853a962eda41c&tu=10G9z00DW1D03M0&sku=&tstsId=&ver=&&r=355
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1002 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN
SearchScopes: HKU\S-1-5-21-1621219649-1687009001-4096927769-1003 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENN
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKU\S-1-5-21-1621219649-1687009001-4096927769-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Tcpip\Parameters: [DhcpNameServer] 10.10.112.1 134.76.63.248
FireFox:
========
FF ProfilePath: C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default
FF SelectedSearchEngine: Search By ZoneAlarm
FF Homepage: hxxp://google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1621219649-1687009001-4096927769-1001: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\sunias\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\user.js
FF SearchPlugin: C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\searchplugins\gmx-suche.xml
FF Extension: Avira Browser Safety - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\abs@avira.com [2015-02-02]
FF Extension: WEB.DE MailCheck - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\toolbar@web.de [2014-12-19]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-21]
FF Extension: Easy YouTube Video Downloader - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013-02-10]
FF Extension: Adblock Plus - C:\Users\sunias\AppData\Roaming\Mozilla\Firefox\Profiles\0x0rnipr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-10]
FF HKU\S-1-5-21-1621219649-1687009001-4096927769-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
Chrome:
=======
CHR HomePage: Profile 1 -> hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&sp=hp&searchtype=hp&t=c0120
CHR StartupUrls: Profile 1 -> "hxxp://feed.plusnetwork.com/?publisher=MessengerPlus&dpid=pb2&sp=hp&searchtype=hp&t=c0120"
CHR Profile: C:\Users\sunias\AppData\Local\Google\Chrome\User Data\default
CHR Profile: C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-09]
CHR Extension: (Google Drive) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-09]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-26]
CHR Extension: (YouTube) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-09]
CHR Extension: (Google-Suche) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-09]
CHR Extension: (Avira Browserschutz) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-09-26]
CHR Extension: (Google Wallet) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-09]
CHR Extension: (Google Mail) - C:\Users\sunias\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-09]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiToolbarProtector; C:\Program Files\AntiToolbar\ReiGuard.exe [5101928 2014-01-23] (Reimage®)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [431920 2014-12-20] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [431920 2014-12-20] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [956192 2011-02-15] (Broadcom Corporation.)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3558112 2014-03-18] (Check Point Software Technologies Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe [81752 2014-02-23] (Check Point Software Technologies, Ltd.)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [119272 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131608 2014-10-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-27] (Avira Operations GmbH & Co. KG)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [7717984 2013-12-24] (Kaspersky Lab ZAO)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-12-24] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [489568 2013-12-24] (Kaspersky Lab ZAO)
R3 SPUVCbv; C:\Windows\System32\Drivers\usbvideo.sys [185344 2013-07-12] (Microsoft Corporation)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [451480 2014-03-18] (Check Point Software Technologies Ltd.)
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
U2 DriverService; No ImagePath
U2 IAStorDataMgrSvc; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
U2 Oasis2Service; No ImagePath
U2 PCCarerServic; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SoftwareService; No ImagePath
U2 Stereo Service; No ImagePath
U3 uwdiqpod; \??\C:\Users\sunias\AppData\Local\Temp\uwdiqpod.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-13 13:25 - 2015-02-13 13:26 - 00026375 _____ () C:\Users\sunias\Downloads\FRST.txt
2015-02-13 13:25 - 2015-02-13 13:25 - 02134016 _____ (Farbar) C:\Users\sunias\Downloads\FRST64.exe
2015-02-13 13:25 - 2015-02-13 13:25 - 00000000 ____D () C:\FRST
2015-02-13 13:19 - 2015-02-13 13:19 - 00380416 _____ () C:\Users\sunias\Downloads\Gmer-19357.exe
2015-02-13 13:07 - 2015-02-13 13:07 - 00000000 ____D () C:\Users\sunias\Downloads\RootkitRevealer(1)
2015-02-13 13:05 - 2015-02-13 13:05 - 00231390 _____ () C:\Users\sunias\Downloads\RootkitRevealer(1).zip
2015-02-13 01:56 - 2015-02-13 01:56 - 00231390 _____ () C:\Users\sunias\Downloads\RootkitRevealer.zip
2015-02-13 01:05 - 2015-02-13 01:56 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-13 01:04 - 2015-02-13 01:56 - 00000000 ____D () C:\Users\sunias\Desktop\mbar
2015-02-13 01:04 - 2015-02-13 01:04 - 16466552 _____ (Malwarebytes Corp.) C:\Users\sunias\Downloads\mbar-1.08.3.1004.exe
2015-02-13 00:09 - 2015-02-13 00:09 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2015-02-13 00:08 - 2015-02-13 00:08 - 00022069 _____ () C:\Users\sunias\Desktop\scan gmer.log
2015-02-12 23:39 - 2015-02-12 23:39 - 00380416 _____ () C:\Users\sunias\Downloads\gdfp1i10.exe
2015-02-12 23:30 - 2015-02-12 23:30 - 01188194 _____ () C:\Users\sunias\Downloads\ProcessExplorer.zip
2015-02-12 23:14 - 2015-02-12 23:14 - 00291606 _____ () C:\Users\sunias\Downloads\TCPView.zip
2015-02-12 20:34 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2015-02-12 20:34 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-02-12 20:34 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2015-02-12 20:34 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-02-11 05:37 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\aepic.dll
2015-02-11 05:37 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-02-11 05:37 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\windows\system32\aitstatic.exe
2015-02-11 05:37 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2015-02-11 05:37 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2015-02-11 05:37 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2015-02-11 05:37 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\windows\system32\perftrack.dll
2015-02-11 05:37 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\wdi.dll
2015-02-11 05:37 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\windows\system32\powertracker.dll
2015-02-11 05:37 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdi.dll
2015-02-11 05:36 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2015-02-11 05:36 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2015-02-11 05:36 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2015-02-11 05:36 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2015-02-11 05:36 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2015-02-11 05:36 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2015-02-11 05:36 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2015-02-11 05:36 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2015-02-11 05:36 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2015-02-11 05:36 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2015-02-11 05:36 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2015-02-11 05:36 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2015-02-11 05:36 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2015-02-11 05:36 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2015-02-11 05:36 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2015-02-11 05:36 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2015-02-11 05:36 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2015-02-11 05:36 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2015-02-11 05:36 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2015-02-11 05:36 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2015-02-11 05:36 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll
2015-02-11 05:36 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll
2015-02-11 05:36 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-02-11 05:36 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2015-02-11 05:36 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2015-02-11 05:36 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2015-02-11 05:36 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2015-02-11 05:36 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-02-11 05:36 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2015-02-11 05:36 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2015-02-11 05:36 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2015-02-11 05:36 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2015-02-11 05:36 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2015-02-11 05:36 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2015-02-11 05:36 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2015-02-11 05:36 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-02-11 05:36 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2015-02-11 05:36 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2015-02-11 05:36 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2015-02-11 05:36 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 05:36 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-02-11 05:36 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2015-02-11 05:36 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2015-02-11 05:36 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2015-02-11 05:36 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2015-02-11 05:36 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2015-02-11 05:36 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2015-02-11 05:36 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2015-02-11 05:36 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2015-02-11 05:36 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2015-02-11 05:36 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2015-02-11 05:36 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2015-02-11 05:36 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-02-11 05:36 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2015-02-11 05:36 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2015-02-11 05:36 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2015-02-11 05:36 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2015-02-11 05:36 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-02-11 05:36 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 05:36 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2015-02-11 05:36 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2015-02-11 05:36 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2015-02-11 05:36 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-02-11 05:36 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2015-02-11 05:36 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-02-11 05:36 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2015-02-11 05:36 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-02-11 05:36 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-02-11 05:36 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2015-02-11 05:36 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-02-11 05:36 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-02-11 05:36 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2015-02-11 05:36 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2015-02-11 05:36 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2015-02-11 05:36 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2015-02-11 05:36 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2015-02-11 05:36 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2015-02-11 05:36 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2015-02-11 05:35 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-02-11 05:35 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-02-11 05:35 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-02-11 05:35 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-02-11 05:35 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-02-11 05:35 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\windows\system32\scesrv.dll
2015-02-11 05:35 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\windows\SysWOW64\scesrv.dll
2015-02-11 05:35 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2015-02-11 05:35 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2015-02-11 05:35 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2015-02-11 05:35 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2015-02-11 05:35 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2015-02-11 05:34 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-02-11 05:34 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-02-11 05:34 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-02-11 05:34 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-02-11 05:34 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2015-02-10 01:34 - 2015-02-10 01:34 - 00000000 _____ () C:\windows\SysWOW64\sho21A1.tmp
2015-02-05 01:26 - 2015-02-05 01:26 - 00000000 _____ () C:\Users\sunias\Documents\~WRD3656.tmp
2015-02-01 22:58 - 2015-02-02 01:10 - 00000000 ____D () C:\Users\sunias\Desktop\Essen
2015-01-31 17:01 - 2015-02-13 01:05 - 00136408 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-31 17:00 - 2015-02-13 01:05 - 00097496 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-01-31 17:00 - 2015-01-31 17:00 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-31 17:00 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-01-31 16:44 - 2015-01-31 16:48 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2015-01-31 16:44 - 2015-01-31 16:47 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-01-31 16:44 - 2015-01-31 16:44 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-01-31 16:44 - 2015-01-31 16:44 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-01-31 16:44 - 2015-01-31 16:44 - 00000000 ____D () C:\windows\System32\Tasks\Safer-Networking
2015-01-31 16:44 - 2015-01-31 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-01-31 16:44 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\windows\system32\sdnclean64.exe
2015-01-31 16:38 - 2015-01-31 16:38 - 01191200 _____ () C:\Users\sunias\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2015-01-31 15:29 - 2015-01-31 15:30 - 13946462 _____ () C:\Users\sunias\Downloads\SysinternalsSuite.zip
2015-01-31 15:25 - 2015-01-31 15:27 - 00000000 ____D () C:\Users\sunias\Desktop\Handy-Backup
2015-01-31 15:22 - 2015-01-31 15:22 - 00000000 ____D () C:\Users\sunias\Desktop\WhatsApp
2015-01-29 12:46 - 2015-01-29 12:47 - 00045130 _____ () C:\Users\sunias\Desktop\L'amore più forte è quello che può dimostrare la sua fragilità
2015-01-29 12:41 - 2015-01-29 12:41 - 00039255 _____ () C:\Users\sunias\Desktop\Da lontano giungono canzoni d’addio ma non si sente il rumore degli strappi della separazione
2015-01-29 11:30 - 2015-01-29 11:30 - 00055531 _____ () C:\Users\sunias\Desktop\ La felicità è solo un momento di pausa tra un dolore e l’altro
2015-01-27 12:13 - 2015-01-27 12:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 20:00 - 2015-02-02 00:54 - 00000000 ____D () C:\Users\sunias\Desktop\Paare
2015-01-26 19:59 - 2015-01-27 11:57 - 00000000 ____D () C:\Users\sunias\Desktop\Blumen
2015-01-26 19:58 - 2015-02-02 00:54 - 00000000 ____D () C:\Users\sunias\Desktop\Vintage Shabby
2015-01-26 19:58 - 2015-02-01 23:21 - 00000000 ____D () C:\Users\sunias\Desktop\Wohnen
2015-01-26 19:58 - 2015-02-01 23:11 - 00000000 ____D () C:\Users\sunias\Desktop\Strick
2015-01-26 19:55 - 2015-02-01 23:13 - 00000000 ____D () C:\Users\sunias\Desktop\Tiere
2015-01-26 19:55 - 2015-02-01 23:03 - 00000000 ____D () C:\Users\sunias\Desktop\Kinder
2015-01-26 19:55 - 2015-01-30 14:25 - 00000000 ____D () C:\Users\sunias\Desktop\Natur Städte
2015-01-21 12:41 - 2015-01-21 12:41 - 03423974 _____ () C:\Users\sunias\Downloads\Anhänge_2015121.zip
2015-01-20 22:17 - 2015-02-08 22:30 - 00000000 ____D () C:\Users\sunias\Desktop\Bilder
2015-01-20 22:17 - 2015-01-20 22:18 - 00000000 ____D () C:\Users\sunias\Desktop\Dokumente
2015-01-20 22:15 - 2015-01-26 20:23 - 00000000 ____D () C:\Users\sunias\Desktop\sprüche
2015-01-20 22:06 - 2015-01-20 22:06 - 00001305 _____ () C:\Users\sunias\Desktop\Movie Maker.lnk
2015-01-20 20:17 - 2015-01-20 20:17 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-01-20 20:17 - 2015-01-20 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-01-16 11:10 - 2015-01-16 11:10 - 02928413 _____ () C:\Users\sunias\Downloads\VID_20131206_224235.mp4
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-13 13:19 - 2012-02-17 20:23 - 00700462 _____ () C:\windows\system32\perfh007.dat
2015-02-13 13:19 - 2012-02-17 20:23 - 00150498 _____ () C:\windows\system32\perfc007.dat
2015-02-13 13:19 - 2012-02-17 13:27 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-13 13:19 - 2009-07-14 06:13 - 01622236 _____ () C:\windows\system32\PerfStringBackup.INI
2015-02-13 13:16 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 13:16 - 2009-07-14 05:45 - 00028704 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-13 13:15 - 2014-05-26 20:58 - 00000435 _____ () C:\windows\system32\Drivers\etc\hosts.ics
2015-02-13 13:15 - 2012-02-17 12:31 - 01931515 _____ () C:\windows\WindowsUpdate.log
2015-02-13 13:15 - 2009-07-14 05:51 - 00117907 _____ () C:\windows\setupact.log
2015-02-13 13:10 - 2012-02-17 13:17 - 03905855 _____ () C:\FaceProv.log
2015-02-13 13:05 - 2014-02-12 13:54 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\FileAdvisor
2015-02-13 12:55 - 2012-09-14 12:29 - 00000000 ____D () C:\Users\sunias\.rainlendar2
2015-02-13 12:55 - 2012-08-31 21:50 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-02-13 12:55 - 2012-02-17 13:18 - 00776769 _____ () C:\windows\system32\fastboot.set
2015-02-13 12:55 - 2012-02-17 13:17 - 00000000 ____D () C:\ProgramData\VeriFace
2015-02-13 12:54 - 2014-08-26 23:44 - 00000680 __RSH () C:\Users\sunias\ntuser.pol
2015-02-13 12:54 - 2012-08-25 16:12 - 00000000 ____D () C:\Users\sunias
2015-02-13 12:54 - 2012-02-17 13:27 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-13 12:47 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-02-12 21:35 - 2014-08-26 23:35 - 00000000 ____D () C:\Users\uni
2015-02-12 18:08 - 2014-02-11 13:05 - 00003518 _____ () C:\windows\System32\Tasks\FileAdvisorCheck
2015-02-12 18:08 - 2014-02-11 13:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\File Type Advisor
2015-02-12 18:08 - 2014-02-11 13:05 - 00000000 ____D () C:\Program Files (x86)\File Type Advisor
2015-02-12 14:38 - 2014-08-26 23:57 - 00001328 __RSH () C:\Users\Elias\ntuser.pol
2015-02-12 14:38 - 2014-08-26 23:57 - 00000000 ____D () C:\Users\Elias
2015-02-12 13:26 - 2009-07-14 05:45 - 00307728 _____ () C:\windows\system32\FNTCACHE.DAT
2015-02-12 13:23 - 2014-12-20 03:22 - 00000000 ____D () C:\windows\system32\appraiser
2015-02-12 13:23 - 2014-05-07 07:33 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-02-12 13:23 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\tracing
2015-02-12 00:51 - 2012-10-02 08:19 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 00:18 - 2014-08-16 22:25 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-12 00:18 - 2012-12-17 06:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-02-12 00:18 - 2012-12-17 06:18 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-02-10 10:36 - 2010-11-21 04:47 - 00220960 _____ () C:\windows\PFRO.log
2015-02-06 03:47 - 2012-08-25 16:27 - 00000000 ____D () C:\windows\System32\Tasks\Games
2015-02-06 01:14 - 2012-02-17 13:27 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-06 01:14 - 2012-02-17 13:27 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 11:55 - 2012-08-31 21:50 - 00701616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 11:55 - 2012-08-31 21:50 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-05 11:55 - 2012-08-31 21:50 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 10:05 - 2009-07-14 06:08 - 00032632 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-02-05 10:03 - 2012-09-08 00:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-04 18:25 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2015-02-02 19:41 - 2012-09-01 00:10 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2015-02-02 10:26 - 2013-05-04 16:37 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\.minecraft
2015-02-01 23:08 - 2014-02-08 00:50 - 00000743 _____ () C:\Users\sunias\Desktop\mp3DirectCut.lnk
2015-02-01 23:07 - 2014-03-16 21:11 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Skype
2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\Malwarebytes
2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-31 17:00 - 2013-10-30 10:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2015-01-31 15:13 - 2014-04-29 09:07 - 00078409 ____H () C:\windows\SysWOW64\BTImages.dat
2015-01-20 20:17 - 2014-03-16 21:11 - 00000000 ____D () C:\ProgramData\Skype
2015-01-20 20:13 - 2012-12-26 23:27 - 00000000 ____D () C:\Temp
2015-01-20 20:10 - 2013-10-27 17:40 - 00001122 _____ () C:\Users\sunias\Desktop\Cyberlink Power2Go.lnk
2015-01-16 11:07 - 2014-06-22 19:50 - 00000000 ____D () C:\Users\sunias\AppData\Roaming\vlc
2015-01-15 03:06 - 2012-09-06 10:59 - 01598034 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
==================== Files in the root of some directories =======
2013-05-26 19:34 - 2013-05-26 19:34 - 0005909 _____ () C:\Users\sunias\AppData\Local\recently-used.xbel
Some content of TEMP:
====================
C:\Users\Elias\AppData\Local\Temp\avgnt.exe
C:\Users\sunias\AppData\Local\Temp\A.exe
C:\Users\sunias\AppData\Local\Temp\avgnt.exe
C:\Users\sunias\AppData\Local\Temp\CUTBA.exe
C:\Users\sunias\AppData\Local\Temp\CXQLD.exe
C:\Users\sunias\AppData\Local\Temp\EYJUY.exe
C:\Users\sunias\AppData\Local\Temp\HUPH.exe
C:\Users\sunias\AppData\Local\Temp\i4jdel0.exe
C:\Users\sunias\AppData\Local\Temp\i4jdel1.exe
C:\Users\sunias\AppData\Local\Temp\i4jdel2.exe
C:\Users\sunias\AppData\Local\Temp\i4jdel3.exe
C:\Users\sunias\AppData\Local\Temp\i4jdel4.exe
C:\Users\sunias\AppData\Local\Temp\PAXH.exe
C:\Users\sunias\AppData\Local\Temp\RIM.exe
C:\Users\sunias\AppData\Local\Temp\tmd_34013428.exe
C:\Users\sunias\AppData\Local\Temp\UQEUEFPDW.exe
C:\Users\sunias\AppData\Local\Temp\vlc-2.1.5-win32.exe
C:\Users\uni\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-03 01:48
==================== End Of Log ============================
--- --- --- |
|
13.02.2015, 16:22
| #4 |
| | Spysoftware auf PC? Hier noch ein Logfile: Code:
ATTFilter // info: Rootkit removal help file
// copyright: (c) 2008-2015 Safer-Networking Ltd. All rights reserved.
:: RootAlyzer Results
File:"No admin in ACL","C:\Windows\Temp\ZLT00177.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00307.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT004e7.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00628.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT008ba.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00b2d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00c2e.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00cb7.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00ce8.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00d90.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00e62.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00f03.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00f0d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT00fce.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0100f.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0104b.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01052.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0107f.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0110e.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0112c.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01339.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01529.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01632.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT016f3.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01909.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01a1d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01ab4.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01afa.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01b6f.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01c6e.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01c84.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01ded.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01e01.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT01e35.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02024.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT021b5.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02390.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02448.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02490.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT024ae.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02742.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT027c8.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02c08.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT02f42.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT030e4.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03114.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03205.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03347.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03361.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT033e4.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0346e.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03544.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT035c2.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03745.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03789.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03947.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03986.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03a43.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03ab0.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03cb1.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT03f71.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT04097.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT04272.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT042cc.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0432b.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT043d1.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT044f9.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0478b.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT04886.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT048fb.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT04ef2.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0504d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT050dd.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT05769.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0576c.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT05802.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT05b98.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT05bd5.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT05ebf.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT06037.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0613e.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0622d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT06272.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0629d.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0634f.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT063ac.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT06536.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT066e0.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT06eb2.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07284.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07420.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT074ce.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0755a.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT0765f.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07684.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07b83.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07d32.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07dbf.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07e23.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07e28.TMP"
File:"No admin in ACL","C:\Windows\Temp\ZLT07f94.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF00CA9FEB65A9F33E.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF0B95819A25FFA450.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF11D52BEF121D528A.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF18E5493883B9BBD7.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF1A9426C66E746734.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF1AF303E419ED30C8.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF2B4AAB5275B2FB80.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF2C5BB04C6E8E275B.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF2CFAB3EC6F4BF846.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF330D440B035EEFC4.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF3A97B3832C65F079.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF3B7BD4DE967D2338.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF3D817C5122FAB23F.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF486727246DA90C52.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF5071B525E6223570.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF517AE8CE93226699.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF51FE67035AC8F95B.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF52FCC9B03764B69F.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF54C944FCEC3FC803.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF56E8E580AA261E46.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF5C777049F23D70D6.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF5F93A0540F4E0B6D.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF61DC23950D502F9B.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF6286DD33C3C8AD7C.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF62F6473CE7295947.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF65184EFA38AEF788.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF6709A1BE48E59A93.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF6A4DDB1220835018.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF6A54F429F951D9F3.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF6E4556A9ADD3A7F6.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF7034F47D289CA572.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF710864A860A24BCC.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF752FDF7B9314D421.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF7670991B9AF03039.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF7B1D80549468DB03.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF7CD339B34820713E.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF8334C9D363BD370C.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF83623CF44E0E6EAD.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF843D36BB7EC90209.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF8BD2376B97B3EDD3.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF8CF7E2F51EA4149E.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF8ECA09A90F715576.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF94A21BD52A9BA4C4.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DF94F6DFF7EEE1A4B7.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFBB5EC44EC2C22916.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFBBEAB63B5C673FFA.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFD390FF799815E465.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFE82545E35518C3AB.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFEE5811076313ACF7.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFF86020C0AF2637C2.TMP"
File:"No admin in ACL","C:\Users\sunias\AppData\Local\Temp\~DFFDFEE34E62518D35.TMP"
File:"No admin in ACL","C:\ProgramData\Microsoft\Office\DATA"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Logs\tvDebug.log"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Logs\ZALog.txt"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\BACKUP.NDB"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\IAMDB.NDB"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\SUNIAS-PC.ldb"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB10E1.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB1371.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB319A.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB339E.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB4826.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB5791.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB57CF.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6279.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB65D4.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6759.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6A76.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6B01.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6B02.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6C58.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6C69.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6CB7.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB6E2C.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7001.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB70EA.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7177.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7232.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7270.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB732C.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB73C9.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB74B2.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7510.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB75CB.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7628.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB777F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB782C.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB785A.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB78F6.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7992.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB79A1.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7A2F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7AFA.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7CEC.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7DF5.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7EB0.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7EDF.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB7F3E.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8094.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8121.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB814F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB815F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB818D.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8278.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB82E6.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB82F4.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB83EE.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB845B.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8535.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8601.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB865E.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8786.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8803.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB88AF.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB89A8.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB89A9.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB89D8.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8AFF.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8BAC.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8D22.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB8DBE.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB953C.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB958A.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9694.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB96B3.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB96C2.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9962.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB99DE.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9BA2.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9C0F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9DA6.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9E51.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDB9E80.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA005.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA053.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA17C.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA227.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA380.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA5A1.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA6B9.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBA7A4.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBAA52.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBACE1.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBADAD.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBAE0A.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBB385.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBDF65.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE0DC.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE12A.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE2B1.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE4A3.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE6F4.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE703.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE742.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBE9F0.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBEACC.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBEBC5.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBEDC7.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBF075.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBF18F.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBF6BC.tmp"
File:"No admin in ACL","C:\ProgramData\CheckPoint\ZoneAlarm\Data\xDBF98B.tmp"
Vielen Dank im Voraus für die Hilfe! |
|
14.02.2015, 11:40
| #5 |
| /// the machine /// TB-Ausbilder | Spysoftware auf PC? Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Spysoftware auf PC? |
| anhang, ansehen, befürchtung, gescannt, gmer, hoffe, installier, installiert, kopieren, logfile, spionagesoftware, verdächtiges, wissen, ähnlich |
dann auf 
und dann auf 
. 
Linear-Darstellung
