| |
| |||||||
Log-Analyse und Auswertung: Langsames Laptop-Trojaner von Avira gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
16.04.2015, 21:42
| #1 |
| |  Langsames Laptop-Trojaner von Avira gefunden Hallo, ich bin unbedarfte Nutzerin meines Laptops, das jetzt ein Jahr alt ist. Durch mein GIS-Studium wurde ich mehrfach angehalten freie Software und Tools zu nutzen und dazu eben zu installieren. WO und Wann ich mir das alles eingefangen habe, kann ich nicht sagen. Zunächst ist der Rechner beim Hochfahren und Öffnen von Programmen immer langsamer geworden, aber es ging. Dann habe ich bei Adobe Reader bemerkt, das der Rahmen des Fensters nicht richtig dargestellt wird. Nun kam hinzu, dass das Fenster für einen sicheren Zahlungsverkehr immer flackerte und nicht richtig zu sehen war. Daraufhin habe ich es nicht mehr benutzt. Kaspersky habe ich beim Neukauf des Rechners mit gekauft und regelmäßig ein Update gemacht. Sämtliche Prüfungen waren ergebnislos bis auf gestern. Da hatte ich das erste Mal eine Warnung. Die aber behoben werden konnte. Heute habe ich AVIRA kostenfrei runtergeladen und nach fast 9 h folgende LOG Datei erhalten. (im Anhang) Nun weiß ich nicht damit umzugehen. Ich hoffe mir kann jemand helfen, so dass ich es verstehe. Danke schon mal im voraus. doreagr |
|
16.04.2015, 21:45
| #2 |
| /// the machine /// TB-Ausbilder    | Langsames Laptop-Trojaner von Avira gefunden Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
17.04.2015, 07:00
| #3 |
| | Langsames Laptop-Trojaner von AVIRA gefundenCode:
ATTFilter
Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 16. April 2015 12:22
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : DOREENAGRICOLA
Versionsinformationen:
BUILD.DAT : 15.0.9.504 94784 Bytes 24.03.2015 14:59:00
AVSCAN.EXE : 15.0.9.504 1027528 Bytes 24.03.2015 12:59:28
AVSCANRC.DLL : 15.0.9.460 64760 Bytes 24.03.2015 12:59:28
LUKE.DLL : 15.0.9.460 60664 Bytes 24.03.2015 12:59:30
AVSCPLR.DLL : 15.0.9.460 95536 Bytes 24.03.2015 12:59:28
REPAIR.DLL : 15.0.9.504 374064 Bytes 24.03.2015 12:59:28
REPAIR.RDF : 1.0.7.16 834076 Bytes 16.04.2015 10:08:55
AVREG.DLL : 15.0.9.460 273712 Bytes 24.03.2015 12:59:28
AVLODE.DLL : 15.0.9.504 596272 Bytes 24.03.2015 12:59:26
AVLODE.RDF : 14.0.4.64 79226 Bytes 16.04.2015 10:08:22
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 12:59:31
XBV00208.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:46
XBV00209.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00210.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00211.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00212.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00213.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00214.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:47
XBV00215.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00216.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00217.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00218.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00219.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00220.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00221.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00222.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00223.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00224.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:48
XBV00225.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00226.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00227.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00228.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00229.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00230.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00231.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00232.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00233.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00234.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00235.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00236.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00237.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:49
XBV00238.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00239.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00240.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00241.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00242.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00243.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00244.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00245.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00246.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00247.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00248.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00249.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00250.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00251.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00252.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00253.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00254.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00255.VDF : 8.11.219.166 2048 Bytes 25.03.2015 10:08:50
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 12:59:31
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 12:59:31
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 12:59:31
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 12:59:31
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 12:59:31
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 12:59:31
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 12:59:31
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 12:59:31
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 12:59:31
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 12:59:31
XBV00010.VDF : 8.11.178.32 1581056 Bytes 14.10.2014 12:59:31
XBV00011.VDF : 8.11.184.50 2178560 Bytes 11.11.2014 12:59:31
XBV00012.VDF : 8.11.190.32 1876992 Bytes 03.12.2014 12:59:31
XBV00013.VDF : 8.11.201.28 2973696 Bytes 14.01.2015 12:59:31
XBV00014.VDF : 8.11.206.252 2695680 Bytes 04.02.2015 12:59:31
XBV00015.VDF : 8.11.213.84 3175936 Bytes 03.03.2015 12:59:31
XBV00016.VDF : 8.11.213.176 212480 Bytes 05.03.2015 12:59:31
XBV00017.VDF : 8.11.219.166 2033664 Bytes 25.03.2015 10:08:23
XBV00042.VDF : 8.11.219.194 36864 Bytes 25.03.2015 10:08:23
XBV00043.VDF : 8.11.219.218 7168 Bytes 25.03.2015 10:08:24
XBV00044.VDF : 8.11.219.242 6144 Bytes 25.03.2015 10:08:24
XBV00045.VDF : 8.11.219.244 7680 Bytes 25.03.2015 10:08:25
XBV00046.VDF : 8.11.219.246 5632 Bytes 26.03.2015 10:08:27
XBV00047.VDF : 8.11.219.250 38400 Bytes 26.03.2015 10:08:27
XBV00048.VDF : 8.11.219.252 14336 Bytes 26.03.2015 10:08:28
XBV00049.VDF : 8.11.219.254 18432 Bytes 26.03.2015 10:08:28
XBV00050.VDF : 8.11.220.0 7680 Bytes 26.03.2015 10:08:28
XBV00051.VDF : 8.11.220.2 10240 Bytes 26.03.2015 10:08:28
XBV00052.VDF : 8.11.220.6 2048 Bytes 26.03.2015 10:08:28
XBV00053.VDF : 8.11.220.8 2560 Bytes 26.03.2015 10:08:29
XBV00054.VDF : 8.11.220.10 17408 Bytes 26.03.2015 10:08:29
XBV00055.VDF : 8.11.220.12 2048 Bytes 26.03.2015 10:08:29
XBV00056.VDF : 8.11.220.16 23040 Bytes 26.03.2015 10:08:29
XBV00057.VDF : 8.11.220.18 8704 Bytes 26.03.2015 10:08:30
XBV00058.VDF : 8.11.220.22 30720 Bytes 27.03.2015 10:08:30
XBV00059.VDF : 8.11.220.24 6144 Bytes 27.03.2015 10:08:30
XBV00060.VDF : 8.11.220.26 2048 Bytes 27.03.2015 10:08:30
XBV00061.VDF : 8.11.220.48 9728 Bytes 27.03.2015 10:08:30
XBV00062.VDF : 8.11.220.68 14848 Bytes 27.03.2015 10:08:30
XBV00063.VDF : 8.11.220.88 23552 Bytes 27.03.2015 10:08:30
XBV00064.VDF : 8.11.220.108 9216 Bytes 27.03.2015 10:08:30
XBV00065.VDF : 8.11.220.110 15360 Bytes 27.03.2015 10:08:30
XBV00066.VDF : 8.11.220.116 27648 Bytes 27.03.2015 10:08:30
XBV00067.VDF : 8.11.220.118 10752 Bytes 27.03.2015 10:08:30
XBV00068.VDF : 8.11.220.120 6144 Bytes 27.03.2015 10:08:30
XBV00069.VDF : 8.11.220.122 62976 Bytes 28.03.2015 10:08:31
XBV00070.VDF : 8.11.220.124 2048 Bytes 28.03.2015 10:08:31
XBV00071.VDF : 8.11.220.126 9728 Bytes 28.03.2015 10:08:31
XBV00072.VDF : 8.11.220.128 20992 Bytes 28.03.2015 10:08:31
XBV00073.VDF : 8.11.220.148 54784 Bytes 29.03.2015 10:08:31
XBV00074.VDF : 8.11.220.176 7680 Bytes 29.03.2015 10:08:31
XBV00075.VDF : 8.11.220.196 32768 Bytes 30.03.2015 10:08:31
XBV00076.VDF : 8.11.220.216 2048 Bytes 30.03.2015 10:08:31
XBV00077.VDF : 8.11.220.236 9728 Bytes 30.03.2015 10:08:32
XBV00078.VDF : 8.11.220.238 15360 Bytes 30.03.2015 10:08:32
XBV00079.VDF : 8.11.220.240 9216 Bytes 30.03.2015 10:08:32
XBV00080.VDF : 8.11.220.242 4608 Bytes 30.03.2015 10:08:32
XBV00081.VDF : 8.11.220.248 58368 Bytes 30.03.2015 10:08:32
XBV00082.VDF : 8.11.220.250 2048 Bytes 30.03.2015 10:08:32
XBV00083.VDF : 8.11.220.252 2048 Bytes 30.03.2015 10:08:32
XBV00084.VDF : 8.11.220.254 39424 Bytes 31.03.2015 10:08:32
XBV00085.VDF : 8.11.221.0 2048 Bytes 31.03.2015 10:08:32
XBV00086.VDF : 8.11.221.6 40960 Bytes 31.03.2015 10:08:33
XBV00087.VDF : 8.11.221.8 2048 Bytes 31.03.2015 10:08:33
XBV00088.VDF : 8.11.221.10 16896 Bytes 31.03.2015 10:08:33
XBV00089.VDF : 8.11.221.30 10240 Bytes 31.03.2015 10:08:33
XBV00090.VDF : 8.11.221.48 29184 Bytes 31.03.2015 10:08:33
XBV00091.VDF : 8.11.221.50 2048 Bytes 31.03.2015 10:08:33
XBV00092.VDF : 8.11.221.70 27648 Bytes 31.03.2015 10:08:34
XBV00093.VDF : 8.11.221.88 3584 Bytes 31.03.2015 10:08:35
XBV00094.VDF : 8.11.221.90 32256 Bytes 31.03.2015 10:08:35
XBV00095.VDF : 8.11.221.94 34816 Bytes 01.04.2015 10:08:36
XBV00096.VDF : 8.11.221.96 8704 Bytes 01.04.2015 10:08:36
XBV00097.VDF : 8.11.221.100 8704 Bytes 01.04.2015 10:08:36
XBV00098.VDF : 8.11.221.102 7680 Bytes 01.04.2015 10:08:36
XBV00099.VDF : 8.11.221.106 39936 Bytes 01.04.2015 10:08:36
XBV00100.VDF : 8.11.221.124 8704 Bytes 01.04.2015 10:08:37
XBV00101.VDF : 8.11.221.142 12288 Bytes 01.04.2015 10:08:37
XBV00102.VDF : 8.11.221.160 7168 Bytes 01.04.2015 10:08:37
XBV00103.VDF : 8.11.221.178 7168 Bytes 01.04.2015 10:08:37
XBV00104.VDF : 8.11.221.196 8192 Bytes 01.04.2015 10:08:37
XBV00105.VDF : 8.11.221.200 33280 Bytes 02.04.2015 10:08:38
XBV00106.VDF : 8.11.221.202 2048 Bytes 02.04.2015 10:08:38
XBV00107.VDF : 8.11.221.204 28160 Bytes 02.04.2015 10:08:38
XBV00108.VDF : 8.11.221.206 2048 Bytes 02.04.2015 10:08:38
XBV00109.VDF : 8.11.221.208 33792 Bytes 02.04.2015 10:08:39
XBV00110.VDF : 8.11.221.210 24576 Bytes 02.04.2015 10:08:39
XBV00111.VDF : 8.11.221.214 18944 Bytes 02.04.2015 10:08:39
XBV00112.VDF : 8.11.221.216 11264 Bytes 02.04.2015 10:08:40
XBV00113.VDF : 8.11.221.220 29696 Bytes 03.04.2015 10:08:40
XBV00114.VDF : 8.11.221.222 2048 Bytes 03.04.2015 10:08:40
XBV00115.VDF : 8.11.221.224 31232 Bytes 03.04.2015 10:08:40
XBV00116.VDF : 8.11.221.242 3584 Bytes 03.04.2015 10:08:40
XBV00117.VDF : 8.11.222.2 11776 Bytes 03.04.2015 10:08:40
XBV00118.VDF : 8.11.222.18 7168 Bytes 03.04.2015 10:08:40
XBV00119.VDF : 8.11.222.34 6656 Bytes 03.04.2015 10:08:40
XBV00120.VDF : 8.11.222.38 15360 Bytes 03.04.2015 10:08:40
XBV00121.VDF : 8.11.222.40 5632 Bytes 03.04.2015 10:08:40
XBV00122.VDF : 8.11.222.42 6144 Bytes 03.04.2015 10:08:40
XBV00123.VDF : 8.11.222.44 46592 Bytes 04.04.2015 10:08:40
XBV00124.VDF : 8.11.222.46 2048 Bytes 04.04.2015 10:08:40
XBV00125.VDF : 8.11.222.48 2048 Bytes 04.04.2015 10:08:40
XBV00126.VDF : 8.11.222.50 36864 Bytes 04.04.2015 10:08:40
XBV00127.VDF : 8.11.222.52 2048 Bytes 04.04.2015 10:08:40
XBV00128.VDF : 8.11.222.68 68096 Bytes 05.04.2015 10:08:41
XBV00129.VDF : 8.11.222.84 2048 Bytes 05.04.2015 10:08:41
XBV00130.VDF : 8.11.222.116 18432 Bytes 05.04.2015 10:08:41
XBV00131.VDF : 8.11.222.132 62464 Bytes 06.04.2015 10:08:41
XBV00132.VDF : 8.11.222.134 10752 Bytes 06.04.2015 10:08:41
XBV00133.VDF : 8.11.222.138 2048 Bytes 06.04.2015 10:08:41
XBV00134.VDF : 8.11.222.154 13312 Bytes 06.04.2015 10:08:41
XBV00135.VDF : 8.11.222.156 8704 Bytes 06.04.2015 10:08:42
XBV00136.VDF : 8.11.222.158 9216 Bytes 06.04.2015 10:08:42
XBV00137.VDF : 8.11.222.160 2048 Bytes 06.04.2015 10:08:42
XBV00138.VDF : 8.11.222.164 18432 Bytes 06.04.2015 10:08:42
XBV00139.VDF : 8.11.222.166 10752 Bytes 06.04.2015 10:08:42
XBV00140.VDF : 8.11.222.182 7168 Bytes 06.04.2015 10:08:42
XBV00141.VDF : 8.11.222.196 8704 Bytes 07.04.2015 10:08:43
XBV00142.VDF : 8.11.222.212 29696 Bytes 07.04.2015 10:08:43
XBV00143.VDF : 8.11.222.226 6656 Bytes 07.04.2015 10:08:43
XBV00144.VDF : 8.11.222.228 10752 Bytes 07.04.2015 10:08:43
XBV00145.VDF : 8.11.222.230 4096 Bytes 07.04.2015 10:08:43
XBV00146.VDF : 8.11.222.232 5120 Bytes 07.04.2015 10:08:43
XBV00147.VDF : 8.11.222.234 5632 Bytes 07.04.2015 10:08:43
XBV00148.VDF : 8.11.222.240 34816 Bytes 07.04.2015 10:08:43
XBV00149.VDF : 8.11.222.242 2048 Bytes 07.04.2015 10:08:43
XBV00150.VDF : 8.11.222.244 3584 Bytes 07.04.2015 10:08:43
XBV00151.VDF : 8.11.222.246 24576 Bytes 07.04.2015 10:08:43
XBV00152.VDF : 8.11.222.250 37888 Bytes 08.04.2015 10:08:43
XBV00153.VDF : 8.11.223.8 12800 Bytes 08.04.2015 10:08:43
XBV00154.VDF : 8.11.223.22 2048 Bytes 08.04.2015 10:08:43
XBV00155.VDF : 8.11.223.36 10752 Bytes 08.04.2015 10:08:43
XBV00156.VDF : 8.11.223.52 35328 Bytes 08.04.2015 10:08:44
XBV00157.VDF : 8.11.223.66 7168 Bytes 08.04.2015 10:08:44
XBV00158.VDF : 8.11.223.68 2048 Bytes 08.04.2015 10:08:44
XBV00159.VDF : 8.11.223.72 15360 Bytes 08.04.2015 10:08:44
XBV00160.VDF : 8.11.223.74 7168 Bytes 09.04.2015 10:08:44
XBV00161.VDF : 8.11.223.78 38400 Bytes 09.04.2015 10:08:44
XBV00162.VDF : 8.11.223.80 2048 Bytes 09.04.2015 10:08:44
XBV00163.VDF : 8.11.223.82 35328 Bytes 09.04.2015 10:08:44
XBV00164.VDF : 8.11.223.90 80896 Bytes 09.04.2015 10:08:44
XBV00165.VDF : 8.11.223.92 2048 Bytes 09.04.2015 10:08:44
XBV00166.VDF : 8.11.223.94 30208 Bytes 09.04.2015 10:08:44
XBV00167.VDF : 8.11.223.108 30208 Bytes 10.04.2015 10:08:44
XBV00168.VDF : 8.11.223.120 35840 Bytes 10.04.2015 10:08:44
XBV00169.VDF : 8.11.223.124 3072 Bytes 10.04.2015 10:08:44
XBV00170.VDF : 8.11.223.136 20480 Bytes 10.04.2015 10:08:44
XBV00171.VDF : 8.11.223.148 14848 Bytes 10.04.2015 10:08:44
XBV00172.VDF : 8.11.223.150 2048 Bytes 10.04.2015 10:08:44
XBV00173.VDF : 8.11.223.154 23552 Bytes 10.04.2015 10:08:44
XBV00174.VDF : 8.11.223.156 8192 Bytes 10.04.2015 10:08:44
XBV00175.VDF : 8.11.223.158 7680 Bytes 11.04.2015 10:08:44
XBV00176.VDF : 8.11.223.162 49152 Bytes 11.04.2015 10:08:45
XBV00177.VDF : 8.11.223.164 2048 Bytes 11.04.2015 10:08:45
XBV00178.VDF : 8.11.223.176 18944 Bytes 11.04.2015 10:08:45
XBV00179.VDF : 8.11.223.192 68096 Bytes 12.04.2015 10:08:45
XBV00180.VDF : 8.11.223.194 2048 Bytes 12.04.2015 10:08:45
XBV00181.VDF : 8.11.223.196 2048 Bytes 12.04.2015 10:08:45
XBV00182.VDF : 8.11.223.208 13312 Bytes 12.04.2015 10:08:45
XBV00183.VDF : 8.11.223.210 6144 Bytes 12.04.2015 10:08:45
XBV00184.VDF : 8.11.223.222 75776 Bytes 13.04.2015 10:08:45
XBV00185.VDF : 8.11.223.224 2048 Bytes 13.04.2015 10:08:45
XBV00186.VDF : 8.11.223.236 27648 Bytes 13.04.2015 10:08:45
XBV00187.VDF : 8.11.223.246 2048 Bytes 13.04.2015 10:08:45
XBV00188.VDF : 8.11.224.2 9728 Bytes 13.04.2015 10:08:45
XBV00189.VDF : 8.11.224.12 33792 Bytes 13.04.2015 10:08:45
XBV00190.VDF : 8.11.224.22 40448 Bytes 14.04.2015 10:08:45
XBV00191.VDF : 8.11.224.28 26112 Bytes 14.04.2015 10:08:45
XBV00192.VDF : 8.11.224.32 49152 Bytes 14.04.2015 10:08:45
XBV00193.VDF : 8.11.224.34 12288 Bytes 14.04.2015 10:08:46
XBV00194.VDF : 8.11.224.36 8704 Bytes 14.04.2015 10:08:46
XBV00195.VDF : 8.11.224.46 6656 Bytes 14.04.2015 10:08:46
XBV00196.VDF : 8.11.224.48 2048 Bytes 14.04.2015 10:08:46
XBV00197.VDF : 8.11.224.58 12288 Bytes 15.04.2015 10:08:46
XBV00198.VDF : 8.11.224.68 5632 Bytes 15.04.2015 10:08:46
XBV00199.VDF : 8.11.224.72 29184 Bytes 15.04.2015 10:08:46
XBV00200.VDF : 8.11.224.82 17920 Bytes 15.04.2015 10:08:46
XBV00201.VDF : 8.11.224.84 29184 Bytes 15.04.2015 10:08:46
XBV00202.VDF : 8.11.224.90 29184 Bytes 15.04.2015 10:08:46
XBV00203.VDF : 8.11.224.92 18432 Bytes 15.04.2015 10:08:46
XBV00204.VDF : 8.11.224.102 13824 Bytes 15.04.2015 10:08:46
XBV00205.VDF : 8.11.224.112 18944 Bytes 15.04.2015 10:08:46
XBV00206.VDF : 8.11.224.120 6144 Bytes 15.04.2015 10:08:46
XBV00207.VDF : 8.11.224.130 38400 Bytes 16.04.2015 10:08:46
LOCAL000.VDF : 8.11.224.130 127554048 Bytes 16.04.2015 10:09:36
Engineversion : 8.3.30.16
AEVDF.DLL : 8.3.1.6 133992 Bytes 24.03.2015 12:59:23
AESCRIPT.DLL : 8.2.2.58 560248 Bytes 24.03.2015 12:59:23
AESCN.DLL : 8.3.2.2 139456 Bytes 24.03.2015 12:59:23
AESBX.DLL : 8.2.20.34 1615784 Bytes 24.03.2015 12:59:23
AERDL.DLL : 8.2.1.20 731040 Bytes 24.03.2015 12:59:23
AEPACK.DLL : 8.4.0.62 793456 Bytes 24.03.2015 12:59:23
AEOFFICE.DLL : 8.3.1.16 359280 Bytes 16.04.2015 10:08:21
AEMOBILE.DLL : 8.1.7.0 281456 Bytes 24.03.2015 12:59:23
AEHEUR.DLL : 8.1.4.1634 8259496 Bytes 16.04.2015 10:08:20
AEHELP.DLL : 8.3.2.0 281456 Bytes 24.03.2015 12:59:23
AEGEN.DLL : 8.1.7.40 456608 Bytes 24.03.2015 12:59:23
AEEXP.DLL : 8.4.2.82 260968 Bytes 16.04.2015 10:08:21
AEEMU.DLL : 8.1.3.4 399264 Bytes 24.03.2015 12:59:23
AEDROID.DLL : 8.4.3.116 1050536 Bytes 24.03.2015 12:59:23
AECORE.DLL : 8.3.4.0 243624 Bytes 24.03.2015 12:59:23
AEBB.DLL : 8.1.2.0 60448 Bytes 24.03.2015 12:59:23
AVWINLL.DLL : 15.0.9.460 26872 Bytes 24.03.2015 12:59:29
AVPREF.DLL : 15.0.9.460 52984 Bytes 24.03.2015 12:59:28
AVREP.DLL : 15.0.9.460 220464 Bytes 24.03.2015 12:59:28
AVARKT.DLL : 15.0.9.460 228088 Bytes 24.03.2015 12:59:24
AVEVTLOG.DLL : 15.0.9.460 193328 Bytes 24.03.2015 12:59:25
SQLITE3.DLL : 15.0.9.460 455472 Bytes 24.03.2015 12:59:31
AVSMTP.DLL : 15.0.9.460 79096 Bytes 24.03.2015 12:59:28
NETNT.DLL : 15.0.9.460 15152 Bytes 24.03.2015 12:59:30
CommonImageRc.dll: 15.0.9.460 4355376 Bytes 24.03.2015 12:59:30
CommonTextRc.DLL: 15.0.9.476 70960 Bytes 24.03.2015 12:59:30
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\Antivirus\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 16. April 2015 12:22
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:, E:)'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf nach versteckten Objekten wird begonnen.
Eine Instanz der ARK Library läuft bereits.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'DpHostW.exe' - '147' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV64.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'DPCardEngine.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Hpservice.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'vcsFPService.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'BlueSoleilCS.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'SkypeC2CAutoUpdateSvc.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'SkypeC2CPNRSvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'OfficeClickToRun.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '178' Modul(e) wurden durchsucht
Durchsuche Prozess 'CreoSvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'CtService.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lyricsgizm.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSMonitorServicePDVD12.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSServerPDVD12.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'wrapper.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'java.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPFSService.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPHotkeyMonitor.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'hydrup.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'HeciServer.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdfsvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'ss_conn_service.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '140' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmi64.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqwmiex.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'BsHelpCS.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'OSPPSVC.EXE' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'lyricsgizm.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '130' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '4250' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Windows>
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$R9WT274.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/InstallCore.OR.1
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RCYOOJ3.exe
[0] Archivtyp: ZIP SFX (self extracting)
--> Setup.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6831
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RM9JJCH.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RRBJONL.exe
[FUND] Enthält Muster der Software PUA/InstallCore.Gen7
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RS1NL5C.exe
[FUND] Enthält Muster der Software PUA/SeaSuite.Gen
C:\ProgramData\lyricsgizm\wlyricsgizmd.exe
[FUND] Ist das Trojanische Pferd TR/Strictor.59716.8
C:\Users\DoreenAgricola\Downloads\iLividSetup-r887-n-bf.exe
[FUND] Enthält Muster der Software PUA/iLivid.iona
[0] Archivtyp: Runtime Packed
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_451_W81_DRV\amd64\WinUSBCoInstaller2.dll
[1] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_451_W81_DRV\x86\WinUSBCoInstaller2.dll
[2] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_471_W81_DRV\amd64\WinUSBCoInstaller2.dll
[3] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_471_W81_DRV\x86\WinUSBCoInstaller2.dll
[4] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_491_W81_DRV\amd64\WinUSBCoInstaller2.dll
[5] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_491_W81_DRV\x86\WinUSBCoInstaller2.dll
[6] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_495_W81_DRV\amd64\WinUSBCoInstaller2.dll
[7] Archivtyp: RSRC
--> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_495_W81_DRV\x86\WinUSBCoInstaller2.dll
[8] Archivtyp: RSRC
--> C:\Users\DoreenAgricola\Downloads\jxpiinstall.exe
[9] Archivtyp: Runtime Packed
--> C:\Users\DoreenAgricola\Downloads\PDF24 Creator - CHIP-Installer.exe
[10] Archivtyp: RSRC
--> C:\Users\DoreenAgricola\Downloads\PDF24 Creator - CHIP-Installer.exe
[11] Archivtyp: Runtime Packed
--> C:\Users\DoreenAgricola\Downloads\Samsung Kies - CHIP-Installer.exe
[12] Archivtyp: RSRC
--> C:\Users\DoreenAgricola\Downloads\Samsung Kies - CHIP-Installer.exe
[13] Archivtyp: Runtime Packed
--> C:\Windows\System32\WinUSBCoInstaller2.dll
[14] Archivtyp: RSRC
--> C:\Windows\System32\DriverStore\FileRepository\vfs451.inf_amd64_neutral_f09adf1ebd0a9344\amd64\WinUSBCoInstaller2.dll
[15] Archivtyp: RSRC
--> C:\Windows\System32\DriverStore\FileRepository\vfs471.inf_amd64_neutral_3c2b813b62272cc9\amd64\WinUSBCoInstaller2.dll
[16] Archivtyp: RSRC
--> C:\Windows\System32\DriverStore\FileRepository\vfs491.inf_amd64_neutral_88f7e00ca6db9fb9\amd64\WinUSBCoInstaller2.dll
[17] Archivtyp: RSRC
--> C:\Windows\System32\DriverStore\FileRepository\vfs495.inf_amd64_neutral_d0cde3cda2a4493b\amd64\WinUSBCoInstaller2.dll
[18] Archivtyp: RSRC
--> C:\Windows\Temp\bch7497.exe
[19] Archivtyp: Portable Executable Resource
--> id_201
[20] Archivtyp: ZIP
--> wlyricsgizmd.exe
[FUND] Ist das Trojanische Pferd TR/Strictor.59716.8
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\Windows\Temp\bch7497.exe
[FUND] Ist das Trojanische Pferd TR/Strictor.59716.8
C:\Windows\Temp\6b4a5932\SettingsManagerSetup.exe
[FUND] Enthält Muster der Software PUA/SeaSuite.Gen
Beginne mit der Suche in 'D:\' <HP_RECOVERY>
Beginne mit der Suche in 'E:\' <HP_TOOLS>
Beginne mit der Desinfektion:
[ERROR] RepairMalware: Not able to Repair Malware PUA/SeaSuite.Gen
[ERROR] RepairMalware: Not able to Repair Malware PUA/SeaSuite.Gen
C:\Windows\Temp\6b4a5932\SettingsManagerSetup.exe
[FUND] Enthält Muster der Software PUA/SeaSuite.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '504db9bb.qua' verschoben!
C:\Windows\Temp\bch7497.exe
[FUND] Ist das Trojanische Pferd TR/Strictor.59716.8
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48e6961b.qua' verschoben!
C:\Users\DoreenAgricola\Downloads\iLividSetup-r887-n-bf.exe
[FUND] Enthält Muster der Software PUA/iLivid.iona
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ab8c301.qua' verschoben!
C:\ProgramData\lyricsgizm\wlyricsgizmd.exe
[FUND] Ist das Trojanische Pferd TR/Strictor.59716.8
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7cbf8ce3.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RS1NL5C.exe
[FUND] Enthält Muster der Software PUA/SeaSuite.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3911a1e4.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RRBJONL.exe
[FUND] Enthält Muster der Software PUA/InstallCore.Gen7
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '460b9388.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RM9JJCH.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0a4cbff5.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RCYOOJ3.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6831
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '765affb8.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$R9WT274.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/InstallCore.OR.1
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5b1ad081.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 16. April 2015 22:13
Benötigte Zeit: 9:47:06 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
40869 Verzeichnisse wurden überprüft
3092124 Dateien wurden geprüft
10 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
9 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
3092114 Dateien ohne Befall
20317 Archive wurden durchsucht
2 Warnungen
9 Hinweise
Sorry. Doreagr |
|
17.04.2015, 19:40
| #4 |
| /// the machine /// TB-Ausbilder | Langsames Laptop-Trojaner von Avira gefunden FRST fehlt noch 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.04.2015, 11:21
| #5 |
| | Langsames Laptop-Trojaner von Avira gefunden Sorry, das ich das mit dem frst nicht gesehen habe. Hier die gewünschten zwei Dateien nach dem Scan. Gruß DoreAg Hier der FRST.txt: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2015
Ran by
Doreen Agricola (administrator) on DOREENAGRICOLA on 19-04-2015 12:08:24
Running from C:\Users\DoreenAgricola\Downloads
Loaded Profiles: Doreen Agricola (Available profiles: Doreen Agricola & Test & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CryptoMill Technologies Ltd.) C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
(Print Test Agent) C:\ProgramData\lyricsgizm\lyricsgizm.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Tanuki Software, Ltd.) C:\Program Files (x86)\GeoServer 2.6.2\wrapper.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Software) C:\Program Files (x86)\Common Files\Hydrup\hydrup.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_31\bin\java.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Print Test Agent) C:\ProgramData\lyricsgizm\lyricsgizm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [726320 2015-03-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\RunOnce: [Uninstall C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\RunOnce: [Uninstall C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MountPoints2: H - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MountPoints2: {91f97b4b-9db3-11e3-b44a-806e6f6e6963} - F:\wubi.exe
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
URLSearchHook: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKLM -> {A33DB9FD-7A8A-496E-92D3-9CFCF9D9E1C9} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> DefaultScope {F7C78C08-3CC7-416F-B827-7C1785ABBDA8} URL = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {1B0AEC5F-9979-4A64-8A2F-8014547A8D26} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {A33DB9FD-7A8A-496E-92D3-9CFCF9D9E1C9} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {F7C78C08-3CC7-416F-B827-7C1785ABBDA8} URL = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-10] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-10] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-05-21] (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: HP File Sanitizer -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2013-08-07] (Hewlett-Packard)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-29] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-29] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: No Name -> {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} -> C:\Users\Doreen Agricola\AppData\LocalLow\systems ie bho\bho.dll No File
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-05-21] (Hewlett-Packard Co.)
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default
FF DefaultSearchEngine: SearchTheWeb
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-16] ()
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-10] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-07-26] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-07-26] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-05-07] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\ChromeExt\components\npChromeDPAgent.dll [2013-08-06] (DigitalPersona, Inc.)
FF user.js: detected! => C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\user.js [2015-04-16]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\cgpcfg.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxmui.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icafile.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icalogon.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2012-03-28] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\sslsdk_b.dll [2012-03-19] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [2012-03-28] (Citrix Systems, Inc.)
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\default-search.xml [2014-05-12]
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\google-images.xml [2015-02-17]
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\google-maps.xml [2015-02-17]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\default-search.xml [2014-05-12]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\SearchTheWeb.xml [2014-05-06]
FF Extension: Segurança do navegador Avira - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\abs@avira.com [2015-04-16]
FF Extension: Linkey for Firefox - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\extension@linkeyproject.com [2014-05-12]
FF Extension: Foxy Security - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\sys@foxysecurity.com [2014-05-12]
FF Extension: Garmin Communicator - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-02-19]
FF Extension: SQLite Manager - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2014-07-29]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2014-02-25]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-20]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-09-02]
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Doreen Agricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [igdhbblpcellaljokkpfhcjlagemhgjl] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\ChromeExt\dpchrome.crx [2013-08-06]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [815920 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1004280 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 BlueSoleilCS; c:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1706744 2013-11-02] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-11-02] (IVT Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 CreoService; C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [1366488 2013-08-23] (CryptoMill Technologies Ltd.)
R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2013-08-08] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-07-15] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [294664 2013-07-15] (CyberLink)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2013-08-06] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [558392 2013-08-07] (Hewlett-Packard Company)
R2 GeoServer 2.6.2; C:\Program Files (x86)\GeoServer 2.6.2\wrapper.exe [241664 2013-09-18] (Tanuki Software, Ltd.) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [681760 2013-08-01] (Hewlett-Packard Company)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 Hydrup; C:\Program Files (x86)\Common Files\Hydrup\hydrup.exe [266536 2015-03-30] (Software)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-07-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-07-26] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-07-26] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1143432 2013-07-18] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [337920 2013-07-04] (IDT, Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [35936 2013-04-10] (Advanced Micro Devices, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-24] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [32992 2013-10-09] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [69344 2013-08-23] (IVT Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [54752 2013-08-23] (IVT Corporation)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [90608 2011-12-27] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-06-13] (Hewlett-Packard Company)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-07-30] (Intel Corporation)
R3 IceKore; C:\Windows\System32\DRIVERS\IceKore.sys [397784 2013-08-19] (CryptoMill Technologies Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 m76usb; C:\Windows\System32\DRIVERS\m76usb.sys [537800 2013-11-05] (Ralink Technology Corp.)
R3 MEIx64; C:\Windows\system32\drivers\TeeDriverx64.sys [99288 2013-07-26] (Intel Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2013-07-16] (WinMagic Inc.)
S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [418520 2013-06-17] (Realsil Semiconductor Corporation)
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2013-07-16] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2013-07-16] (WinMagic Inc.)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-20] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [34544 2013-08-20] (Synaptics Incorporated)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1512952 2013-08-08] (Sunplus)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [32992 2013-10-09] (IVT Corporation)
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-19 12:08 - 2015-04-19 12:10 - 00040656 _____ () C:\Users\DoreenAgricola\Downloads\FRST.txt
2015-04-19 12:08 - 2015-04-19 12:08 - 00000000 ____D () C:\FRST
2015-04-19 12:07 - 2015-04-19 12:07 - 02098176 _____ (Farbar) C:\Users\DoreenAgricola\Downloads\FRST64.exe
2015-04-19 11:58 - 2015-04-19 11:59 - 00001078 _____ () C:\Windows\system32dbgraw.bmp
2015-04-16 12:09 - 2015-04-16 12:09 - 00003432 _____ () C:\Windows\System32\Tasks\Avira Browser Safety Updater Task
2015-04-16 12:07 - 2015-04-16 12:07 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Avira
2015-04-16 12:05 - 2015-03-24 14:59 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-16 12:02 - 2015-04-16 12:02 - 00001232 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-04-16 12:01 - 2015-04-16 12:09 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-16 12:01 - 2015-04-16 12:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-16 12:01 - 2015-04-16 12:05 - 00000000 ____D () C:\ProgramData\Avira
2015-04-16 12:01 - 2015-04-16 12:01 - 04625104 _____ (Avira Operations GmbH & Co. KG) C:\Users\DoreenAgricola\Downloads\avira_de_av_5904711050__ws.exe
2015-04-16 08:20 - 2015-04-16 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-04-16 07:45 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-16 07:45 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-16 07:45 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-16 07:45 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-16 07:45 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-16 07:45 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-16 07:45 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-16 07:45 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-16 07:45 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-16 07:45 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-16 07:45 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-16 07:45 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-16 07:45 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-16 07:45 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-16 07:45 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-16 07:45 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-16 07:45 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-16 07:45 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-16 07:45 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-16 07:45 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-16 07:45 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-16 07:45 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-16 07:45 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-16 07:45 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-16 07:45 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-16 07:45 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-16 07:45 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-16 07:45 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-16 07:45 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-16 07:45 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-16 07:44 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-16 07:44 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-16 07:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-16 07:44 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-16 07:44 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-16 07:44 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-16 07:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-16 07:44 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-16 07:44 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-16 07:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-16 07:44 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-16 07:44 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-16 07:44 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-16 07:44 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-16 07:44 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-16 07:44 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-16 07:44 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-16 07:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-16 07:44 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-16 07:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-16 07:44 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-16 07:44 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-16 07:44 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-16 07:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-16 07:44 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-16 07:44 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-16 07:44 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-16 07:44 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-16 07:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-16 07:44 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-16 07:44 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-16 07:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-16 07:44 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-16 07:44 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-16 07:44 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-16 07:44 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-16 07:44 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-16 07:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-16 07:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-16 07:44 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-16 07:44 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-16 07:44 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-16 07:44 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-16 07:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-16 07:44 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-16 07:44 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-16 07:44 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-16 07:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-16 07:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-16 07:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-16 07:44 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-16 07:44 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-16 07:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-16 07:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-16 07:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-16 07:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-16 07:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-16 07:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-16 07:44 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-16 07:44 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-16 07:44 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-16 07:44 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 09:28 - 2015-04-15 09:28 - 00001493 _____ () C:\Users\DoreenAgricola\AppData\Local\recently-used.xbel
2015-04-10 10:17 - 2015-04-10 10:17 - 00000000 ____D () C:\Windows\pss
2015-04-10 09:58 - 2015-04-10 09:58 - 00003150 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-10 09:49 - 2015-04-10 09:49 - 18240176 _____ (Adobe Systems Incorporated) C:\Users\DoreenAgricola\Downloads\install_flash_player.exe
2015-04-10 09:48 - 2015-04-10 09:48 - 00000000 ____D () C:\ProgramData\Sun
2015-04-10 09:47 - 2015-04-10 09:47 - 42925480 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-8u40-windows-x64.exe
2015-04-10 09:45 - 2015-04-10 09:45 - 29469096 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-7u75-windows-i586.exe
2015-04-10 09:44 - 2015-04-10 09:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-04-10 09:44 - 2015-04-10 09:47 - 00000000 ____D () C:\Program Files\Java
2015-04-10 09:44 - 2015-04-10 09:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-04-10 09:44 - 2015-04-10 09:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-04-10 09:43 - 2015-04-10 09:43 - 31036840 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-7u75-windows-x64.exe
2015-04-10 09:41 - 2015-04-10 09:41 - 17658544 _____ (Adobe Systems Incorporated) C:\Users\DoreenAgricola\Downloads\install_flash_player_ax.exe
2015-04-10 09:39 - 2015-04-10 09:40 - 28509232 _____ () C:\Users\DoreenAgricola\Downloads\vlc-2.2.0-win32.exe
2015-04-07 20:01 - 2015-04-07 20:01 - 00000000 ____D () C:\Users\DoreenAgricola\Desktop\Ablage
2015-04-03 22:13 - 2015-04-03 22:13 - 00000000 ____D () C:\Users\DoreenAgricola\rezepte_Kigeb
2015-04-02 13:51 - 2015-04-02 14:05 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\ICAClient
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\Citrix
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\ProgramData\Citrix
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\Program Files (x86)\Citrix
2015-03-26 12:32 - 2015-03-26 12:32 - 00664713 _____ () C:\Users\DoreenAgricola\Downloads\styler-1.7.3.zip
2015-03-25 13:16 - 2015-03-25 13:16 - 00000000 ____D () C:\Windows\SysWOW64\%Report%
2015-03-25 12:19 - 2015-03-25 12:19 - 01726876 _____ (www.minidvdsoft.com ) C:\Users\DoreenAgricola\Downloads\freedvd2iso.exe
2015-03-25 10:16 - 2015-03-25 10:16 - 00000000 ____D () C:\Users\DoreenAgricola\Bahncard
2015-03-24 15:08 - 2015-03-25 12:40 - 00000000 ____D () C:\UNIGIS_Proj
2015-03-24 11:45 - 2015-03-25 09:42 - 00000000 ____D () C:\Users\DoreenAgricola\Ausflug C+C
2015-03-23 17:14 - 2015-03-23 17:14 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GeoServer 2.6.2
2015-03-23 17:13 - 2015-03-23 17:14 - 00000000 ____D () C:\Program Files (x86)\GeoServer 2.6.2
2015-03-23 17:07 - 2015-03-23 17:08 - 61726186 _____ () C:\Users\DoreenAgricola\Downloads\geoserver-2.6.2.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-04-19 12:10 - 2014-05-12 12:50 - 00002032 _____ () C:\Windows\Tasks\lyricsgizm Runner.job
2015-04-19 12:09 - 2009-07-14 06:45 - 00026832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-19 12:09 - 2009-07-14 06:45 - 00026832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-19 12:06 - 2014-05-12 12:50 - 328404820 _____ () C:\Users\Doreen
2015-04-19 12:05 - 2014-05-05 08:33 - 01073867 _____ () C:\Windows\WindowsUpdate.log
2015-04-19 12:05 - 2014-02-25 01:45 - 00718214 _____ () C:\Windows\system32\perfh007.dat
2015-04-19 12:05 - 2014-02-25 01:45 - 00155208 _____ () C:\Windows\system32\perfc007.dat
2015-04-19 12:05 - 2009-07-14 07:13 - 01658622 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-19 12:03 - 2014-05-06 07:42 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-04-19 12:02 - 2014-05-05 08:37 - 00003994 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B6CB3B30-D1AE-4A15-97B7-6788AAE48997}
2015-04-19 12:00 - 2013-09-13 21:02 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-19 11:58 - 2014-05-22 11:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-19 11:58 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.log
2015-04-19 11:58 - 2013-11-02 01:08 - 00001036 _____ () C:\Windows\SysWOW64\bscs.ini
2015-04-19 11:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-19 11:58 - 2009-07-14 06:51 - 00084552 _____ () C:\Windows\setupact.log
2015-04-17 12:43 - 2014-05-22 11:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-17 12:10 - 2014-05-12 12:10 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Skype
2015-04-17 11:58 - 2014-05-20 07:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-17 07:37 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.001
2015-04-16 23:05 - 2011-02-11 15:51 - 01633086 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-16 23:00 - 2014-05-16 13:55 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-16 22:49 - 2014-05-16 13:55 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-16 22:14 - 2014-05-05 08:36 - 00000000 ____D () C:\Users\DoreenAgricola
2015-04-16 22:12 - 2014-05-12 12:50 - 00000000 ____D () C:\ProgramData\lyricsgizm
2015-04-16 21:55 - 2014-12-10 12:29 - 00000000 ____D () C:\fotobuch2014
2015-04-16 21:55 - 2014-07-29 14:59 - 00132187 ____H () C:\treeinfo.wc
2015-04-16 12:18 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.002
2015-04-16 12:18 - 2010-11-21 05:47 - 00382970 _____ () C:\Windows\PFRO.log
2015-04-16 12:01 - 2013-09-13 20:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-16 09:58 - 2014-05-20 07:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-16 09:58 - 2013-09-13 21:02 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-16 09:58 - 2013-09-13 21:02 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-16 08:32 - 2014-05-07 09:59 - 00002380 _____ () C:\Users\DoreenAgricola\Desktop\Outlook 2013.lnk
2015-04-16 08:02 - 2015-02-19 09:34 - 00002393 _____ () C:\Users\Test\Desktop\Sicherer Zahlungsverkehr.lnk
2015-04-16 08:02 - 2015-02-19 09:34 - 00001434 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:02 - 2015-02-19 09:33 - 00002145 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2015-02-18 13:37 - 00001036 _____ () C:\Users\Gast\Desktop\Notepad++.lnk
2015-04-16 08:02 - 2015-02-03 09:03 - 00002393 _____ () C:\Users\Gast\Desktop\Sicherer Zahlungsverkehr.lnk
2015-04-16 08:02 - 2015-02-03 09:03 - 00001434 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:02 - 2015-02-03 09:02 - 00002145 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-10-27 14:39 - 00002297 _____ () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-16 08:02 - 2014-05-20 10:13 - 00001392 _____ () C:\Users\Public\Desktop\HP Solution Center.lnk
2015-04-16 08:02 - 2014-05-07 10:03 - 00002145 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-05-07 10:03 - 00002145 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-05-05 08:37 - 00001434 _____ () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:01 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.003
2015-04-16 07:39 - 2015-02-20 10:19 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\WiseUpdate
2015-04-16 07:32 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.004
2015-04-15 16:51 - 2015-03-09 12:02 - 00000000 ____D () C:\PMBC
2015-04-15 16:50 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.005
2015-04-15 12:11 - 2014-02-25 01:41 - 00003619 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI
2015-04-15 12:11 - 2014-02-25 01:41 - 00000043 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI
2015-04-15 09:28 - 2014-09-02 14:46 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\gtk-2.0
2015-04-15 09:28 - 2014-09-02 14:34 - 00000000 ____D () C:\Users\DoreenAgricola\.gimp-2.8
2015-04-15 09:13 - 2014-11-11 11:08 - 00000000 ____D () C:\Users\DoreenAgricola\Desktop\Hamburg
2015-04-10 09:52 - 2014-09-12 15:53 - 00000000 ____D () C:\Windows\Minidump
2015-04-10 09:46 - 2014-05-26 10:44 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-10 09:45 - 2014-12-01 12:02 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-10 09:40 - 2014-05-21 08:21 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\vlc
2015-04-09 11:48 - 2014-02-25 01:24 - 00000000 ____D () C:\ProgramData\Skype
2015-04-09 11:33 - 2015-03-06 11:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-09 11:33 - 2014-05-12 09:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 14:56 - 2015-01-27 21:50 - 00000000 ____D () C:\Temp_1
2015-04-07 14:51 - 2014-05-07 09:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-04-03 22:19 - 2014-07-07 09:33 - 00000000 ____D () C:\Users\DoreenAgricola\___Doreen_PRIVAT
2015-04-03 22:18 - 2014-11-26 21:54 - 00000000 ____D () C:\Users\DoreenAgricola\mamas 60
2015-04-03 22:13 - 2014-10-01 08:33 - 00000000 ____D () C:\UNIGIS
2015-04-03 22:11 - 2014-05-14 08:17 - 00000000 ____D () C:\Users\DoreenAgricola\GREGOR
2015-04-01 13:03 - 2015-02-04 10:11 - 00005200 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for DoreenAgricola-Doreen Agricola DoreenAgricola
2015-03-25 14:41 - 2014-05-05 08:37 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\PDFC
2015-03-25 13:22 - 2014-08-27 10:30 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\Adobe
2015-03-24 17:07 - 2014-05-13 10:23 - 00001391 _____ () C:\messages.xml
2015-03-20 12:10 - 2014-05-12 12:28 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Samsung
==================== Files in the root of some directories =======
2015-04-15 09:28 - 2015-04-15 09:28 - 0001493 _____ () C:\Users\DoreenAgricola\AppData\Local\recently-used.xbel
2014-05-13 17:52 - 2014-05-20 10:36 - 0004702 _____ () C:\ProgramData\hpzinstall.log
2014-09-16 10:03 - 2014-09-16 10:03 - 0000199 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
Some content of TEMP:
====================
C:\Users\DoreenAgricola\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-07 06:37
==================== End Of Log ============================
|
|
19.04.2015, 11:22
| #6 |
| | Langsames Laptop-Trojaner von Avira gefunden Und hier noch der Addition.txt: FRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2015
Ran by Doreen Agricola at 2015-04-19 12:12:39
Running from C:\Users\DoreenAgricola\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{C4CB2534-82F4-F4AF-5767-9EE64EF9EB64}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Anki (HKLM-x32\...\Anki) (Version: - )
ArcGIS 10.2 Data Interoperability for Desktop (HKLM-x32\...\ArcGIS 10.2 Data Interoperability for Desktop) (Version: 10.2.3348 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2 Data Interoperability for Desktop (x32 Version: 10.2.3348 - Environmental Systems Research Institute, Inc.) Hidden
ArcGIS 10.2 for Desktop (HKLM-x32\...\ArcGIS 10.2 for Desktop) (Version: 10.2.3348 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2 for Desktop (x32 Version: 10.2.3348 - Environmental Systems Research Institute, Inc.) Hidden
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)
Blender (HKLM\...\Blender) (Version: 2.72b - Blender Foundation)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.3.0.8 - Citrix Systems, Inc.)
Copy (x32 Version: 130.0.366.000 - Hewlett-Packard) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.2921 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3115 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4224 - CyberLink Corp.)
DbVisualizer (HKLM\...\8973-4025-0853-7287) (Version: 9.1.10 - DbVis Software AB)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.372.000 - Hewlett-Packard) Hidden
DJ_AIO_06_F2400_SW_Min (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
ER Mapper Image Compressor 7.2 (HKLM-x32\...\ER Mapper Image Compressor 7.2) (Version: 7.2 - Earth Resource Mapping)
ER Viewer 7.1 (HKLM-x32\...\{671D7AB6-8118-4C41-B602-3001A5A949AA}) (Version: - )
F2400 (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Foxy Security (HKLM-x32\...\Foxy Security) (Version: - )
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
GeoServer 2.6.2 (HKLM-x32\...\GeoServer 2.6.2) (Version: - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
gvSIG desktop (HKLM-x32\...\5C7663A6-181A-61C1-6C25-D2B427D68E1B) (Version: 2.0.0 - gvSIG Association)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{07F6DC37-0857-4B68-A675-4E35989E85E3}) (Version: 6.0.15.1 - Hewlett-Packard Company)
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.2.0.1663 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{7ED7BF91-D145-480A-B206-6891576F6935}) (Version: 4.6.12.1 - Hewlett-Packard Company)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6 (HKLM\...\{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}) (Version: 13.0 - HP)
HP Device Access Manager (HKLM\...\{9F7FF800-8C11-4741-8D20-92E43CA02FD6}) (Version: 8.2.0.10 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{7940DAB9-AC72-4422-8908-DCF58C2C1D21}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.1.160 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{240B2BF7-E7E6-425C-A2A4-A3149189BF7F}) (Version: 2.3.1 - Hewlett-Packard Company)
HP File Sanitizer (HKLM-x32\...\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.11.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.4.8.30 - SunplusIT)
HP Hotkey Support (HKLM-x32\...\{C807BEFB-0F17-41AC-B307-D7B5E1553040}) (Version: 5.0.20.1 - Hewlett-Packard Company)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP PageLift (HKLM-x32\...\{708ABF62-5D7A-4550-823A-1F9EFA63645A}) (Version: 1.0.11.1 - Hewlett-Packard Company)
HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP SoftPaq Download Manager (HKLM-x32\...\{5C2D96B7-0468-4450-8BD9-63AB796D72CF}) (Version: 3.4.11.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{7EF08127-4C30-4C05-8CEB-544F8A71C080}) (Version: 8.7.1.1 - Hewlett-Packard Company)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP System Default Settings (HKLM-x32\...\{3A61A282-4F08-4D43-920C-DC30ECE528E8}) (Version: 2.6.1 - Hewlett-Packard Company)
HP Theft Recovery (HKLM-x32\...\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.2.0.9 - Hewlett-Packard Company)
HP Trust Circles (HKLM-x32\...\HP Trust Circles) (Version: 8.2.15.16418 - CryptoMill Technologies)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
hpPrintProjects (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
hpWLPGInstaller (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HyperCam 2 (HKLM-x32\...\HyperCam 2) (Version: - )
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6486.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.12.1688 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3272 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.7.3.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intergraph GeoMedia Viewer 2014 (HKLM-x32\...\{91429374-40EC-48DA-999C-4678CAB5CE1E}) (Version: 14.00.0002.00088 - Intergraph Corporation) <==== ATTENTION
Java 7 Update 75 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417075FF}) (Version: 7.0.750 - Oracle)
Java 7 Update 75 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mediatek MT7630E 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.36.0 - Mediatek)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MyFreeCodec) (Version: - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.4 - Notepad++ Team)
OEM Application Profile (HKLM-x32\...\{CCBD6679-C7CF-2030-2A1F-3640781DF4F4}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.1.50 - PDF Complete, Inc)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
posterXXL Designer 5.2 (HKLM-x32\...\posterXXL Designer)_is1) (Version: - )
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QGIS Chugiak 2.4.0 Chugiak (HKLM-x32\...\QGIS Chugiak) (Version: - QGIS Development Team)
Ralink Bluetooth Stack (HKLM\...\{BCDD86BE-1426-19BA-D1D1-C94D92FD6281}) (Version: 11.0.748.0 - Mediatek)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 1.1.9200.18 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.73.618.2013 - Realtek)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Settings Manager (HKLM-x32\...\Settings Manager) (Version: 5.0.0.12349 - Aztec Media Inc) <==== ATTENTION
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.3 - Synaptics Incorporated)
Tableau Public 8.2 (8200.14.1015.1955) (HKLM\...\{D1DA53A9-040E-4D82-B888-EF5617A9C25B}) (Version: 8.2.2152 - Tableau Software)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{F5850B80-27F9-406E-91D3-1329F813BA63}) (Version: 4.5.130.0 - Validity Sensors, Inc.)
Video Songs Gizmos (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\lyricsgizm) (Version: 3.0.0.0 - lyricsgizm) <==== ATTENTION
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
WinTopo (HKLM-x32\...\WinTopo) (Version: - )
Wise Program Uninstaller 1.63 (HKLM-x32\...\Wise Program Uninstaller_is1) (Version: 1.63 - WiseCleaner.com, Inc.)
Wise Registry Cleaner 8.42 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.42 - WiseCleaner.com, Inc.)
XTools Pro 10.2 (HKLM-x32\...\{41A0A466-04BA-4142-BBA2-A0A08F865610}) (Version: 10.2.1235 - Data East Soft, LLC)
yEd Graph Editor 3.7 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.7 - yWorks GmbH)
YTD Video Downloader 4.8.9 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.9 - GreenTree Applications SRL) <==== ATTENTION
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> C:\Program Files\Blender Foundation\Blender\BlendThumb64.dll ()
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll No (the data entry has 4 more characters).
==================== Restore Points =========================
24-03-2015 11:40:02 Windows Update
30-03-2015 08:40:27 Windows Update
02-04-2015 14:03:48 Windows Modules Installer
03-04-2015 21:45:51 Windows Update
09-04-2015 07:22:38 Windows Update
10-04-2015 09:43:28 Installed Java 7 Update 75 (64-bit)
10-04-2015 09:45:38 Installed Java 7 Update 75
10-04-2015 10:36:33 Windows Defender Checkpoint
16-04-2015 07:44:21 Windows Update
16-04-2015 08:16:42 Removed Bonjour
16-04-2015 22:44:29 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0F2E3699-286F-44D0-8052-BADD371F2AEF} - System32\Tasks\{CFCFC0F1-4AA8-46B8-9ACF-A2C95ABEA347} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {2030E90F-7308-4BF7-B264-4A05C078BDB3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {247803FB-AC8A-45B5-A54F-C2B14174937E} - System32\Tasks\{0A472056-4AAA-448E-98C1-F9D5F526BCEF} => pcalua.exe -a F:\Setup\snsplash.exe -d F:\
Task: {33F61431-4C68-497C-9751-BCF365D37DC9} - System32\Tasks\Clip => C:\___Module\Modul6\UebungenM6\Uebung8\scheduledTasks.py [2014-10-10] ()
Task: {36723A3D-C688-4466-83B6-FE60BC3A5C83} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-16] (Adobe Systems Incorporated)
Task: {3A1857E4-CC82-4E1E-8AB4-5BFA73D37CE8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {3B6C0BF7-BDB5-4662-A28A-B630F6918E79} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\Doreen Agricola\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\MinibarChrome.exe
Task: {463EFD36-123B-4D48-A5C6-55A8B3C3B34E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22] (Google Inc.)
Task: {46FCC82F-EECF-494E-9EDB-CD0AC7A6F6C8} - System32\Tasks\{0DA2C344-C7A3-443D-B3A1-0655E1D5FF01} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {98B470E0-FB4D-445F-90F5-2FCA2B0A0B31} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {9CFA66FC-B52A-41FA-82B9-E36B4E3227E1} - System32\Tasks\{7BB3B0E1-FB84-4E4C-B5B0-E465F0C0386A} => pcalua.exe -a C:\Users\DoreenAgricola\Desktop\setup.exe -d C:\Users\DoreenAgricola\Desktop
Task: {ACE243A2-0E2D-4908-B537-2EA0B046BD05} - System32\Tasks\{FF4D077D-604A-41CE-863F-20F86D23DC77} => pcalua.exe -a "C:\Users\Doreen Agricola\Downloads\msorun.exe" -d "C:\Users\Doreen Agricola\Downloads"
Task: {BACC6C11-0E3A-400B-96F0-D3D26FD13997} - System32\Tasks\{B0E7FAB3-7140-4A58-B3ED-16AB57F10219} => pcalua.exe -a "C:\Users\Doreen Agricola\Downloads\wlsetup-web.exe" -d "C:\Users\Doreen Agricola\Downloads"
Task: {BDEBA074-ACA0-41BD-A20B-98A47023CCC2} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {C51BB2FB-82FD-4A25-BFBF-10CAF2B4073B} - System32\Tasks\{E84A3618-1408-452D-8610-FEED3040DB60} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {D4C0C374-457C-495D-A89E-477E12A99CCB} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D9529417-7358-4E66-97BE-A0DDDCFD3A21} - System32\Tasks\lyricsgizm Runner => C:\ProgramData\lyricsgizm\lyricsgizm.exe [2014-06-30] (Print Test Agent) <==== ATTENTION
Task: {D9CE6AD5-97FA-40AD-8B83-71EDC89338C0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22] (Google Inc.)
Task: {E19831DE-4441-4DBB-AD09-63BFFB79DAD1} - System32\Tasks\Microsoft Office 15 Sync Maintenance for DoreenAgricola-Doreen Agricola DoreenAgricola => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {E1CBFC58-44CB-4C39-A4A5-AA3D153606B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E2284166-3B08-41E1-93CA-C225C16A1BDB} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG)
Task: {E65A49A0-98D7-41A4-B3A7-9592F1BE2CA2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\lyricsgizm Runner.job => C:\ProgramData\lyricsgizm\lyricsgizm.exe;/task=4 C:\ProgramData\lyricsgizm\lyricsgizm.exe /task=4 /InstallOn=0 /closebr=0 /active=24 /update=24 /interval=2880 /pubId=1001 /affId=10010035 /appId=111 /uId={11B3653E-46F5-420B-8870-5F13D2E3E023} /version=3.0.0.0 /Override=false /IEhome=0 /IEsearch=0 /FFhome=0 /FFsearch=0 /CHhome=0 /CHsearch=0 /FFaddon= /CHaddon= /AutoSP= /regAppName=lyricsgizm /curSID=S-1-5-21-423146766-3122434050-3300097568-1001 /logf=C:\Users\Doreen Agricola\AppData\Local\Temp\lyricsgizm_installer_{11B3653E-46F5-420B-8870-5F13D2E3E023}_1399891842.txt
==================== Loaded Modules (whitelisted) ==============
2013-05-22 23:21 - 2013-05-22 23:21 - 00299832 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2014-05-13 17:50 - 2012-09-18 15:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2014-05-13 17:50 - 2012-09-18 15:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2015-03-09 12:25 - 2015-01-20 11:45 - 00020240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll
2013-11-02 01:48 - 2013-11-02 01:48 - 00029432 _____ () C:\Windows\system32\BsTrace.dll
2013-08-08 00:01 - 2013-08-08 00:01 - 02654936 _____ () C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\ShredContextMenu.dll
2013-11-02 01:48 - 2013-11-02 01:48 - 00371448 _____ () C:\Windows\system32\BsExtendFunc.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-05-12 07:46 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-08-08 01:02 - 2013-08-08 01:02 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2013-11-02 01:48 - 2013-11-02 01:48 - 00016632 _____ () C:\Windows\system32\BsHelpCSps.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-04-20 01:42 - 2014-10-09 11:36 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2014-02-25 01:20 - 2013-07-26 07:24 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: AccelerometerSysTrayApplet => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe
MSCONFIG\startupreg: BtTray => "c:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
MSCONFIG\startupreg: CLMLServer_For_P2G8 => "c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe"
MSCONFIG\startupreg: CLVirtualDrive => "c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" /R
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: CryptoMill Refresh => C:\Program Files\Hewlett-Packard\HP Trust Circles\ceflauncher -m refresh
MSCONFIG\startupreg: HotKeysCmds => "C:\Windows\system32\hkcmd.exe"
MSCONFIG\startupreg: HP File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\Coreshredder.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPConnectionManager => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
MSCONFIG\startupreg: IAStorIcon => "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: IgfxTray => "C:\Windows\system32\igfxtray.exe"
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Persistence => "C:\Windows\system32\igfxpers.exe"
MSCONFIG\startupreg: QLBController => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
MSCONFIG\startupreg: StartCCC => "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
MSCONFIG\startupreg: YouCam Mirage => "c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
MSCONFIG\startupreg: YouCam Tray => "c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s
==================== Accounts: =============================
Administrator (S-1-5-21-423146766-3122434050-3300097568-500 - Administrator - Disabled)
Doreen Agricola (S-1-5-21-423146766-3122434050-3300097568-1001 - Administrator - Enabled) => C:\Users\DoreenAgricola
Gast (S-1-5-21-423146766-3122434050-3300097568-501 - Limited - Enabled) => C:\Users\Gast
Test (S-1-5-21-423146766-3122434050-3300097568-1002 - Administrator - Enabled) => C:\Users\Test
==================== Faulty Device Manager Devices =============
Name: Microsoft-Teredo-Tunneling-Adapter
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (04/17/2015 07:40:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lyricsgizm.exe, Version: 1.1.0.14, Zeitstempel: 0x53b195a4
Name des fehlerhaften Moduls: lyricsgizm.exe, Version: 1.1.0.14, Zeitstempel: 0x53b195a4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000085cf
ID des fehlerhaften Prozesses: 0xc4c
Startzeit der fehlerhaften Anwendung: 0xlyricsgizm.exe0
Pfad der fehlerhaften Anwendung: lyricsgizm.exe1
Pfad des fehlerhaften Moduls: lyricsgizm.exe2
Berichtskennung: lyricsgizm.exe3
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1427051
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1427051
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/10/2015 10:36:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {43d32e80-3bd0-4212-a950-b807cf23e2be}
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x12b0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x12cc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
System errors:
=============
Error: (04/17/2015 00:53:42 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.
Error: (04/17/2015 10:59:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/16/2015 11:08:39 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.
Error: (04/16/2015 10:43:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (04/16/2015 10:43:42 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (04/16/2015 06:10:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.
Error: (04/16/2015 04:49:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (04/16/2015 02:18:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
Error: (04/16/2015 01:41:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (04/16/2015 00:17:11 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.
Microsoft Office Sessions:
=========================
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\DoreenAgricola\Downloads\SoftonicDownloader_fuer_freemind.exe
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\DoreenAgricola\Downloads\SoftonicDownloader_fuer_samsung-kies.exe
Error: (04/17/2015 07:40:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: lyricsgizm.exe1.1.0.1453b195a4lyricsgizm.exe1.1.0.1453b195a4c0000005000085cfc4c01d078d0f2047781C:\ProgramData\lyricsgizm\lyricsgizm.exeC:\ProgramData\lyricsgizm\lyricsgizm.exe3118722a-e4c4-11e4-9d87-a01d48aefcc7
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1427051
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1427051
Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (04/10/2015 10:36:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {43d32e80-3bd0-4212-a950-b807cf23e2be}
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa112b001d073678c1f2624C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec67c0e1-df5a-11e4-9acc-a01d48aefcc7
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa112cc01d073678c2d6e66C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec6772c1-df5a-11e4-9acc-a01d48aefcc7
Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa1129401d073678bed293fC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec6799d1-df5a-11e4-9acc-a01d48aefcc7
CodeIntegrity Errors:
===================================
Date: 2014-09-02 14:11:44.469
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:11:44.469
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:32.776
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:32.776
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:29.896
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:29.896
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:29.796
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:29.796
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:19.832
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-09-02 14:10:19.831
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 50%
Total physical RAM: 3977.11 MB
Available physical RAM: 1970.57 MB
Total Pagefile: 7952.41 MB
Available Pagefile: 5085.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:450.51 GB) (Free:334.13 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:12.24 GB) (Free:1.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.99 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 618D8341)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0B)
==================== End Of Log ============================
|
|
19.04.2015, 22:04
| #7 |
| /// the machine /// TB-Ausbilder | Langsames Laptop-Trojaner von Avira gefunden Lade Dir bitte von hier  Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.04.2015, 17:32
| #8 |
| | Langsames Laptop-Trojaner von Avira gefunden Hallo, hier die ersten Probleme. Also Intergraph und YTD gingen problemlos zu deinstallieren. Bei Settings Manager und Video songs Gizmos gab es Probleme. Wahrscheinlich, weil es hier keine automatischen Deinstallationsprogramme der Firmen gab. Was soll ich tun, wenn ich,bei den Übriggebliebenen Registryeinträgen Fenster, auf alles markieren gehe, dann werden alle Verzeichnisse von Mein Computer , HKEY_LOCAL_Machine, SOFTWARE..... markiert bis hin zu Settings Manager und dessen Unterpfade! Ist das richtig, dass in jedem Kästchen ein Haken drinne ist von der Wurzel an oder soll ich nur das Settings Manager und die darunter liegenden Anstriche markieren und Löschen. Ähnlich bei Video Songs Gizmos. Ich habe auch Screenshots von den beiden Anzeigen, weiß aber nicht wie ich die hier hochladen soll, damit Du das auch siehst. Na dann, Danke bis hierher ich bin gespannt wie es weiter geht. Doreen |
|
23.04.2015, 11:27
| #9 |
| /// the machine /// TB-Ausbilder | Langsames Laptop-Trojaner von Avira gefunden Ist korrekt so, steht aber alles in der bebilderten Anleitung
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.04.2015, 05:57
| #10 |
| | Langsames Laptop-Trojaner von Avira gefunden Hallo Schrauber, das hat jetzt ewig gedauert, aber ich habe einen Log File von Combofix. Combofix Logfile: Code:
ATTFilter ComboFix 15-04-19.01 - Doreen Agricola 24.04.2015 15:17:11.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3977.1806 [GMT 2:00]
ausgeführt von:: c:\users\DoreenAgricola\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\lyricsgizm
c:\programdata\lyricsgizm\lyricsgizm.exe
c:\programdata\lyricsgizm\lyricsgizmutil.dll
c:\users\DoreenAgricola\AppData\Local\assembly\tmp
c:\users\DoreenAgricola\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C5458AEF-52A5-4455-AA31-DAFD9DA33B25}.xps
c:\users\DoreenAgricola\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C62C3DB3-7FCD-4697-85AA-2DF114275DBB}.xps
c:\users\DoreenAgricola\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\logs
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-03-25 bis 2015-04-25 ))))))))))))))))))))))))))))))
.
.
2015-04-24 21:07 . 2015-04-24 21:07 -------- d-----w- c:\users\Test\AppData\Local\temp
2015-04-24 21:07 . 2015-04-24 21:07 -------- d-----w- c:\users\Gast\AppData\Local\temp
2015-04-24 21:07 . 2015-04-24 21:07 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-04-22 15:53 . 2015-04-22 15:53 -------- d-----w- c:\program files (x86)\VS Revo Group
2015-04-19 10:08 . 2015-04-19 10:13 -------- d-----w- C:\FRST
2015-04-16 10:07 . 2015-04-16 10:07 -------- d-----w- c:\users\DoreenAgricola\AppData\Roaming\Avira
2015-04-16 10:05 . 2015-03-24 12:59 44088 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2015-04-16 10:05 . 2015-03-24 12:59 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2015-04-16 10:05 . 2015-03-24 12:59 132120 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-04-16 10:05 . 2015-03-24 12:59 128536 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-04-16 10:01 . 2015-04-16 10:09 -------- d-----w- c:\program files (x86)\Avira
2015-04-16 10:01 . 2015-04-16 10:05 -------- d-----w- c:\programdata\Avira
2015-04-16 05:44 . 2015-02-25 03:18 754688 ----a-w- c:\windows\system32\drivers\http.sys
2015-04-10 07:48 . 2015-04-10 07:48 -------- d-----w- c:\program files (x86)\Common Files\Java
2015-04-10 07:44 . 2015-04-10 07:47 111016 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2015-04-10 07:44 . 2015-04-10 07:44 189352 ----a-w- c:\windows\system32\javaw.exe
2015-04-10 07:44 . 2015-04-10 07:44 189352 ----a-w- c:\windows\system32\java.exe
2015-04-10 07:44 . 2015-04-10 07:47 -------- d-----w- c:\program files\Java
2015-04-03 20:13 . 2015-04-03 20:13 -------- d-----w- c:\users\DoreenAgricola\rezepte_Kigeb
2015-04-02 11:51 . 2015-04-02 11:51 -------- d-----w- c:\programdata\Citrix
2015-04-02 11:51 . 2015-04-02 12:05 -------- d-----w- c:\users\DoreenAgricola\AppData\Roaming\ICAClient
2015-04-02 11:51 . 2015-04-02 11:51 -------- d-----w- c:\users\DoreenAgricola\AppData\Local\Citrix
2015-04-02 11:51 . 2015-04-02 11:51 -------- d-----w- c:\program files (x86)\Citrix
2015-03-30 06:39 . 2015-03-30 06:39 -------- d-----w- c:\program files (x86)\Common Files\Hydrup
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-16 20:49 . 2014-05-16 11:55 128913832 ----a-w- c:\windows\system32\MRT.exe
2015-04-16 07:58 . 2013-09-13 19:02 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-04-16 07:58 . 2013-09-13 19:02 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-17 04:56 . 2015-04-16 05:45 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2015-02-26 03:25 . 2015-03-11 09:44 3204096 ----a-w- c:\windows\system32\win32k.sys
2015-02-24 03:20 . 2015-02-24 03:20 829264 ----a-w- c:\windows\system32\msvcr100.dll
2015-02-24 03:20 . 2015-02-24 03:20 608080 ----a-w- c:\windows\system32\msvcp100.dll
2015-02-24 03:17 . 2010-11-21 03:27 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-24 02:11 . 2015-02-24 02:11 773968 ----a-w- c:\windows\SysWow64\msvcr100.dll
2015-02-24 02:11 . 2015-02-24 02:11 421200 ----a-w- c:\windows\SysWow64\msvcp100.dll
2015-02-20 04:41 . 2015-03-11 09:48 41984 ----a-w- c:\windows\system32\lpk.dll
2015-02-20 04:40 . 2015-03-11 09:48 100864 ----a-w- c:\windows\system32\fontsub.dll
2015-02-20 04:40 . 2015-03-11 09:48 14336 ----a-w- c:\windows\system32\dciman32.dll
2015-02-20 04:40 . 2015-03-11 09:48 46080 ----a-w- c:\windows\system32\atmlib.dll
2015-02-20 04:13 . 2015-03-11 09:48 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2015-02-20 04:13 . 2015-03-11 09:48 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2015-02-20 04:13 . 2015-03-11 09:48 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-02-20 04:12 . 2015-03-11 09:48 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2015-02-20 03:29 . 2015-03-11 09:48 372224 ----a-w- c:\windows\system32\atmfd.dll
2015-02-20 03:09 . 2015-03-11 09:48 299008 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-02-13 05:22 . 2015-03-11 09:45 14177280 ----a-w- c:\windows\system32\shell32.dll
2015-02-10 10:36 . 2014-05-07 08:00 627912 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2015-02-04 10:23 . 2015-02-04 10:23 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2015-02-04 10:13 . 2015-02-04 10:13 869536 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2015-02-04 03:16 . 2015-03-11 09:40 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2015-02-04 02:54 . 2015-03-11 09:40 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-02-03 03:34 . 2015-03-11 09:47 693176 ----a-w- c:\windows\system32\winload.efi
2015-02-03 03:34 . 2015-03-11 09:47 94656 ----a-w- c:\windows\system32\drivers\mountmgr.sys
2015-02-03 03:33 . 2015-03-11 09:47 616360 ----a-w- c:\windows\system32\winresume.efi
2015-02-03 03:31 . 2015-03-11 09:47 14632960 ----a-w- c:\windows\system32\wmp.dll
2015-02-03 03:31 . 2015-03-11 09:47 782848 ----a-w- c:\windows\system32\wmdrmsdk.dll
2015-02-03 03:31 . 2015-03-11 09:47 229376 ----a-w- c:\windows\system32\wintrust.dll
2015-02-03 03:31 . 2015-03-11 09:44 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-02-03 03:31 . 2015-03-11 09:45 215552 ----a-w- c:\windows\system32\ubpm.dll
2015-02-03 03:31 . 2015-03-11 09:47 5120 ----a-w- c:\windows\system32\msdxm.ocx
2015-02-03 03:31 . 2015-03-11 09:47 5120 ----a-w- c:\windows\system32\dxmasf.dll
2015-02-03 03:31 . 2015-03-11 09:47 63488 ----a-w- c:\windows\system32\setbcdlocale.dll
2015-02-03 03:31 . 2015-03-11 09:47 371712 ----a-w- c:\windows\system32\qdvd.dll
2015-02-03 03:31 . 2015-03-11 09:47 1574400 ----a-w- c:\windows\system32\quartz.dll
2015-02-03 03:31 . 2015-03-11 09:47 500224 ----a-w- c:\windows\system32\AUDIOKSE.dll
2015-02-03 03:31 . 2015-03-11 09:47 188416 ----a-w- c:\windows\system32\pcasvc.dll
2015-02-03 03:31 . 2015-03-11 09:47 37376 ----a-w- c:\windows\system32\pcadm.dll
2015-02-03 03:31 . 2015-03-11 09:47 9728 ----a-w- c:\windows\system32\spwmp.dll
2015-02-03 03:31 . 2015-03-11 09:47 641024 ----a-w- c:\windows\system32\msscp.dll
2015-02-03 03:31 . 2015-03-11 09:47 325632 ----a-w- c:\windows\system32\msnetobj.dll
2015-02-03 03:31 . 2015-03-11 09:47 11264 ----a-w- c:\windows\system32\msmmsp.dll
2015-02-03 03:31 . 2015-03-11 09:47 4121600 ----a-w- c:\windows\system32\mf.dll
2015-02-03 03:31 . 2015-03-11 09:47 432128 ----a-w- c:\windows\system32\mfplat.dll
2015-02-03 03:31 . 2015-03-11 09:47 206848 ----a-w- c:\windows\system32\mfps.dll
2015-02-03 03:30 . 2015-03-11 09:47 631808 ----a-w- c:\windows\system32\evr.dll
2015-02-03 03:30 . 2015-03-11 09:47 284672 ----a-w- c:\windows\system32\EncDump.dll
2015-02-03 03:30 . 2015-03-11 09:47 1202176 ----a-w- c:\windows\system32\drmv2clt.dll
2015-02-03 03:30 . 2015-03-11 09:47 497664 ----a-w- c:\windows\system32\drmmgrtn.dll
2015-02-03 03:30 . 2015-03-11 09:47 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-02-03 03:30 . 2015-03-11 09:47 140288 ----a-w- c:\windows\system32\cryptnet.dll
2015-02-03 03:30 . 2015-03-11 09:47 1069056 ----a-w- c:\windows\system32\cryptui.dll
2015-02-03 03:30 . 2015-03-11 09:47 187904 ----a-w- c:\windows\system32\cryptsvc.dll
2015-02-03 03:30 . 2015-03-11 09:47 82432 ----a-w- c:\windows\system32\cryptsp.dll
2015-02-03 03:30 . 2015-03-11 09:47 680960 ----a-w- c:\windows\system32\audiosrv.dll
2015-02-03 03:30 . 2015-03-11 09:47 842240 ----a-w- c:\windows\system32\blackbox.dll
2015-02-03 03:30 . 2015-03-11 09:47 296448 ----a-w- c:\windows\system32\AudioSes.dll
2015-02-03 03:30 . 2015-03-11 09:47 440832 ----a-w- c:\windows\system32\AudioEng.dll
2015-02-03 03:30 . 2015-03-11 09:47 58880 ----a-w- c:\windows\system32\appidapi.dll
2015-02-03 03:30 . 2015-03-11 09:47 32256 ----a-w- c:\windows\system32\appidsvc.dll
2015-02-03 03:30 . 2015-03-11 09:47 55808 ----a-w- c:\windows\system32\rrinstaller.exe
2015-02-03 03:30 . 2015-03-11 09:47 9728 ----a-w- c:\windows\system32\pcalua.exe
2015-02-03 03:30 . 2015-03-11 09:47 11264 ----a-w- c:\windows\system32\pcawrk.exe
2015-02-03 03:30 . 2015-03-11 09:47 24576 ----a-w- c:\windows\system32\mfpmp.exe
2015-02-03 03:30 . 2015-03-11 09:47 126464 ----a-w- c:\windows\system32\audiodg.exe
2015-02-03 03:30 . 2015-03-11 09:47 146944 ----a-w- c:\windows\system32\appidpolicyconverter.exe
2015-02-03 03:30 . 2015-03-11 09:47 17920 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-02-03 03:30 . 2015-03-11 09:47 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2015-02-03 03:29 . 2015-03-11 09:47 8704 ----a-w- c:\windows\system32\pcaevts.dll
2015-02-03 03:28 . 2015-03-11 09:47 2048 ----a-w- c:\windows\system32\mferror.dll
2015-02-03 03:19 . 2015-03-11 09:47 663552 ----a-w- c:\windows\system32\drivers\PEAuth.sys
2015-02-03 03:12 . 2015-03-11 09:47 617984 ----a-w- c:\windows\SysWow64\wmdrmsdk.dll
2015-02-03 03:12 . 2015-03-11 09:47 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2015-02-03 03:12 . 2015-03-11 09:44 1230848 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-02-03 03:12 . 2015-03-11 09:45 171520 ----a-w- c:\windows\SysWow64\ubpm.dll
2015-02-03 03:12 . 2015-03-11 09:47 4096 ----a-w- c:\windows\SysWow64\msdxm.ocx
2015-02-03 03:12 . 2015-03-11 09:47 4096 ----a-w- c:\windows\SysWow64\dxmasf.dll
2015-02-03 03:12 . 2015-03-11 09:47 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2015-02-03 03:12 . 2015-03-11 09:47 1329664 ----a-w- c:\windows\SysWow64\quartz.dll
2015-02-03 03:12 . 2015-03-11 09:47 442880 ----a-w- c:\windows\SysWow64\AUDIOKSE.dll
2015-02-03 03:12 . 2015-03-11 09:47 8192 ----a-w- c:\windows\SysWow64\spwmp.dll
2015-02-03 03:12 . 2015-03-11 09:47 504320 ----a-w- c:\windows\SysWow64\msscp.dll
2015-02-03 03:12 . 2015-03-11 09:47 265216 ----a-w- c:\windows\SysWow64\msnetobj.dll
2015-02-03 03:12 . 2015-03-11 09:47 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2015-02-03 03:12 . 2015-03-11 09:47 354816 ----a-w- c:\windows\SysWow64\mfplat.dll
2015-02-03 03:12 . 2015-03-11 09:47 103424 ----a-w- c:\windows\SysWow64\mfps.dll
2015-02-03 03:12 . 2015-03-11 09:47 489984 ----a-w- c:\windows\SysWow64\evr.dll
2015-02-03 03:12 . 2015-03-11 09:47 988160 ----a-w- c:\windows\SysWow64\drmv2clt.dll
2015-02-03 03:12 . 2015-03-11 09:47 406016 ----a-w- c:\windows\SysWow64\drmmgrtn.dll
2015-02-03 03:12 . 2015-03-11 09:47 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-02-03 03:12 . 2015-03-11 09:47 1005056 ----a-w- c:\windows\SysWow64\cryptui.dll
2015-02-03 03:12 . 2015-03-11 09:47 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2015-02-03 03:12 . 2015-03-11 09:47 143872 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2015-02-03 03:12 . 2015-03-11 09:47 81408 ----a-w- c:\windows\SysWow64\cryptsp.dll
2015-02-03 03:12 . 2015-03-11 09:47 744960 ----a-w- c:\windows\SysWow64\blackbox.dll
2015-02-03 03:12 . 2015-03-11 09:47 50688 ----a-w- c:\windows\SysWow64\appidapi.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\+1TBIcon]
@="{B9C55E85-DED6-4911-82F3-83CF1CAB2898}"
[HKEY_CLASSES_ROOT\CLSID\{B9C55E85-DED6-4911-82F3-83CF1CAB2898}]
2013-08-23 02:24 133592 ----a-w- c:\program files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"avgnt"="c:\program files (x86)\Avira\Antivirus\avgnt.exe" [2015-03-24 726320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\Antivirus\avmailc7.exe;c:\program files (x86)\Avira\Antivirus\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\Antivirus\avwebg7.exe;c:\program files (x86)\Avira\Antivirus\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FLCDLOCK;HP Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe [x]
R3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 SmbDrvI;SmbDrvI;c:\windows\system32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\DRIVERS\amdkmpfd.sys;c:\windows\SYSNATIVE\DRIVERS\amdkmpfd.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 PinFile;PinFile;c:\windows\system32\DRIVERS\PinFile.sys;c:\windows\SYSNATIVE\DRIVERS\PinFile.sys [x]
S0 SDDisk2K;SDDisk2K;c:\windows\system32\DRIVERS\SDDisk2K.sys;c:\windows\SYSNATIVE\DRIVERS\SDDisk2K.sys [x]
S0 SDDToki;SDDToki;c:\windows\system32\DRIVERS\SDDToki.sys;c:\windows\SYSNATIVE\DRIVERS\SDDToki.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\Antivirus\sched.exe;c:\program files (x86)\Avira\Antivirus\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 CreoService;HP Trust Circles Service;c:\program files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe;c:\program files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [x]
S2 CtAgentService;Absolute Software Agent Service;c:\program files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe;c:\program files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [x]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [x]
S2 GeoServer 2.6.2;GeoServer 2.6.2;c:\program files (x86)\GeoServer 2.6.2\wrapper.exe;c:\program files (x86)\GeoServer 2.6.2\wrapper.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPFSService;HP File Sanitizer;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 Hydrup;Hydrup;c:\program files (x86)\Common Files\Hydrup\hydrup.exe;c:\program files (x86)\Common Files\Hydrup\hydrup.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 BtAudioBusSrv;Ralink Bluetooth Audio Bus Service;c:\windows\system32\Drivers\BtAudioBus.sys;c:\windows\SYSNATIVE\Drivers\BtAudioBus.sys [x]
S3 BthL2caScoIfSrv;IVT Bluetooth Profile Interface Driver Service;c:\windows\system32\Drivers\BtL2caScoIf.sys;c:\windows\SYSNATIVE\Drivers\BtL2caScoIf.sys [x]
S3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;c:\windows\system32\Drivers\IvtUrbBtFlt.sys;c:\windows\SYSNATIVE\Drivers\IvtUrbBtFlt.sys [x]
S3 IceKore;IceKore;c:\windows\system32\DRIVERS\IceKore.sys;c:\windows\SYSNATIVE\DRIVERS\IceKore.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 m76usb;M76USB Bluetooth Device Driver;c:\windows\system32\DRIVERS\m76usb.sys;c:\windows\SYSNATIVE\DRIVERS\m76usb.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys;c:\windows\SYSNATIVE\DRIVERS\teamviewervpn.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-13 07:58]
.
2015-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22 09:59]
.
2015-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22 09:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-02-10 11:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-02-10 11:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-02-10 11:52 2334928 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\+1TBIcon]
@="{B9C55E85-DED6-4911-82F3-83CF1CAB2898}"
[HKEY_CLASSES_ROOT\CLSID\{B9C55E85-DED6-4911-82F3-83CF1CAB2898}]
2013-08-23 02:24 147928 ----a-w- c:\program files\Hewlett-Packard\HP Trust Circles\tbicon.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = https://safesearch.avira.com/
mDefault_Page_URL = https://safesearch.avira.com/
mStart Page = https://safesearch.avira.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = https://safesearch.avira.com/
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\ie_banner_deny.htm
IE: {{d8f67242-b229-4065-95fa-391b077ed6ca} - {d8f67242-b229-4065-95fa-391b077ed6ca} - mscoree.dll
TCP: DhcpNameServer = 192.168.2.1
Handler: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - c:\windows\System32\mscoree.dll
FF - ProfilePath - c:\users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.anti_banner_native_proxy - 2
FF - user.js: plugin.state.url_advisor - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.anti_banner_native_proxy - 2
FF - user.js: plugin.state.url_advisor - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
AddRemove-Foxy Security - c:\users\Doreen Agricola\AppData\Roaming\Security Systems\uninstaller.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
AddRemove-OneDriveSetup.exe - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\OneDriveSetup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\Antivirus\avguard.exe
c:\program files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
c:\program files (x86)\Java\jre1.8.0_31\bin\java.exe
c:\program files (x86)\TeamViewer\TeamViewer_Service.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-25 21:35:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-04-25 19:34
.
Vor Suchlauf: 25 Verzeichnis(se), 366,424,489,984 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 369,442,226,176 Bytes frei
.
- - End Of File - - 365375F46FEA920F2B8FC365E3D33A00
A36C5E4F47E84449FF07ED3517B43A31 [/CODE] Ok, dann schaue ich mal wie es weiter geht. Den Rechner habe ich nach Combofix noch nicht wieder neu gestartet. Gruß Doreen |
|
26.04.2015, 18:11
| #11 |
| /// the machine /// TB-Ausbilder | Langsames Laptop-Trojaner von Avira gefunden Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Langsames Laptop-Trojaner von Avira gefunden |
| adobe, adware, angehalten, anhang, avira, datei, eingefangen, erhalte, folge, folgende, gekauft, gen, heute, hochfahren, kaspersky, langsamer, log, nicht mehr, nutzen, programme, reader, rechner, sichere, software, tools, trojanische pferd, update |
dann auf 
und dann auf 
. 
Linear-Darstellung
