| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojan Spy: Win32/Shiotob.BWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
24.04.2015, 16:37
| #16 |
| /// TB-Ausbilder /// Anleitungs-Guru  |  Trojan Spy: Win32/Shiotob.B Bitte die FRST sowie das Malwarebytes-Log in CodeTags posten.
__________________ Gruß deeprybka  Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
24.04.2015, 20:33
| #17 |
 | Trojan Spy: Win32/Shiotob.B FRST Logfile:
__________________FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-04-2015 02 Ran by Marlin (administrator) on MERLINS on 24-04-2015 17:14:33 Running from C:\Users\Marlin\Downloads Loaded Profiles: Marlin (Available profiles: Marlin) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe (Toshiba) C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe () C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Skillbrains) C:\Users\Marlin\AppData\Local\Skillbrains\lightshot\5.1.4.34\Lightshot.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe () C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Farbar) C:\Users\Marlin\Downloads\FRST (1).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor) HKLM\...\Run: [NDSTray.exe] => NDSTray.exe HKLM\...\Run: [cfFncEnabler.exe] => cfFncEnabler.exe HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation) HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [54608 2007-10-31] (TOSHIBA Corporation) HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-01-25] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-03-19] (TOSHIBA Corporation) HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.) HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.) HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] () HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-04-07] (Apple Inc.) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [LightShot] => C:\Users\Marlin\AppData\Local\Skillbrains\lightshot\Lightshot.exe [226560 2014-06-18] () HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [Facebook Update] => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-09-08] (Facebook Inc.) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\RunOnce: [Adobe Speed Launcher] => 1429888192 HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {10a2aea9-2430-11e1-bfcb-bcb96134645e} - D:\pushinst.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cba7-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cbce-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cbf0-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {e0ea989b-5b57-11e3-8093-a0b371b526af} - D:\pushinst.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {f19b05e5-4af4-11df-9e29-ae976310cd93} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Aurora.scr [1370624 2008-01-21] (Microsoft Corporation) AppInit_DLLs: C:\PROGRA~1\Amazon\AMAZON~1\\AMAZON~1.DLL => C:\Program Files\Amazon\Amazon1ButtonApp\\AmazonExtIE.dll [138048 2013-12-15] () Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2008-10-07] ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2008-10-07] ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEE&bmod=TSEE HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEE&bmod=TSEE; HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> DefaultScope {9D768E64-B834-4E9D-AA51-9BDEB1C1719D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> {9D768E64-B834-4E9D-AA51-9BDEB1C1719D} URL = https://www.google.com/search?q={searchTerms} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation) BHO: Online_Downloaden_Toolbar -> {f6e6051c-0d37-44e3-8855-2308b314f6c2} -> C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] () Toolbar: HKLM - Online_Downloaden_Toolbar - {40090c1a-85c9-419d-b493-6119f95d97a4} - C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] () Toolbar: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Marlin\AppData\Roaming\Mozilla\Firefox\Profiles\bfpcejxh.default-1416090229181 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll [2008-08-21] (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll [2015-02-13] (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @Nero.com/KM -> C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2012-10-25] (Nero AG) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2241634971-3471804435-397115952-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-2241634971-3471804435-397115952-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Marlin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-12-05] (Unity Technologies ApS) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-26] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR Profile: C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-28] CHR Extension: (Google Docs) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-28] CHR Extension: (Google Drive) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-28] CHR Extension: (YouTube) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-28] CHR Extension: (Google Search) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-28] CHR Extension: (Google Sheets) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-28] CHR Extension: (Bookmark Manager) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-21] CHR Extension: (Heavenly Cross) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kepdlccjceknhloddohpnmciihblkann [2015-02-28] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15] CHR Extension: (Google Wallet) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-07] CHR Extension: (Gmail) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-28] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed] R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-17] (TOSHIBA CORPORATION) [File not signed] S3 getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [33752 2008-12-01] (NOS Microsystems Ltd.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2006-11-08] (Hewlett-Packard) [File not signed] R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2006-11-08] (Hewlett-Packard) [File not signed] R3 SmartFaceVWatchSrv; C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [73728 2008-04-24] (Toshiba) [File not signed] R2 TOSHIBA SMART Log Service; c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2007-12-03] (TOSHIBA Corporation) [File not signed] R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.) [File not signed] S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-01] (AVM Berlin) [File not signed] S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [926080 2010-10-01] (AVM GmbH) S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH) S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49664 2006-04-13] (HP) [File not signed] S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2006-04-13] (HP) [File not signed] S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2006-04-13] (HP) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation) R3 odysseyIM3; C:\Windows\System32\DRIVERS\odysseyIM3.sys [62673 2003-05-14] (Funk Software, Inc.) S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.) R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [290304 2007-12-26] (Realtek Semiconductor Corporation ) R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider) R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2009-01-16] () [File not signed] S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [18432 2007-12-17] (Chicony Electronics Co., Ltd.) S3 ZD1211U(Wireless); C:\Windows\System32\DRIVERS\zd1211u.sys [247296 2004-09-29] (ZyDAS Technology Corporation) S3 cpuz134; \??\C:\Users\Marlin\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 lmimirr; system32\DRIVERS\lmimirr.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-24 17:14 - 2015-04-24 17:15 - 00021426 _____ () C:\Users\Marlin\Downloads\FRST.txt 2015-04-24 17:14 - 2015-04-24 17:14 - 01139200 _____ (Farbar) C:\Users\Marlin\Downloads\FRST (1).exe 2015-04-24 17:00 - 2015-04-24 17:00 - 00011674 _____ () C:\Users\Marlin\Documents\Unbenannt 2.odt 2015-04-24 16:53 - 2015-04-24 16:54 - 01638089 _____ () C:\Users\Marlin\Documents\Unbenannt 1.odt 2015-04-24 16:38 - 2015-04-24 16:38 - 04349362 _____ () C:\Users\Marlin\Desktop\Scannen10001.BMP 2015-04-24 16:17 - 2015-04-24 16:17 - 04349362 _____ () C:\Users\Marlin\Desktop\Scannen1.BMP 2015-04-23 21:26 - 2015-04-24 17:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-04-23 21:26 - 2015-04-23 21:26 - 00000864 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-04-23 21:26 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-04-23 21:26 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-04-23 21:26 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-04-23 21:21 - 2015-04-23 21:21 - 00002384 _____ () C:\Users\Marlin\Desktop\AdwCleaner[S1].txt 2015-04-23 21:12 - 2015-04-23 21:12 - 02224640 _____ () C:\Users\Marlin\Downloads\adwcleaner_4.202.exe 2015-04-23 20:25 - 2015-04-23 20:25 - 00001022 _____ () C:\Users\Marlin\Desktop\Revo Uninstaller.lnk 2015-04-23 20:25 - 2015-04-23 20:25 - 00000000 ____D () C:\Program Files\VS Revo Group 2015-04-22 20:04 - 2015-04-22 20:04 - 00044896 _____ () C:\Users\Marlin\Desktop\Addition.txt 2015-04-22 20:01 - 2015-04-24 17:14 - 00000000 ____D () C:\FRST 2015-04-22 19:49 - 2015-04-22 19:49 - 01139200 _____ (Farbar) C:\Users\Marlin\Downloads\FRST.exe 2015-04-21 22:21 - 2015-04-21 22:21 - 00552992 _____ () C:\Users\Marlin\Downloads\Bruderschaftsregeln - Rules of the Brotherhood.odt 2015-04-19 21:18 - 2015-04-19 21:18 - 00001629 _____ () C:\Users\Public\Desktop\iTunes.lnk 2015-04-19 21:18 - 2015-04-19 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-04-19 21:15 - 2015-04-19 21:18 - 00000000 ____D () C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB 2015-04-19 21:15 - 2015-04-19 21:18 - 00000000 ____D () C:\Program Files\iTunes 2015-04-19 21:15 - 2015-04-19 21:15 - 00000000 ____D () C:\Program Files\iPod 2015-04-18 10:49 - 2015-04-24 17:07 - 00001156 _____ () C:\Windows\PFRO.log 2015-04-17 17:51 - 2015-04-17 17:52 - 00768512 _____ (Reimage®) C:\Users\Marlin\Downloads\ReimageRepair.exe 2015-04-15 11:01 - 2015-03-09 03:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-04-15 10:51 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys 2015-04-15 10:51 - 2015-03-05 04:24 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2015-04-15 10:51 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll 2015-04-15 10:50 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-04-15 10:50 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-04-15 10:50 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-15 08:34 - 2015-04-15 08:44 - 00022457 _____ () C:\Users\Marlin\Documents\Trauerrede Emmy_1.odt 2015-04-15 08:21 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-15 08:21 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-04-15 08:21 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-15 08:21 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-15 08:21 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-15 08:21 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-04-15 08:21 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-04-15 08:21 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-04-15 08:21 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-04-15 08:21 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-04-07 10:21 - 2015-04-07 10:21 - 00026665 _____ () C:\Users\Marlin\Downloads\kalender-2014-querformat-tage-nebeneinander.xlsm 2015-04-07 10:20 - 2015-04-07 10:20 - 00051712 _____ () C:\Users\Marlin\Downloads\kalender-2014-querformat-tage-nebeneinander.xls ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-24 17:13 - 2015-01-29 04:01 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-24 17:13 - 2009-01-02 17:42 - 01160471 _____ () C:\Windows\WindowsUpdate.log 2015-04-24 17:07 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-24 17:07 - 2006-11-02 14:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-24 17:07 - 2006-11-02 14:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-24 17:04 - 2006-11-02 15:01 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-24 16:37 - 2012-04-07 19:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-24 16:34 - 2014-09-08 22:29 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA.job 2015-04-23 22:34 - 2014-09-08 22:29 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core.job 2015-04-23 21:15 - 2014-11-16 04:24 - 00000000 ____D () C:\AdwCleaner 2015-04-23 17:24 - 2012-08-19 18:28 - 00000000 ____D () C:\Users\Marlin\AppData\Roaming\Skype 2015-04-22 15:08 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2015-04-21 18:41 - 2014-09-03 15:42 - 00000000 ____D () C:\Users\Marlin\AppData\Local\Adobe 2015-04-21 18:41 - 2012-04-07 19:42 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-04-21 18:41 - 2012-04-07 19:42 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-04-20 10:11 - 2013-10-22 13:32 - 00000000 ____D () C:\ProgramData\Oracle 2015-04-20 10:10 - 2008-10-07 16:32 - 00000000 ____D () C:\Program Files\Java 2015-04-20 10:08 - 2015-01-23 01:38 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2015-04-19 21:15 - 2012-05-20 03:29 - 00000000 ____D () C:\Program Files\Common Files\Apple 2015-04-18 21:26 - 2015-03-17 16:37 - 00000892 _____ () C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job 2015-04-16 16:47 - 2009-09-18 22:24 - 00000000 ____D () C:\ProgramData\Skype 2015-04-15 11:01 - 2013-08-14 22:36 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-15 10:52 - 2006-11-02 12:24 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-04-08 14:36 - 2009-09-07 09:37 - 00000000 ____D () C:\Program Files\Opera 2015-04-07 11:50 - 2015-02-12 13:02 - 00000000 ____D () C:\Users\Marlin\Documents\Stephan 2015-04-07 08:54 - 2008-01-21 09:16 - 00006610 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-02 04:22 - 2008-10-07 17:14 - 00000000 ____D () C:\Program Files\Picasa2 ==================== Files in the root of some directories ======= 2009-03-26 18:31 - 2002-03-18 22:04 - 0021038 _____ () C:\Program Files\WinRAR Crack.exe 2009-03-26 18:31 - 2003-01-21 14:36 - 0947429 _____ () C:\Program Files\WinRAR v3.11 Deutsch.exe 2014-04-15 19:33 - 2014-04-15 19:33 - 0000045 _____ () C:\Users\Marlin\AppData\Roaming\WB.CFG 2009-01-10 22:42 - 2009-01-10 22:42 - 0000000 _____ () C:\Users\Marlin\AppData\Roaming\wklnhst.dat 2009-04-21 01:30 - 2015-02-11 20:05 - 0000680 _____ () C:\Users\Marlin\AppData\Local\d3d9caps.dat 2009-01-02 18:16 - 2013-03-06 00:28 - 0056320 _____ () C:\Users\Marlin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-06-19 12:23 - 2014-06-19 12:23 - 0000003 _____ () C:\Users\Marlin\AppData\Local\updater.log 2014-06-19 12:23 - 2014-10-09 16:19 - 0000439 _____ () C:\Users\Marlin\AppData\Local\UserProducts.xml 2009-09-18 22:27 - 2009-09-18 22:27 - 0000048 ____H () C:\ProgramData\ezsidmv.dat 2009-10-08 18:47 - 2009-10-29 13:57 - 0006185 _____ () C:\ProgramData\hpzinstall.log 2009-01-16 18:19 - 2009-08-15 12:37 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt Files to move or delete: ==================== C:\Users\Marlin\ffdshow.reg Some content of TEMP: ==================== C:\Users\Marlin\AppData\Local\Temp\jre-8u45-windows-au.exe C:\Users\Marlin\AppData\Local\Temp\Quarantine.exe C:\Users\Marlin\AppData\Local\Temp\ReimageExpressSetup.exe C:\Users\Marlin\AppData\Local\Temp\ReimagePackage.exe C:\Users\Marlin\AppData\Local\Temp\ReiSysUpdate.exe C:\Users\Marlin\AppData\Local\Temp\SkypeSetup.exe C:\Users\Marlin\AppData\Local\Temp\sqlite3.dll C:\Users\Marlin\AppData\Local\Temp\sqlite3.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-24 17:14 ==================== End Of Log ============================ --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 23-04-2015 02
Ran by Marlin at 2015-04-24 17:16:01
Running from C:\Users\Marlin\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2241634971-3471804435-397115952-500 - Administrator - Disabled)
Gast (S-1-5-21-2241634971-3471804435-397115952-501 - Limited - Disabled)
Marlin (S-1-5-21-2241634971-3471804435-397115952-1000 - Administrator - Enabled) => C:\Users\Marlin
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 1.0.0 - Hewlett-Packard) Hidden
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Amazon 1Button App (Version: 1.0.4 - Amazon) Hidden
Apple Application Support (32-Bit) (HKLM\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{A7F27ADB-3C56-0F2B-6B4B-0B8E02A49186}) (Version: 3.0.664.0 - ATI Technologies, Inc.)
AVM FRITZ!WLAN (HKLM\...\AVMWLANCLI) (Version: - AVM Berlin)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Camera Assistant Software for Toshiba (HKLM\...\{37C866E4-AA67-4725-9E95-A39968DD7960}) (Version: 1.7.193.0508L - Chicony Electronics Co.,Ltd.)
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{132CA5D9-C745-4B0B-A3B2-8C7A6EC3EE7E}) (Version: 2.4.0 - )
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{3BDDF462-8A95-4C50-86DA-4D41F3483EA5}) (Version: - )
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{943D534F-B17D-4D52-9AC4-AE8DE38D3BF4}) (Version: 2.4.0 - Canon)
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{DD929BD3-5D41-4407-BE04-119B4A631869}) (Version: - )
Canon MF4010-Serie (HKLM\...\{900A29A0-52BA-4a78-8E6C-5F4F821397CE}) (Version: - )
Catalyst Control Center - Branding (HKLM\...\{69E5255D-9D43-4CFF-8984-843ABD7753B7}) (Version: 1.00.0000 - ATI)
ccc-core-static (Version: 2008.0422.2139.36895 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CD/DVD Drive Acoustic Silencer (HKLM\...\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}) (Version: 2.02.03 - TOSHIBA)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVD MovieFactory for TOSHIBA (HKLM\...\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}) (Version: 5.51 - Ulead Systems, Inc.)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
getPlus(R) for Adobe (HKLM\...\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}) (Version: 1.5.2.35 - NOS Microsystems Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.23.0 - SaveSense) Hidden <==== ATTENTION
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Haali Media Splitter (HKLM\...\HaaliMkx) (Version: - )
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.2.0 - Conexant Systems)
iCloud (HKLM\...\{79BD66B2-4DAE-4C3B-B08E-DC72E507C163}) (Version: 2.1.3.25 - Apple Inc.)
IEEE 802.11g Wireless USB Adapter (HKLM\...\{BF0FE637-63C0-488E-8B32-5715859808F1}) (Version: - )
iTunes (HKLM\...\{CE1F04C7-79BC-4219-BE6A-BA490224D4B5}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Lightshot-5.1.4.34 (HKLM\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.1.4.34 - Skillbrains)
Magical Jelly Bean KeyFinder (HKLM\...\KeyFinder_is1) (Version: 2.0.8.2 - Magical Jelly Bean)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Windows Media Video 9 VCM (HKLM\...\WMV9_VCM) (Version: - )
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Kwik Media (HKLM\...\{C88F0D8E-3F3E-4E90-B8AA-EA24FACCFF3C}) (Version: 12.0.02200 - Nero AG)
Odyssey Client (HKLM\...\{99D42EC7-652B-4819-B3E6-6450C815E03F}) (Version: 2.00.00.00 - Funk Software)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Online-Downloaden-Toolbar (HKLM\...\{4CB51140-6359-47A2-BEB9-56A87246D0E2}) (Version: 1.0.0 - Online-Downloaden-Service Limited)
OpenOffice.org 3.1 (HKLM\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
Opera Stable 28.0.1750.51 (HKLM\...\Opera 28.0.1750.51) (Version: 28.0.1750.51 - Opera Software ASA)
PhotoScape (HKLM\...\PhotoScape) (Version: - )
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Prerequisite installer (Version: 12.0.0003 - Nero AG) Hidden
Presto! PageManager 7.15.14 (HKLM\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.14G - NewSoft)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5599 - Realtek Semiconductor Corp.)
REALTEK RTL8187B Wireless LAN Driver (HKLM\...\{895722FE-25FE-4854-95AC-B0C42F9DBEDA}) (Version: Package:1.00.0026 Driver:6.1116.1226.2007 - )
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: - Realtek Semiconductor Corp.)
Realtek WiFi Protected Setup Library (HKLM\...\{02CA24DD-C8B0-4280-BE53-7862869C2EB1}) (Version: Package:1.00.0026 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Software (HKLM\...\Samsung Mobile phone USB driver) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
ScanSoft OmniPage SE 4.0 (HKLM\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
Sicherheitsupdate für Windows Media Player (KB2845142) (HKLM\...\KB2845142_WM64) (Version: - Microsoft Corporation)
Skins (Version: 2008.0422.2139.36895 - ATI) Hidden
Skype™ 7.3 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.2.4.0 - Synaptics)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.04 - TOSHIBA)
TOSHIBA Benutzerhandbücher (HKLM\...\{1C971EE3-B4C4-4367-9676-57549919C6CE}) (Version: 7.40 - TOSHIBA)
TOSHIBA ConfigFree (HKLM\...\{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}) (Version: 7.2.13 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.0.1.3 - TOSHIBA Corporation)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 1.30.12 - TOSHIBA Corporation)
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: 1.01.00 - Toshiba)
TOSHIBA Face Recognition (HKLM\...\InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}) (Version: 2.0.2.32 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM\...\{2883F6F5-0509-43F3-868C-D50330DD9DD3}) (Version: 2.00.08 - )
Toshiba Online Product Information (HKLM\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 1.00.0012 - TOSHIBA)
TOSHIBA Recovery Disc Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.0.0.1b - TOSHIBA)
TOSHIBA Supervisor Password (HKLM\...\{4B1E87C3-00DE-4898-8E39-E390AAEF2391}) (Version: 2.00.04 - )
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.1.19 - TOSHIBA Corporation)
TRDCReminder (HKLM\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0015 - TOSHIBA)
TRDCReminder (Version: 1.00.0015 - TOSHIBA) Hidden
TRORDCLauncher (HKLM\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: 1.0.0.1 - TOSHIBA)
TRORDCLauncher (Version: 1.0.0.1 - TOSHIBA) Hidden
Unity Web Player (HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\UnityWebPlayer) (Version: 4.6.1f1 - Unity Technologies ApS)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9-Reihe (HKLM\...\Windows Media Encoder 9) (Version: - )
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{17CCA71B-ECD7-11D0-B908-00A0C9223196}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33156164-81D6-11D3-8006-00C04FA30A73}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33156168-81D6-11D3-8006-00C04FA30A73}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Marlin\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{505C2E67-8615-4CA9-9B57-48CF6EE696FD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{632B606A-BBC6-11D2-A329-006097C4E476}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{6A2E0670-28E4-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{720D4AC0-7533-11D0-A5D6-28DB04C10000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8D52AA2E-40BE-46D7-8F36-DB7B0F636824}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8E849609-C7E8-4EC7-8BD3-D55E871A340D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{A5AC04E7-3E13-48CE-A43F-9FBA59DB1544}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{AB37E6C0-194D-4C33-A924-5178414DEB98}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{AB406AAC-2B2B-11D3-B36B-00C04F6108FF}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C1AB3D89-6973-45A6-AA44-09CEBBF872E5}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C3043B13-E649-436A-9CE7-8DA8CB0BF7C8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13344-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13360-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13370-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E0-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E1-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E3-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E297AB5E-40B0-41BD-9E06-E4144084EE5F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E30629D2-27E5-11CE-875D-00608CB78066}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
14-04-2015 23:27:19 Windows Update
15-04-2015 10:45:36 Windows Update
16-04-2015 00:00:01 Geplanter Prüfpunkt
19-04-2015 20:55:07 Windows Update
21-04-2015 18:29:58 Windows Update
22-04-2015 18:36:25 Geplanter Prüfpunkt
23-04-2015 22:26:26 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {119D6E0A-51D8-4E53-8497-B389488AB9FC} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-08] (Facebook Inc.)
Task: {15A058FF-3741-48B4-A15E-E8D8EAA07623} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {1B0D0690-0FC6-4244-BE20-0DADE342975D} - System32\Tasks\{ED1CC139-58BC-40B4-8708-7FEC88EBEA13} => pcalua.exe -a C:\Users\Marlin\Downloads\sp33902(1).exe -d C:\Users\Marlin\Downloads
Task: {32E9846F-CDD6-4998-9A68-21939EA72CAC} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files\real\realplayer\Update\realsched.exe
Task: {36620D0D-C238-4894-819E-ED6542FAFB38} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {4B08F621-B025-4F95-B848-9A008DB5DBCB} - System32\Tasks\{0DEB5E1F-89FE-4937-AD25-9F5EE1996C1E} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.11.73.102.456/de/go/help.faq.installer?LastError=1618
Task: {531716D2-8677-4DB5-80B7-D8698B67B559} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {56A5AA4C-3FE4-4C2C-A22D-17A3077CB07C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {5739F407-DFB9-4E12-AD5A-2D464C1747CF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-21] (Adobe Systems Incorporated)
Task: {6B672597-DBD3-46B7-93A0-7D7F03AA091F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {704E81BD-D544-46BE-89E3-F19140D14368} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {83521EC9-12FE-4DF1-AE5E-A16FEC01FB62} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {836D53BF-7E5C-4CA4-A4B8-545CEF8A50B1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-08] (Facebook Inc.)
Task: {88BD4654-BD01-4A8B-B84D-08982E875721} - System32\Tasks\Opera scheduled Autoupdate 1404912602 => C:\Program Files\Opera\launcher.exe [2015-04-07] (Opera Software)
Task: {88C8B7A7-F710-4F62-A230-C15E5663C5F8} - System32\Tasks\{B6EF1DAE-08DA-4CBF-AFE5-F8E0515835EE} => C:\Program Files\Skype\Phone\Skype.exe [2015-03-25] (Skype Technologies S.A.)
Task: {8AD46E65-238C-4623-A94D-C4B2D7A58A0F} - System32\Tasks\Real Networks Scheduler => C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Task: {AC8CFCE7-352B-49E3-B07E-7A81BF9853A6} - System32\Tasks\4792 => Wscript.exe C:\Users\Marlin\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {BBB9EB2A-5485-4CDA-BF64-D93A516DB21F} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {BFB8C0F0-69B8-4A66-B13B-6E8D63421F64} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C21D87D7-D59D-4B76-AFDE-386000159936} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-01-29] (Google Inc.)
Task: {C32E27E4-1494-49C0-88EF-504F68BAC679} - System32\Tasks\Microsoft\Windows\RestartManager\{97BF8A5E-261D-4c7d-95A5-F8453895B2EE} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {C3F0D367-1F25-457E-930C-907BE7519E38} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-01-29] (Google Inc.)
Task: {E34440B8-3FF5-4C5C-AA91-90006325DE8A} - System32\Tasks\Opera scheduled Autoupdate 1426602758 => C:\Program Files\Opera\launcher.exe [2015-04-07] (Opera Software)
Task: {EC151374-CD77-4B44-AE63-49B079039EB1} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Marlin => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {F3553B6D-8753-4B1D-B452-E27496239505} - System32\Tasks\{CBAF1C73-D3E9-4B80-AE41-C9EB48CD6731} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe"
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core.job => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA.job => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 00126976 _____ () C:\Windows\system32\SmartFaceVCtrl.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 06701056 _____ () C:\Windows\system32\FaceHI.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 00995328 _____ () C:\Windows\system32\FaceRec.dll
2008-10-07 15:38 - 2008-04-22 22:05 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2008-03-06 11:14 - 2008-03-06 11:14 - 05121912 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2007-12-14 22:40 - 2007-12-14 22:40 - 00090112 _____ () C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
2008-10-07 16:56 - 2006-10-10 11:44 - 00009728 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2007-12-25 13:03 - 2007-12-25 13:03 - 00015184 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2006-10-07 12:57 - 2006-10-07 12:57 - 00053248 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2006-12-01 18:55 - 2006-12-01 18:55 - 00009216 _____ () C:\Program Files\Toshiba\TBS\NotifyTBS.dll
2015-02-07 14:31 - 2006-09-20 09:35 - 00020480 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
2015-02-07 14:31 - 2006-09-19 17:05 - 00024576 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
2013-12-15 09:12 - 2013-12-15 09:12 - 00138048 _____ () C:\Program Files\Amazon\Amazon1ButtonApp\AmazonExtIE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Marlin\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^IEEE 802.11g Wireless USB Adapter Utility.lnk => C:\Windows\pss\IEEE 802.11g Wireless USB Adapter Utility.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Camera Assistant Software => "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
==================== Faulty Device Manager Devices =============
Name: Microsoft-6zu4-Adapter #11
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-ISATAP-Adapter #2
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-ISATAP-Adapter #6
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (04/24/2015 05:07:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 09:18:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 08:22:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 05:23:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:26 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:26 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:12 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:12 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/23/2015 05:23:10 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (04/23/2015 09:15:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Windows Presentation Foundation-Schriftartcache 3.0.0.02
Error: (04/23/2015 09:15:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: iPod-Dienst1
Error: (04/23/2015 09:15:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Media Player-Netzwerkfreigabedienst1300001Neustart des Diensts
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: SmartFaceVWatchSrv1
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: XAudioService1
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Search1300001Neustart des Diensts
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Ulead Burning Helper1
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: TOSHIBA SMART Log Service1
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: TOSHIBA Power Saver1
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: TOSHIBA Optical Disc Drive Service1
Microsoft Office Sessions:
=========================
Error: (04/24/2015 05:07:38 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 09:18:50 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 08:22:11 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/23/2015 05:23:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES
Error: (04/23/2015 05:23:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES
Error: (04/23/2015 05:23:26 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS
Error: (04/23/2015 05:23:26 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS
Error: (04/23/2015 05:23:12 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES
Error: (04/23/2015 05:23:12 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES
Error: (04/23/2015 05:23:10 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS
CodeIntegrity Errors:
===================================
Date: 2015-04-24 17:15:39.214
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:38.324
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:37.357
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:36.421
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:35.345
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:34.378
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:33.442
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:15:32.506
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:14:59.914
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-24 17:14:58.916
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) X2 Dual-Core QL-62
Percentage of memory in use: 49%
Total physical RAM: 2813.1 MB
Available physical RAM: 1413.45 MB
Total Pagefile: 5848.7 MB
Available Pagefile: 4111.17 MB
Total Virtual: 2047.88 MB
Available Virtual: 1905.42 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:116.29 GB) (Free:40.36 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data_Recovery Laptop) (Fixed) (Total:115.13 GB) (Free:109.75 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: E43EEFE7)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=116.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=115.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 24.04.2015 Suchlauf-Zeit: 15:58:26 Logdatei: Administrator: Ja Version: 0.00.0.0000 Malware Datenbank: v2015.04.24.03 Rootkit Datenbank: v2015.04.21.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows Vista Service Pack 2 CPU: x86 Dateisystem: NTFS Benutzer: Marlin Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 318126 Verstrichene Zeit: 11 Min, 40 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Update, 24.04.2015 11:01:30, SYSTEM, MERLINS, Scheduler, Malware Database, 2015.4.23.6, 2015.4.24.1, Protection, 24.04.2015 11:01:30, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 24.04.2015 11:01:30, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 24.04.2015 11:01:31, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 24.04.2015 11:01:40, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 24.04.2015 11:01:40, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 11:01:40, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Update, 24.04.2015 12:12:19, SYSTEM, MERLINS, Scheduler, Malware Database, 2015.4.24.1, 2015.4.24.2, Protection, 24.04.2015 12:12:19, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 24.04.2015 12:12:19, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 24.04.2015 12:12:19, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 24.04.2015 12:12:29, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 24.04.2015 12:12:29, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 12:12:30, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Update, 24.04.2015 15:58:25, SYSTEM, MERLINS, Scheduler, Malware Database, 2015.4.24.2, 2015.4.24.3, Protection, 24.04.2015 15:58:25, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 24.04.2015 15:58:25, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 24.04.2015 15:58:25, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 24.04.2015 15:58:39, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 24.04.2015 15:58:39, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 15:58:39, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Scan, 24.04.2015 17:04:13, SYSTEM, MERLINS, Context, Start: 24.04.2015 02:20:42, Dauer: 11 Minuten 40 Sekunden, Bedrohungs-Suchlauf, Abgeschlossen, 0 Malwareerkennung, "2" nicht-Malwareerkennung, Protection, 24.04.2015 17:07:44, SYSTEM, MERLINS, Protection, Malware Protection, Starting, Protection, 24.04.2015 17:07:44, SYSTEM, MERLINS, Protection, Malware Protection, Started, Protection, 24.04.2015 17:07:44, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 17:07:49, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Update, 24.04.2015 18:10:03, SYSTEM, MERLINS, Scheduler, Malware Database, 2015.4.24.3, 2015.4.24.4, Protection, 24.04.2015 18:10:04, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 24.04.2015 18:10:04, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 24.04.2015 18:10:07, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 24.04.2015 18:10:59, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 24.04.2015 18:10:59, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 18:11:05, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Protection, 24.04.2015 21:13:42, SYSTEM, MERLINS, Protection, Malware Protection, Starting, Protection, 24.04.2015 21:13:42, SYSTEM, MERLINS, Protection, Malware Protection, Started, Protection, 24.04.2015 21:13:42, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 24.04.2015 21:14:56, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, (end) Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Protection, 23.04.2015 21:26:59, SYSTEM, MERLINS, Protection, Malware Protection, Starting, Protection, 23.04.2015 21:26:59, SYSTEM, MERLINS, Protection, Malware Protection, Started, Protection, 23.04.2015 21:26:59, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Update, 23.04.2015 21:27:00, SYSTEM, MERLINS, Manual, Remediation Database, 2015.3.9.1, 2015.4.22.1, Update, 23.04.2015 21:27:00, SYSTEM, MERLINS, Manual, Rootkit Database, 2015.2.25.1, 2015.4.21.1, Update, 23.04.2015 21:27:06, SYSTEM, MERLINS, Manual, Malware Database, 2015.3.9.5, 2015.4.23.5, Protection, 23.04.2015 21:27:33, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 23.04.2015 21:27:34, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Protection, 23.04.2015 21:27:34, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 23.04.2015 21:27:35, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 23.04.2015 21:27:46, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 23.04.2015 21:27:46, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 23.04.2015 21:27:46, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, Update, 23.04.2015 22:46:46, SYSTEM, MERLINS, Scheduler, Malware Database, 2015.4.23.5, 2015.4.23.6, Protection, 23.04.2015 22:46:46, SYSTEM, MERLINS, Protection, Refresh, Starting, Protection, 23.04.2015 22:46:46, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopping, Protection, 23.04.2015 22:46:46, SYSTEM, MERLINS, Protection, Malicious Website Protection, Stopped, Protection, 23.04.2015 22:47:19, SYSTEM, MERLINS, Protection, Refresh, Success, Protection, 23.04.2015 22:47:19, SYSTEM, MERLINS, Protection, Malicious Website Protection, Starting, Protection, 23.04.2015 22:47:24, SYSTEM, MERLINS, Protection, Malicious Website Protection, Started, (end) |
|
24.04.2015, 21:42
| #18 |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.B Ja, so ist es genau richtig!
__________________ Schritt 1 ESET Online Scanner
__________________ |
|
25.04.2015, 13:37
| #19 |
| | Trojan Spy: Win32/Shiotob.BCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=2a989d0663fd8c4693e3b8069c750b8f
# engine=23555
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-25 12:24:39
# local_time=2015-04-25 02:24:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 6292985 71277995 0 0
# scanned=182491
# found=56
# cleaned=0
# scan_time=7451
sh=8CA829965DEBDA7768E45E5441C3ED02D7B016C4 ft=1 fh=920e42f13ebd9031 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hbar.dll.vir"
sh=E43F9745F65433BAF40AD3465F370F9F2E535131 ft=1 fh=2b338fa56c825114 vn="Variante von Win32/Toolbar.MyWebSearch.AE evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hbarsvc.exe.vir"
sh=55B11AD38706958CF3E29B5BCADCD168A2C4C029 ft=1 fh=fe76b35afcb36b20 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hbprtct.dll.vir"
sh=1F2A692516690F940CAC2E248FD28EE516B4BB6B ft=1 fh=ed1baf6ec764ff2d vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hdatact.dll.vir"
sh=C5C2A073BF687CA94E4FD95FF1F58BB1D7AB918C ft=1 fh=a89d940fd4d22715 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hdlghk.dll.vir"
sh=15C8303F4C204B3BB21FF353787D785B7A4C7898 ft=1 fh=0924f3697e8a9339 vn="Variante von Win64/Toolbar.MyWebSearch.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hdlghk64.dll.vir"
sh=80425D8EB342D494CEBAE2F4FC7BBBFB8FEA0259 ft=1 fh=9dc72e8306e7643d vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hfeedmg.dll.vir"
sh=969954E856F4A7FF538FAFBC989668C610D38CA3 ft=1 fh=0fb950b95d748110 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hhighin.exe.vir"
sh=622A0EAF6D63BD4AC665ABE919FC2064DAAD622E ft=1 fh=d5f4bdadf4ef1b17 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hhkstub.dll.vir"
sh=348A268168A282D2396055201905AD2E42BA41FF ft=1 fh=5b7279172be564e3 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hhtmlmu.dll.vir"
sh=4999F2C13F4A415029017863E91F57965F8DB893 ft=1 fh=17e36f0e43f6cf94 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hhttpct.dll.vir"
sh=B301AC0BE9EFA6B919DC1BEBC2D91148121ED659 ft=1 fh=92d02fcdbc80ad21 vn="Variante von Win32/Toolbar.MyWebSearch.AE evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hidle.dll.vir"
sh=6A18914283455D7A001E4114589276E8D2B89236 ft=1 fh=c6b3d538d5210ab8 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hmedint.exe.vir"
sh=1DC5BC0DAA026811A28FD3BECACD43AD5B77809B ft=1 fh=c51ff9d07f71191f vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hmlbtn.dll.vir"
sh=E8C2EA7BAAB4B7E98D41A85B33B738A097BAD8A0 ft=1 fh=09209e966e800832 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hPlugin.dll.vir"
sh=0620C8527D7E08EB58A555CF50F3CAE3A29260DB ft=1 fh=3d4acf14a74dcb2d vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hregfft.dll.vir"
sh=42BF9091C84053CB7EEF430E6AE5E177EC129FB3 ft=1 fh=812914f4cb935ac1 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hreghk.dll.vir"
sh=C68C5C68ECCAC58EBEEF7C893B3D9BFDC3515C9E ft=1 fh=4db6b5d818b32eaa vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hregiet.dll.vir"
sh=DABD05807961A1FB354F15AC2D7BA35E42F0F71A ft=1 fh=92244c5e22a3f492 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hscript.dll.vir"
sh=A0EA6B1C306C342724D184D72D01F2064085D2D0 ft=1 fh=19364b21d0bb563d vn="Variante von Win32/Toolbar.MyWebSearch.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hskin.dll.vir"
sh=4E2DF0D9DF835E0D5F7B08A09484F6A3B01E036B ft=1 fh=85f82dd6c29e3902 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hskplay.exe.vir"
sh=5B0C7B3637D971B8946659385374B8F5281D5C6A ft=1 fh=72a1550ade3c7d19 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll.vir"
sh=8220CE911493A21FEC86656F53DF8F0C9EBA0234 ft=1 fh=1fa24cdbc4bd1b57 vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hSrchMn.exe.vir"
sh=A589C294B7DA31F4AEDCDEF07E8142A41FC11700 ft=1 fh=6d623bc160b7b726 vn="Variante von Win32/Toolbar.MyWebSearch.AK evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8hsrchmr.dll.vir"
sh=72489280930F183E34FE5AF817F207A5EB65F8D4 ft=1 fh=033eb58713fd33d4 vn="Variante von Win32/Toolbar.MyWebSearch.AA evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\8htpinst.dll.vir"
sh=EDDE7A90F1395BE5000987FD7FAB2F24AC47B8CD ft=1 fh=45b283f68e7f407d vn="Variante von Win32/Toolbar.MyWebSearch.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\APPINTEGRATOR.EXE.vir"
sh=5412C87E938585D8EBB668C9450F3C89881A8846 ft=1 fh=8c57b22ec92ae6cf vn="Win64/Toolbar.MyWebSearch.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\AppIntegrator64.exe.vir"
sh=6543CBF93621F59572260ABDA74E89F0E77E20F8 ft=1 fh=a25b4d022aadfbe5 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\APPINTEGRATORSTUB.DLL.vir"
sh=BE986E2A79F2153D149A15EDF50123638E4D6D36 ft=1 fh=212a616fd4ec8d2b vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\AppIntegratorStub64.dll.vir"
sh=84D3B49E7E0432D533F18D67B3BDA59D6AB356D7 ft=1 fh=5f18725ad39609cd vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\ASSISTMONITOR.DLL.vir"
sh=FAB8EC54BDC6A1467409A9F02609B32FB33DB870 ft=1 fh=686632d8dcf3703a vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\ASSISTMONITOR64.DLL.vir"
sh=72F02A910782BDF576864B00AF6EDB73BBA00486 ft=1 fh=998737e7183480e7 vn="Variante von Win32/Toolbar.MyWebSearch.Z evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\CREXT.DLL.vir"
sh=8EF7BAADB49E08791AB5E64687C61E6795C19813 ft=1 fh=85a910743dddda59 vn="Variante von Win32/Toolbar.MyWebSearch.AO evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\FF-NativeMessagingDispatcher.dll.vir"
sh=23B9415FA989D89880DA535F485B7203F41AE1CB ft=1 fh=ed84e4202059c578 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\HPG.DLL.vir"
sh=1188F60EC659BC84BFB26CDC7701D4A3F051CD57 ft=1 fh=587d9397ef77b55a vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\Hpg64.dll.vir"
sh=498CED2B9BEB320426075CFEB7DD2DB37DDF163A ft=1 fh=33ead52f3a590e2c vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\T8EPMSUP.DLL.vir"
sh=686A848121DC336D3A24774188354ADAD7FC94F0 ft=1 fh=5df2707b6d32b5df vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\T8EXTEX.DLL.vir"
sh=785703EB626A3825676E2060CC35F8D2D4056E8F ft=1 fh=49ebc55b315244f3 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\T8EXTPEX.DLL.vir"
sh=53658C05B4469AD3661EFE4D29991794928FFCF2 ft=1 fh=3ff470b42f3bb9bf vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\T8HTML.DLL.vir"
sh=15DDD8EEA2FD9660BB13D9A2D556FC801D1C9E56 ft=1 fh=909b71103900cbc9 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\T8TICKER.DLL.vir"
sh=7221646AB9D1C7F51EC46D579020E0A427DA0987 ft=1 fh=b870907bab95f235 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\TOOLBARGUARD.DLL.vir"
sh=01A474FE17792A4C919131D79937FDF7CF7E6E36 ft=1 fh=327c0c3812aea2eb vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\TOOLBARGUARD64.DLL.vir"
sh=57DB00772C3C65DDB7375591EC8A0011D5BF8734 ft=1 fh=1ec5d4c345b5f238 vn="Win32/Toolbar.MyWebSearch.AI evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\TPIMANAGERCONSOLE.EXE.vir"
sh=C4506ADCB67C3D6910B7349712082F6C88191392 ft=1 fh=9c061b618abe6013 vn="Variante von Win32/Toolbar.MyWebSearch.AC evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\VERIFY.DLL.vir"
sh=0F11F15385344A3FC77A33823FEC752C020B7DF8 ft=1 fh=b9032ec57022ef32 vn="Variante von Win32/Toolbar.MyWebSearch.AM evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\assists\ie_default_search_provider\ARBITER.DLL.vir"
sh=DDFAD70AFEB13A882D45846AC650695AA2C1D8A6 ft=1 fh=2bdde21af09a7c14 vn="Variante von Win64/Toolbar.MyWebSearch.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\assists\ie_default_search_provider\ARBITER64.DLL.vir"
sh=F17F0CF176CCB344A42CD253CC6B7F506D96D2E3 ft=1 fh=7a98b969c99b3637 vn="Variante von Win32/Toolbar.MyWebSearch.AF evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Allin1Convert_8h\bar\1.bin\assists\ie_default_search_provider\ASSIST.EXE.vir"
sh=1D92C411E960520E0146F301BEC84FB46A128566 ft=1 fh=d63b9fbf6094c8e5 vn="MSIL/DomaIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Uninstaller\Uninstall.exe.vir"
sh=9B9853DF9ADAEB96067FC4F2DCA99EBB6525F86C ft=1 fh=70883ddb3cd6f157 vn="Win32/ELEX.O evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\eSafe\_eUpdate_10.2.1.2609.exe.vir"
sh=410B32FD3FE4642644AD91AC60C69B86EC2762DD ft=1 fh=0e378a435beab91a vn="Variante von Win32/Adware.Yontoo.B Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll.vir"
sh=8796021AC742D759EB6629CFA22D23820041FB2F ft=1 fh=626734ce82a4d729 vn="Variante von Win32/Systweak.A evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Windows\system32\roboot.exe.vir"
sh=33049B804F6837579AD782694692273FFD43ED17 ft=1 fh=1b2ddb3a5e7fcade vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marlin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\89J2BGAI\ReimageExpress[1].exe"
sh=998828E003A479EEEEA46080901889D776A4DCB2 ft=1 fh=80a0a421e03a8ec0 vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marlin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ASW0JMA\ReimagePackage1814[1].exe"
sh=33049B804F6837579AD782694692273FFD43ED17 ft=1 fh=1b2ddb3a5e7fcade vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marlin\AppData\Local\Temp\ReimageExpressSetup.exe"
sh=998828E003A479EEEEA46080901889D776A4DCB2 ft=1 fh=80a0a421e03a8ec0 vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marlin\AppData\Local\Temp\ReimagePackage.exe"
sh=45E7449F1A82158B429BE44611AE49BCEFDAB6E1 ft=1 fh=dffb77abfb1a8bfc vn="Win32/ReImageRepair.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Marlin\Downloads\ReimageRepair.exe"
|
|
25.04.2015, 13:39
| #20 |
| | Trojan Spy: Win32/Shiotob.B Hallo und Grüße Dich, hier der Bericht, hoffe das passt so..... VIELEN DANK für Deine Geduld und Hilfe. |
|
25.04.2015, 17:27
| #21 |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.B Den ESET-Scan hast Du super gemacht! Es ist auch keine Malware gefunden worden. Nur Kram in der Quarantäne von Adwcleaner. Mach mal jetzt bitte noch nen Scan mit Deinem MSE ob der wieder was findet.
__________________ --> Trojan Spy: Win32/Shiotob.B |
|
26.04.2015, 16:12
| #22 |
| | Trojan Spy: Win32/Shiotob.B Hallo, Grüße Dich. Hier nun nochmal den neuen scan Bericht vom essentials; scheint, als ob der Troyaner weg wäre, oder täusche ich mich da? Wie oder wo fängt man sich so ein Ding überhaupt ein? VIELEN DANK vorab für Deine umfassende Hilfe. Stephan
__________________ Stephan Räderich  der "Dummbeutel" |
|
27.04.2015, 17:02
| #23 | |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.BZitat:
wenn Du einen Scan mit MSE machst wird nichts mehr gefunden oder? Das will ich wissen... 
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
27.04.2015, 20:09
| #24 |
| | Trojan Spy: Win32/Shiotob.B nein, es stehen nur die alten Dinger drin, die unter Quarantäne stehen. |
|
28.04.2015, 10:41
| #25 |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.B OK, dann noch zum Abschluss frische FRST-Logs bitte: Schritt 1   Bitte starte FRST erneut, markiere auch die checkbox  und drücke auf Scan. Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
28.04.2015, 11:34
| #26 |
| | Trojan Spy: Win32/Shiotob.BCode:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 27-04-2015 01
Ran by Marlin at 2015-04-28 12:25:29
Running from C:\Users\Marlin\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-2241634971-3471804435-397115952-500 - Administrator - Disabled)
Gast (S-1-5-21-2241634971-3471804435-397115952-501 - Limited - Disabled)
Marlin (S-1-5-21-2241634971-3471804435-397115952-1000 - Administrator - Enabled) => C:\Users\Marlin
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
32 Bit HP CIO Components Installer (Version: 1.0.0 - Hewlett-Packard) Hidden
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 PPAPI (HKLM\...\Adobe Flash Player PPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Amazon 1Button App (Version: 1.0.4 - Amazon) Hidden
Apple Application Support (32-Bit) (HKLM\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E1DB0812-2D60-43DB-AE09-6C7027D93B28}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ATI Catalyst Install Manager (HKLM\...\{A7F27ADB-3C56-0F2B-6B4B-0B8E02A49186}) (Version: 3.0.664.0 - ATI Technologies, Inc.)
AVM FRITZ!WLAN (HKLM\...\AVMWLANCLI) (Version: - AVM Berlin)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Camera Assistant Software for Toshiba (HKLM\...\{37C866E4-AA67-4725-9E95-A39968DD7960}) (Version: 1.7.193.0508L - Chicony Electronics Co.,Ltd.)
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{132CA5D9-C745-4B0B-A3B2-8C7A6EC3EE7E}) (Version: 2.4.0 - )
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{3BDDF462-8A95-4C50-86DA-4D41F3483EA5}) (Version: - )
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{943D534F-B17D-4D52-9AC4-AE8DE38D3BF4}) (Version: 2.4.0 - Canon)
Canon MF Toolbox 4.9.1.1.mf05 (HKLM\...\{DD929BD3-5D41-4407-BE04-119B4A631869}) (Version: - )
Canon MF4010-Serie (HKLM\...\{900A29A0-52BA-4a78-8E6C-5F4F821397CE}) (Version: - )
Catalyst Control Center - Branding (HKLM\...\{69E5255D-9D43-4CFF-8984-843ABD7753B7}) (Version: 1.00.0000 - ATI)
ccc-core-static (Version: 2008.0422.2139.36895 - Ihr Firmenname) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
CD/DVD Drive Acoustic Silencer (HKLM\...\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}) (Version: 2.02.03 - TOSHIBA)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Dropbox (HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Dropbox) (Version: 2.10.52 - Dropbox, Inc.)
DVD MovieFactory for TOSHIBA (HKLM\...\{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}) (Version: 5.51 - Ulead Systems, Inc.)
ElsterFormular (HKLM\...\ElsterFormular) (Version: 16.0.20150211 - Landesfinanzdirektion Thüringen)
Facebook Video Calling 3.1.0.521 (HKLM\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
getPlus(R) for Adobe (HKLM\...\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}) (Version: 1.5.2.35 - NOS Microsystems Ltd.)
Google Chrome (HKLM\...\Google Chrome) (Version: 42.0.2311.90 - Google Inc.)
Google Earth (HKLM\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.23.0 - SaveSense) Hidden <==== ATTENTION
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Haali Media Splitter (HKLM\...\HaaliMkx) (Version: - )
HDAUDIO Soft Data Fax Modem with SmartCP (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.2.0 - Conexant Systems)
iCloud (HKLM\...\{79BD66B2-4DAE-4C3B-B08E-DC72E507C163}) (Version: 2.1.3.25 - Apple Inc.)
IEEE 802.11g Wireless USB Adapter (HKLM\...\{BF0FE637-63C0-488E-8B32-5715859808F1}) (Version: - )
iTunes (HKLM\...\{CE1F04C7-79BC-4219-BE6A-BA490224D4B5}) (Version: 12.1.2.27 - Apple Inc.)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Lightshot-5.1.4.34 (HKLM\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.1.4.34 - Skillbrains)
Magical Jelly Bean KeyFinder (HKLM\...\KeyFinder_is1) (Version: 2.0.8.2 - Magical Jelly Bean)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM\...\{4fcf070a-daac-45e9-a8b0-6850941f7ed8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Windows Media Video 9 VCM (HKLM\...\WMV9_VCM) (Version: - )
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero Kwik Media (HKLM\...\{C88F0D8E-3F3E-4E90-B8AA-EA24FACCFF3C}) (Version: 12.0.02200 - Nero AG)
Odyssey Client (HKLM\...\{99D42EC7-652B-4819-B3E6-6450C815E03F}) (Version: 2.00.00.00 - Funk Software)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
Online-Downloaden-Toolbar (HKLM\...\{4CB51140-6359-47A2-BEB9-56A87246D0E2}) (Version: 1.0.0 - Online-Downloaden-Service Limited)
OpenOffice.org 3.1 (HKLM\...\{D765F1CE-5AE5-4C47-B134-AE58AC474740}) (Version: 3.1.9420 - OpenOffice.org)
Opera Stable 29.0.1795.47 (HKLM\...\Opera 29.0.1795.47) (Version: 29.0.1795.47 - Opera Software ASA)
PhotoScape (HKLM\...\PhotoScape) (Version: - )
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Prerequisite installer (Version: 12.0.0003 - Nero AG) Hidden
Presto! PageManager 7.15.14 (HKLM\...\{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}) (Version: 7.15.14G - NewSoft)
QuickTime 7 (HKLM\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek 8169 8168 8101E 8102E Ethernet Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5599 - Realtek Semiconductor Corp.)
REALTEK RTL8187B Wireless LAN Driver (HKLM\...\{895722FE-25FE-4854-95AC-B0C42F9DBEDA}) (Version: Package:1.00.0026 Driver:6.1116.1226.2007 - )
Realtek USB 2.0 Card Reader (HKLM\...\{DC24971E-1946-445D-8A82-CE685433FA7D}) (Version: - Realtek Semiconductor Corp.)
Realtek WiFi Protected Setup Library (HKLM\...\{02CA24DD-C8B0-4280-BE53-7862869C2EB1}) (Version: Package:1.00.0026 - REALTEK Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
SAMSUNG Mobile Modem Driver Set (HKLM\...\SAMSUNG Mobile Modem) (Version: - )
Samsung Mobile phone USB driver Software (HKLM\...\Samsung Mobile phone USB driver) (Version: - )
SAMSUNG Mobile USB Modem 1.0 Software (HKLM\...\SAMSUNG Mobile USB Modem 1.0) (Version: - )
SAMSUNG Mobile USB Modem Software (HKLM\...\SAMSUNG Mobile USB Modem) (Version: - )
ScanSoft OmniPage SE 4.0 (HKLM\...\{C1E693A4-B1D5-4DCD-B68D-2087835B7184}) (Version: 15.00.0020 - Nuance Communications, Inc.)
Sicherheitsupdate für Windows Media Player (KB2845142) (HKLM\...\KB2845142_WM64) (Version: - Microsoft Corporation)
Skins (Version: 2008.0422.2139.36895 - ATI) Hidden
Skype™ 7.3 (HKLM\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.2.4.0 - Synaptics)
TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.04 - TOSHIBA)
TOSHIBA Benutzerhandbücher (HKLM\...\{1C971EE3-B4C4-4367-9676-57549919C6CE}) (Version: 7.40 - TOSHIBA)
TOSHIBA ConfigFree (HKLM\...\{0D5D0BEE-FBA9-4928-A50D-6CDFAB827755}) (Version: 7.2.13 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.0.1.3 - TOSHIBA Corporation)
TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 1.30.12 - TOSHIBA Corporation)
TOSHIBA Extended Tiles for Windows Mobility Center (HKLM\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: 1.01.00 - Toshiba)
TOSHIBA Face Recognition (HKLM\...\InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}) (Version: 2.0.2.32 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (HKLM\...\{2883F6F5-0509-43F3-868C-D50330DD9DD3}) (Version: 2.00.08 - )
Toshiba Online Product Information (HKLM\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 1.00.0012 - TOSHIBA)
TOSHIBA Recovery Disc Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.0.0.1b - TOSHIBA)
TOSHIBA Supervisor Password (HKLM\...\{4B1E87C3-00DE-4898-8E39-E390AAEF2391}) (Version: 2.00.04 - )
TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.1.19 - TOSHIBA Corporation)
TRDCReminder (HKLM\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0015 - TOSHIBA)
TRDCReminder (Version: 1.00.0015 - TOSHIBA) Hidden
TRORDCLauncher (HKLM\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: 1.0.0.1 - TOSHIBA)
TRORDCLauncher (Version: 1.0.0.1 - TOSHIBA) Hidden
Unity Web Player (HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\UnityWebPlayer) (Version: 4.6.1f1 - Unity Technologies ApS)
Windows Live Anmelde-Assistent (HKLM\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Encoder 9-Reihe (HKLM\...\Windows Media Encoder 9) (Version: - )
WinRAR 4.20 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{17CCA71B-ECD7-11D0-B908-00A0C9223196}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{1FD1FE74-9E3C-4C1C-AEEB-AAB592AD770F}\localserver32 -> C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33156164-81D6-11D3-8006-00C04FA30A73}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33156168-81D6-11D3-8006-00C04FA30A73}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{33D9A762-90C8-11D0-BD43-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Marlin\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{505C2E67-8615-4CA9-9B57-48CF6EE696FD}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{5E71E4F3-E8C7-4906-9626-973E418762B6}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Facebook\Update\1.2.205.0\goopdate.dll (Facebook Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{632B606A-BBC6-11D2-A329-006097C4E476}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{6A2E0670-28E4-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{720D4AC0-7533-11D0-A5D6-28DB04C10000}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8B9F5BF4-0407-4BB2-9FED-4C0372DABD00}\localserver32 -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\FacebookVideoCallingProxy.exe (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8D52AA2E-40BE-46D7-8F36-DB7B0F636824}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{8E849609-C7E8-4EC7-8BD3-D55E871A340D}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Google\Update\1.3.22.3\psuser.dll No File
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{A5AC04E7-3E13-48CE-A43F-9FBA59DB1544}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{AB37E6C0-194D-4C33-A924-5178414DEB98}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{AB406AAC-2B2B-11D3-B36B-00C04F6108FF}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C1AB3D89-6973-45A6-AA44-09CEBBF872E5}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C3043B13-E649-436A-9CE7-8DA8CB0BF7C8}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13344-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13360-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{C6E13370-30AC-11D0-A18C-00A0C9118956}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CBE9C57E-FFA9-4123-8354-AD360D6DD3CC}\InprocServer32 -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CDA42200-BD88-11D0-BD4E-00A0C911CE86}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{CFC399AF-D876-11D0-9C10-00C04FC99C8E}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E0-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E1-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{DF0AD8E3-F91C-4109-AE46-1EAA5CD8AB08}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E297AB5E-40B0-41BD-9E06-E4144084EE5F}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E30629D2-27E5-11CE-875D-00608CB78066}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{E436EBB3-524F-11CE-9F53-0020AF0BA770}\InprocServer32 -> No File Path
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2241634971-3471804435-397115952-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Marlin\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
==================== Restore Points =========================
19-04-2015 20:55:07 Windows Update
21-04-2015 18:29:58 Windows Update
22-04-2015 18:36:25 Geplanter Prüfpunkt
23-04-2015 22:26:26 Geplanter Prüfpunkt
24-04-2015 17:48:08 Geplanter Prüfpunkt
25-04-2015 23:53:55 Geplanter Prüfpunkt
26-04-2015 10:49:16 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {119D6E0A-51D8-4E53-8497-B389488AB9FC} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-08] (Facebook Inc.)
Task: {15A058FF-3741-48B4-A15E-E8D8EAA07623} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {1B0D0690-0FC6-4244-BE20-0DADE342975D} - System32\Tasks\{ED1CC139-58BC-40B4-8708-7FEC88EBEA13} => pcalua.exe -a C:\Users\Marlin\Downloads\sp33902(1).exe -d C:\Users\Marlin\Downloads
Task: {32E9846F-CDD6-4998-9A68-21939EA72CAC} - System32\Tasks\Real Player-Online-Aktualisierungsprogramm => c:\program files\real\realplayer\Update\realsched.exe
Task: {36620D0D-C238-4894-819E-ED6542FAFB38} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {4B08F621-B025-4F95-B848-9A008DB5DBCB} - System32\Tasks\{0DEB5E1F-89FE-4937-AD25-9F5EE1996C1E} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.11.73.102.456/de/go/help.faq.installer?LastError=1618
Task: {531716D2-8677-4DB5-80B7-D8698B67B559} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {56A5AA4C-3FE4-4C2C-A22D-17A3077CB07C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {5739F407-DFB9-4E12-AD5A-2D464C1747CF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-21] (Adobe Systems Incorporated)
Task: {6B672597-DBD3-46B7-93A0-7D7F03AA091F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {704E81BD-D544-46BE-89E3-F19140D14368} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {83521EC9-12FE-4DF1-AE5E-A16FEC01FB62} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {836D53BF-7E5C-4CA4-A4B8-545CEF8A50B1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-09-08] (Facebook Inc.)
Task: {88BD4654-BD01-4A8B-B84D-08982E875721} - System32\Tasks\Opera scheduled Autoupdate 1404912602 => C:\Program Files\Opera\launcher.exe [2015-04-17] (Opera Software)
Task: {88C8B7A7-F710-4F62-A230-C15E5663C5F8} - System32\Tasks\{B6EF1DAE-08DA-4CBF-AFE5-F8E0515835EE} => C:\Program Files\Skype\Phone\Skype.exe [2015-03-25] (Skype Technologies S.A.)
Task: {8AD46E65-238C-4623-A94D-C4B2D7A58A0F} - System32\Tasks\Real Networks Scheduler => C:\Program Files\Common Files\Real\Update_OB\realsched.exe
Task: {8FFB10DE-FF4D-4186-A69C-B3C3B2C4CCCB} - System32\Tasks\Opera scheduled Autoupdate 1426602758 => C:\Program Files\Opera\launcher.exe [2015-04-17] (Opera Software)
Task: {AC8CFCE7-352B-49E3-B07E-7A81BF9853A6} - System32\Tasks\4792 => Wscript.exe C:\Users\Marlin\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {BBB9EB2A-5485-4CDA-BF64-D93A516DB21F} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {BCC2AA89-AF31-4A8A-8079-9B7D40C31CB8} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Marlin => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {BFB8C0F0-69B8-4A66-B13B-6E8D63421F64} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2241634971-3471804435-397115952-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C21D87D7-D59D-4B76-AFDE-386000159936} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-01-29] (Google Inc.)
Task: {C32E27E4-1494-49C0-88EF-504F68BAC679} - System32\Tasks\Microsoft\Windows\RestartManager\{97BF8A5E-261D-4c7d-95A5-F8453895B2EE} => C:\Windows\system32\rmclient.exe [2006-11-02] (Microsoft Corporation)
Task: {C3F0D367-1F25-457E-930C-907BE7519E38} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2015-01-29] (Google Inc.)
Task: {F3553B6D-8753-4B1D-B452-E27496239505} - System32\Tasks\{CBAF1C73-D3E9-4B80-AE41-C9EB48CD6731} => pcalua.exe -a "C:\Program Files\WinRAR\WinRAR.exe"
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\Windows\system32\Macromed\Flash\FlashUtil32_17_0_0_169_pepper.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core.job => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA.job => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 01044776 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 00126976 _____ () C:\Windows\system32\SmartFaceVCtrl.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 06701056 _____ () C:\Windows\system32\FaceHI.dll
2008-04-24 19:25 - 2008-04-24 19:25 - 00995328 _____ () C:\Windows\system32\FaceRec.dll
2008-02-04 13:29 - 2008-02-04 13:29 - 00688128 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
2008-10-07 15:38 - 2008-04-22 22:05 - 00159744 _____ () C:\Windows\system32\atitmmxx.dll
2008-03-06 11:14 - 2008-03-06 11:14 - 05121912 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2007-12-14 22:40 - 2007-12-14 22:40 - 00090112 _____ () C:\Program Files\TOSHIBA\FlashCards\TWarnMsg\TWarnMsg.dll
2008-10-07 16:56 - 2006-10-10 11:44 - 00009728 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll
2007-12-25 13:03 - 2007-12-25 13:03 - 00015184 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll
2006-10-07 12:57 - 2006-10-07 12:57 - 00053248 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2006-12-01 18:55 - 2006-12-01 18:55 - 00009216 _____ () C:\Program Files\Toshiba\TBS\NotifyTBS.dll
2015-02-07 14:31 - 2006-09-20 09:35 - 00020480 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe
2015-02-07 14:31 - 2006-09-19 17:05 - 00024576 _____ () C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe
2013-12-15 09:12 - 2013-12-15 09:12 - 00138048 _____ () C:\Program Files\Amazon\Amazon1ButtonApp\AmazonExtIE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Marlin\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^IEEE 802.11g Wireless USB Adapter Utility.lnk => C:\Windows\pss\IEEE 802.11g Wireless USB Adapter Utility.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: APSDaemon => "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Camera Assistant Software => "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
MSCONFIG\startupreg: ehTray.exe => C:\Windows\ehome\ehTray.exe
MSCONFIG\startupreg: msnmsgr => "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: swg => "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
==================== FirewallRules (whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [WinCollab-Out-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-UDP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-Out-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-In-TCP] => (Allow) %ProgramFiles%\Windows Collaboration\WinCollab.exe
FirewallRules: [WinCollab-DFSR-Out-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [WinCollab-DFSR-In-TCP] => (Allow) %SystemRoot%\system32\dfsr.exe
FirewallRules: [{C786E089-F5BF-41AA-BE4B-A7C8A6C50883}] => (Allow) C:\Program Files\Opera\opera.exe
FirewallRules: [{BD472EAF-CBAC-42CB-AD4F-43C1061649FB}] => (Allow) C:\Program Files\Opera\opera.exe
FirewallRules: [{3A366C6C-4611-4DC5-BA7F-D95CE6AA966F}] => (Allow) LPort=80
FirewallRules: [{0A1E5946-67FB-4D6A-AE32-404807D31394}] => (Allow) LPort=80
FirewallRules: [{CF10172C-2FB1-411B-A1D5-25212FE7E873}] => (Allow) LPort=80
FirewallRules: [TCP Query User{610099C2-E2EF-4ED6-A5FA-47E1914E3E85}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{52259442-0902-47B2-BE98-5A636A27CD01}C:\program files\internet explorer\iexplore.exe] => (Allow) C:\program files\internet explorer\iexplore.exe
FirewallRules: [{D628E642-F12E-4802-8EEC-380EF0B275AD}] => (Allow) C:\Program Files\Opera\opera.exe
FirewallRules: [{1C2EAF79-BD53-4EF9-8D1A-071176D1444F}] => (Allow) C:\Program Files\Opera\opera.exe
FirewallRules: [{F9D38A1D-E58B-4C3B-BFB6-3180FAE4679A}] => (Allow) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{651852BF-F2C9-42EA-9E87-390C68A9E5DF}] => (Allow) C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{3F06C1B9-5FE2-498E-8196-0049E40A9FFA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{FF3C8DC9-F839-429D-8ABE-D646DA8B5AD1}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{79E8E754-712D-4DCA-AEAA-069C9CA27376}] => (Allow) C:\Program Files\Nero\KM\KwikMedia.exe
FirewallRules: [{229B4CE0-82D8-41C9-B2AB-CAA3B9400750}] => (Allow) C:\Program Files\Nero\KM\KwikMedia.exe
FirewallRules: [TCP Query User{7253E231-B1C9-42D7-ABF1-F87AD0210611}C:\users\marlin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\marlin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{77A79768-5BCB-4FD4-A8CF-32D45FEA4D64}C:\users\marlin\appdata\roaming\dropbox\bin\dropbox.exe] => (Block) C:\users\marlin\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{0570B7D2-7354-4C62-9B78-CC4348601E6E}] => (Allow) C:\Users\Marlin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{D993F98E-7146-4D7E-9DEB-FCB5DF9C8C67}] => (Allow) C:\Users\Marlin\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{EC894C07-8721-4555-9DB8-2D81BE88323D}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{6A312127-575F-4572-B111-E0D071998EF4}] => (Allow) C:\ProgramData\eSafe\eGdpSvc.exe
FirewallRules: [{4630980D-ACF6-473E-9940-6E8F29844006}] => (Allow) C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{55DBFC3C-78D0-42B8-ABB7-9550650549D5}] => (Allow) C:\Program Files\Skype\Phone\Skype.exe
FirewallRules: [{E0CBE839-3FB1-4E07-9C40-52664DABE2F5}] => (Allow) C:\Program Files\Google\Chrome\Application\chrome.exe
FirewallRules: [{D22B7378-BB19-4A17-94C4-1E5E6C3A87C9}] => (Allow) C:\Program Files\iTunes\iTunes.exe
==================== Faulty Device Manager Devices =============
Name: Microsoft-6zu4-Adapter #11
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-ISATAP-Adapter #2
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
Name: Microsoft-ISATAP-Adapter #6
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (04/28/2015 00:11:01 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT-AUTORITÄT)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.
Error: (04/28/2015 00:11:01 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT-AUTORITÄT)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.
Error: (04/28/2015 00:09:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/27/2015 10:45:55 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:55 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:43 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:43 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:20 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:20 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
Error: (04/27/2015 10:45:17 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Eintrag <C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS> in der Hash-Zuordnung kann nicht aktualisiert werden.
Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
System errors:
=============
Error: (04/27/2015 09:21:15 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: 0x80070643Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.197.758.0){C3EF3006-355A-4FAE-A5F0-CF78C2013B44}201
Error: (04/27/2015 09:20:15 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.197.699.0
Aktualisierungsquelle: %NT-AUTORITÄT59
Aktualisierungsphase: 4.7.0205.00
Quellpfad: 4.7.0205.01
Signaturtyp: %NT-AUTORITÄT602
Aktualisierungstyp: %NT-AUTORITÄT604
Benutzer: NT-AUTORITÄT\SYSTEM
Aktuelle Modulversion: %NT-AUTORITÄT605
Vorherige Modulversion: %NT-AUTORITÄT606
Fehlercode: %NT-AUTORITÄT607
Fehlerbeschreibung: %NT-AUTORITÄT608
Error: (04/26/2015 05:12:52 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWFailureCommand%%5
Error: (04/26/2015 05:12:45 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: ScRegSetValueExWStart%%5
Error: (04/25/2015 00:10:52 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000Spooler
Error: (04/25/2015 00:10:52 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: 30000MBAMService
Error: (04/23/2015 09:15:38 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Windows Presentation Foundation-Schriftartcache 3.0.0.02
Error: (04/23/2015 09:15:37 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: iPod-Dienst1
Error: (04/23/2015 09:15:37 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Windows Media Player-Netzwerkfreigabedienst1300001Neustart des Diensts
Error: (04/23/2015 09:15:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: SmartFaceVWatchSrv1
Microsoft Office Sessions:
=========================
Error: (04/28/2015 00:11:01 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT-AUTORITÄT)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.(NULL)(NULL)(NULL)(NULL)
Error: (04/28/2015 00:11:01 PM) (Source: MsiInstaller) (EventID: 11606) (User: NT-AUTORITÄT)
Description: Product: Adobe Refresh Manager -- Error 1606.Could not access network location %APPDATA%\.(NULL)(NULL)(NULL)(NULL)
Error: (04/28/2015 00:09:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (04/27/2015 10:45:55 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES
Error: (04/27/2015 10:45:55 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\LANGUAGES
Error: (04/27/2015 10:45:43 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS
Error: (04/27/2015 10:45:43 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\JS
Error: (04/27/2015 10:45:20 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES
Error: (04/27/2015 10:45:20 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\IMAGES
Error: (04/27/2015 10:45:17 PM) (Source: Windows Search Service) (EventID: 3013) (User: )
Description: Kontext: Anwendung, SystemIndex Katalog
Details:
Ein an das System angeschlossenes Gerät funktioniert nicht. (0x8007001f)
C:\USERS\MARLIN\APPDATA\LOCAL\SKYPE\APPS\LOGIN\FONTS
CodeIntegrity Errors:
===================================
Date: 2015-04-28 12:25:36.570
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:34.386
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:33.387
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:32.404
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:31.390
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:30.361
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:20.689
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:19.753
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:18.801
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-04-28 12:25:17.694
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: AMD Athlon(tm) X2 Dual-Core QL-62
Percentage of memory in use: 41%
Total physical RAM: 2813.1 MB
Available physical RAM: 1657.47 MB
Total Pagefile: 5844.7 MB
Available Pagefile: 4475.32 MB
Total Virtual: 2047.88 MB
Available Virtual: 1909.42 MB
==================== Drives ================================
Drive c: (Vista) (Fixed) (Total:116.29 GB) (Free:41.55 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (Data_Recovery Laptop) (Fixed) (Total:115.13 GB) (Free:109.75 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: E43EEFE7)
Partition 1: (Not Active) - (Size=1.5 GB) - (Type=27)
Partition 2: (Active) - (Size=116.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=115.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
ÖP´ßäúuuuuu78moooooooooooooooooooooooooooooooooooooooooo. FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-04-2015 01 Ran by Marlin (administrator) on MERLINS on 28-04-2015 12:24:27 Running from C:\Users\Marlin\Downloads Loaded Profiles: Marlin (Available profiles: Marlin) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland) Internet Explorer Version 9 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (AVM Berlin) C:\Program Files\avmwlanstick\WLanNetService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe (Nero AG) C:\Program Files\Nero\Update\NASvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe (Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Conexant Systems, Inc.) C:\Windows\System32\drivers\XAudio.exe (Toshiba) C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe (Malwarebytes Corporation) C:\Program Files\ Malwarebytes Anti-Malware \mbam.exe (Google Inc.) C:\Program Files\Google\Update\1.3.26.9\GoogleCrashHandler.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ScanSoft, Inc.) C:\Program Files\ScanSoft\OmniPageSE4.0\OpWareSE4.exe () C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Skillbrains) C:\Users\Marlin\AppData\Local\Skillbrains\lightshot\5.1.4.34\Lightshot.exe () C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-01-21] (Advanced Micro Devices, Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6037504 2008-04-08] (Realtek Semiconductor) HKLM\...\Run: [NDSTray.exe] => NDSTray.exe HKLM\...\Run: [cfFncEnabler.exe] => cfFncEnabler.exe HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [431456 2008-01-17] (TOSHIBA Corporation) HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [54608 2007-10-31] (TOSHIBA Corporation) HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [509816 2008-01-25] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [716800 2008-03-19] (TOSHIBA Corporation) HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [AVMWlanClient] => C:\Program Files\avmwlanstick\wlangui.exe [2105344 2010-10-22] (AVM Berlin) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-03-20] (Apple Inc.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [978520 2015-01-30] (Microsoft Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1348904 2008-08-14] (Synaptics, Inc.) HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [185896 2006-09-28] (Nuance Communications, Inc.) HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe [75304 2006-10-11] (ScanSoft, Inc.) HKLM\...\Run: [WrtMon.exe] => C:\Windows\system32\spool\drivers\w32x86\3\WrtMon.exe [20480 2006-09-20] () HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157480 2015-04-07] (Apple Inc.) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [LightShot] => C:\Users\Marlin\AppData\Local\Skillbrains\lightshot\Lightshot.exe [226560 2014-06-18] () HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [Facebook Update] => C:\Users\Marlin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-09-08] (Facebook Inc.) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [defowin] => C:\Users\Marlin\AppData\Roaming\defowin.lnk [613 2015-04-26] () HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\RunOnce: [Adobe Speed Launcher] => 1430215862 HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {10a2aea9-2430-11e1-bfcb-bcb96134645e} - D:\pushinst.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cba7-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cbce-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {3139cbf0-4a53-11df-aa23-ff843c67ac91} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {e0ea989b-5b57-11e3-8093-a0b371b526af} - D:\pushinst.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\MountPoints2: {f19b05e5-4af4-11df-9e29-ae976310cd93} - D:\AutoRun.exe HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Aurora.scr [1370624 2008-01-21] (Microsoft Corporation) AppInit_DLLs: C:\PROGRA~1\Amazon\AMAZON~1\\AMAZON~1.DLL => C:\Program Files\Amazon\Amazon1ButtonApp\\AmazonExtIE.dll [138048 2013-12-15] () Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2008-10-07] ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2008-10-07] ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEE&bmod=TSEE HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TSEE&bmod=TSEE; HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> DefaultScope {9D768E64-B834-4E9D-AA51-9BDEB1C1719D} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> {9D768E64-B834-4E9D-AA51-9BDEB1C1719D} URL = https://www.google.com/search?q={searchTerms} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation) BHO: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation) BHO: Online_Downloaden_Toolbar -> {f6e6051c-0d37-44e3-8855-2308b314f6c2} -> C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] () Toolbar: HKLM - Online_Downloaden_Toolbar - {40090c1a-85c9-419d-b493-6119f95d97a4} - C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] () Toolbar: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Marlin\AppData\Roaming\Mozilla\Firefox\Profiles\bfpcejxh.default-1416090229181 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] () FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google) FF Plugin: @google.com/npPicasa2,version=2.0.0 -> C:\Program Files\Picasa2\npPicasa2.dll [2008-08-21] (Google, Inc.) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Picasa2\npPicasa3.dll [2015-02-13] (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @Nero.com/KM -> C:\PROGRA~1\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2012-10-25] (Nero AG) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2241634971-3471804435-397115952-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Marlin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-2241634971-3471804435-397115952-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Marlin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-12-05] (Unity Technologies ApS) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-03-26] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR Profile: C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-28] CHR Extension: (Google Docs) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-28] CHR Extension: (Google Drive) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-28] CHR Extension: (YouTube) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-28] CHR Extension: (Google Search) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-28] CHR Extension: (Google Sheets) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-28] CHR Extension: (Bookmark Manager) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-21] CHR Extension: (Heavenly Cross) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kepdlccjceknhloddohpnmciihblkann [2015-02-28] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-15] CHR Extension: (Google Wallet) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-03-07] CHR Extension: (Gmail) - C:\Users\Marlin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-28] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [376832 2010-10-22] (AVM Berlin) [File not signed] R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2008-04-17] (TOSHIBA CORPORATION) [File not signed] S3 getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [33752 2008-12-01] (NOS Microsystems Ltd.) R2 MBAMScheduler; C:\Program Files\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22184 2015-01-30] (Microsoft Corporation) R2 NAUpdate; C:\Program Files\Nero\Update\NASvc.exe [769432 2012-07-13] (Nero AG) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [43520 2006-11-08] (Hewlett-Packard) [File not signed] S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [284472 2015-01-30] (Microsoft Corporation) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53248 2006-11-08] (Hewlett-Packard) [File not signed] R3 SmartFaceVWatchSrv; C:\Program Files\TOSHIBA\SmartFaceV\SmartFaceVWatchSrv.exe [73728 2008-04-24] (Toshiba) [File not signed] R2 TOSHIBA SMART Log Service; c:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [126976 2007-12-03] (TOSHIBA Corporation) [File not signed] R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-23] (Ulead Systems, Inc.) [File not signed] S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2010-10-01] (AVM Berlin) [File not signed] S3 fwlanusb4; C:\Windows\System32\DRIVERS\fwlanusb4.sys [926080 2010-10-01] (AVM GmbH) S3 fwlanusbn; C:\Windows\System32\DRIVERS\fwlanusbn.sys [586752 2010-10-22] (AVM GmbH) S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49664 2006-04-13] (HP) [File not signed] S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2006-04-13] (HP) [File not signed] S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2006-04-13] (HP) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-28] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-04-14] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [239224 2014-11-15] (Microsoft Corporation) R3 odysseyIM3; C:\Windows\System32\DRIVERS\odysseyIM3.sys [62673 2003-05-14] (Funk Software, Inc.) S3 RTHDMIAzAudService; C:\Windows\System32\drivers\RtHDMIV.sys [141408 2008-02-27] (Realtek Semiconductor Corp.) R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [290304 2007-12-26] (Realtek Semiconductor Corporation ) R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows (R) Codename Longhorn DDK provider) R1 StarOpen; C:\Windows\system32\Drivers\StarOpen.sys [5632 2009-01-16] () [File not signed] S3 USBAAPL; C:\Windows\System32\Drivers\usbaapl.sys [45056 2012-12-13] (Apple, Inc.) [File not signed] R3 UVCFTR; C:\Windows\System32\Drivers\UVCFTR_S.SYS [18432 2007-12-17] (Chicony Electronics Co., Ltd.) S3 ZD1211U(Wireless); C:\Windows\System32\DRIVERS\zd1211u.sys [247296 2004-09-29] (ZyDAS Technology Corporation) S3 cpuz134; \??\C:\Users\Marlin\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 lmimirr; system32\DRIVERS\lmimirr.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-28 12:24 - 2015-04-28 12:24 - 00000000 ____D () C:\Users\Marlin\Downloads\FRST-OlderVersion 2015-04-28 12:10 - 2015-04-28 12:11 - 00000000 ____D () C:\Users\Marlin\Desktop\Trojaner 04.15 2015-04-26 19:42 - 2015-04-26 19:42 - 00245760 _____ (Marin Software) C:\Users\Marlin\AppData\Roaming\defowin.exe 2015-04-26 19:42 - 2015-04-26 19:42 - 00000613 _____ () C:\Users\Marlin\AppData\Roaming\defowin.lnk 2015-04-25 14:29 - 2015-04-25 14:29 - 00008668 _____ () C:\Users\Marlin\Downloads\EET.txt 2015-04-25 12:17 - 2015-04-25 12:17 - 02347384 _____ (ESET) C:\Users\Marlin\Downloads\esetsmartinstaller_deu.exe 2015-04-24 17:18 - 2015-04-24 17:18 - 00044091 _____ () C:\Users\Marlin\Downloads\Addition2.txt 2015-04-24 17:16 - 2015-04-24 17:17 - 00044091 _____ () C:\Users\Marlin\Downloads\Addition.txt 2015-04-24 17:14 - 2015-04-28 12:25 - 00021305 _____ () C:\Users\Marlin\Downloads\FRST.txt 2015-04-24 17:00 - 2015-04-24 17:00 - 00011674 _____ () C:\Users\Marlin\Documents\Unbenannt 2.odt 2015-04-24 16:53 - 2015-04-24 16:54 - 01638089 _____ () C:\Users\Marlin\Documents\Unbenannt 1.odt 2015-04-23 21:26 - 2015-04-28 12:09 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-04-23 21:26 - 2015-04-23 21:26 - 00000864 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-04-23 21:26 - 2015-04-23 21:26 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 2015-04-23 21:26 - 2015-04-14 09:37 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-04-23 21:26 - 2015-04-14 09:37 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-04-23 21:26 - 2015-04-14 09:37 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-04-23 21:12 - 2015-04-23 21:12 - 02224640 _____ () C:\Users\Marlin\Downloads\adwcleaner_4.202.exe 2015-04-23 20:25 - 2015-04-23 20:25 - 00001022 _____ () C:\Users\Marlin\Desktop\Revo Uninstaller.lnk 2015-04-23 20:25 - 2015-04-23 20:25 - 00000000 ____D () C:\Program Files\VS Revo Group 2015-04-22 20:01 - 2015-04-28 12:24 - 00000000 ____D () C:\FRST 2015-04-22 19:49 - 2015-04-28 12:24 - 01140736 _____ (Farbar) C:\Users\Marlin\Downloads\FRST.exe 2015-04-21 22:21 - 2015-04-21 22:21 - 00552992 _____ () C:\Users\Marlin\Downloads\Bruderschaftsregeln - Rules of the Brotherhood.odt 2015-04-19 21:18 - 2015-04-19 21:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-04-19 21:15 - 2015-04-19 21:18 - 00000000 ____D () C:\ProgramData\B0FFCDD9-5261-4e59-B29A-17A4FABDEBAB 2015-04-19 21:15 - 2015-04-19 21:18 - 00000000 ____D () C:\Program Files\iTunes 2015-04-19 21:15 - 2015-04-19 21:15 - 00000000 ____D () C:\Program Files\iPod 2015-04-17 17:51 - 2015-04-17 17:52 - 00768512 _____ (Reimage®) C:\Users\Marlin\Downloads\ReimageRepair.exe 2015-04-15 11:01 - 2015-03-09 03:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-04-15 10:51 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys 2015-04-15 10:51 - 2015-03-05 04:24 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2015-04-15 10:51 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll 2015-04-15 10:50 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-04-15 10:50 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-04-15 10:50 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-15 08:34 - 2015-04-15 08:44 - 00022457 _____ () C:\Users\Marlin\Documents\Trauerrede Emmy_1.odt 2015-04-15 08:21 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-15 08:21 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-04-15 08:21 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-15 08:21 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-15 08:21 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-15 08:21 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-04-15 08:21 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-04-15 08:21 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-04-15 08:21 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-04-15 08:21 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-04-15 08:21 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-04-15 08:21 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-04-07 10:21 - 2015-04-07 10:21 - 00026665 _____ () C:\Users\Marlin\Downloads\kalender-2014-querformat-tage-nebeneinander.xlsm 2015-04-07 10:20 - 2015-04-07 10:20 - 00051712 _____ () C:\Users\Marlin\Downloads\kalender-2014-querformat-tage-nebeneinander.xls ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-28 12:16 - 2009-09-07 09:37 - 00000000 ____D () C:\Program Files\Opera 2015-04-28 12:14 - 2009-01-02 17:42 - 01424191 ____N () C:\Windows\WindowsUpdate.log 2015-04-28 12:13 - 2015-01-29 04:01 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-28 12:07 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-28 12:07 - 2006-11-02 14:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-28 12:07 - 2006-11-02 14:47 - 00003344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-28 02:38 - 2006-11-02 15:01 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-28 02:37 - 2012-04-07 19:42 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-28 02:12 - 2012-08-19 18:28 - 00000000 ____D () C:\Users\Marlin\AppData\Roaming\Skype 2015-04-28 01:34 - 2014-09-08 22:29 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000UA.job 2015-04-27 22:34 - 2014-09-08 22:29 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2241634971-3471804435-397115952-1000Core.job 2015-04-27 11:15 - 2008-01-21 09:16 - 00006610 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-26 01:26 - 2015-03-17 16:37 - 00000892 _____ () C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job 2015-04-25 14:02 - 2015-02-12 13:02 - 00000000 ____D () C:\Users\Marlin\Documents\Stephan 2015-04-23 21:15 - 2014-11-16 04:24 - 00000000 ____D () C:\AdwCleaner 2015-04-22 15:08 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2015-04-21 18:41 - 2014-09-03 15:42 - 00000000 ____D () C:\Users\Marlin\AppData\Local\Adobe 2015-04-21 18:41 - 2012-04-07 19:42 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-04-21 18:41 - 2012-04-07 19:42 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-04-20 10:11 - 2013-10-22 13:32 - 00000000 ____D () C:\ProgramData\Oracle 2015-04-20 10:10 - 2008-10-07 16:32 - 00000000 ____D () C:\Program Files\Java 2015-04-20 10:08 - 2015-01-23 01:38 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2015-04-19 21:15 - 2012-05-20 03:29 - 00000000 ____D () C:\Program Files\Common Files\Apple 2015-04-16 16:47 - 2009-09-18 22:24 - 00000000 ____D () C:\ProgramData\Skype 2015-04-15 11:01 - 2013-08-14 22:36 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-15 10:52 - 2006-11-02 12:24 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-04-02 04:22 - 2008-10-07 17:14 - 00000000 ____D () C:\Program Files\Picasa2 ==================== Files in the root of some directories ======= 2009-03-26 18:31 - 2002-03-18 22:04 - 0021038 _____ () C:\Program Files\WinRAR Crack.exe 2009-03-26 18:31 - 2003-01-21 14:36 - 0947429 _____ () C:\Program Files\WinRAR v3.11 Deutsch.exe 2015-04-26 19:42 - 2015-04-26 19:42 - 0245760 _____ (Marin Software) C:\Users\Marlin\AppData\Roaming\defowin.exe 2015-04-26 19:42 - 2015-04-26 19:42 - 0000613 _____ () C:\Users\Marlin\AppData\Roaming\defowin.lnk 2014-04-15 19:33 - 2014-04-15 19:33 - 0000045 _____ () C:\Users\Marlin\AppData\Roaming\WB.CFG 2009-01-10 22:42 - 2009-01-10 22:42 - 0000000 _____ () C:\Users\Marlin\AppData\Roaming\wklnhst.dat 2009-04-21 01:30 - 2015-02-11 20:05 - 0000680 _____ () C:\Users\Marlin\AppData\Local\d3d9caps.dat 2009-01-02 18:16 - 2013-03-06 00:28 - 0056320 _____ () C:\Users\Marlin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-06-19 12:23 - 2014-06-19 12:23 - 0000003 _____ () C:\Users\Marlin\AppData\Local\updater.log 2014-06-19 12:23 - 2014-10-09 16:19 - 0000439 _____ () C:\Users\Marlin\AppData\Local\UserProducts.xml 2009-09-18 22:27 - 2009-09-18 22:27 - 0000048 ____H () C:\ProgramData\ezsidmv.dat 2009-10-08 18:47 - 2009-10-29 13:57 - 0006185 _____ () C:\ProgramData\hpzinstall.log 2009-01-16 18:19 - 2009-08-15 12:37 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt Files to move or delete: ==================== C:\Users\Marlin\ffdshow.reg Some content of TEMP: ==================== C:\Users\Marlin\AppData\Local\Temp\jre-8u45-windows-au.exe C:\Users\Marlin\AppData\Local\Temp\Quarantine.exe C:\Users\Marlin\AppData\Local\Temp\ReimageExpressSetup.exe C:\Users\Marlin\AppData\Local\Temp\ReimagePackage.exe C:\Users\Marlin\AppData\Local\Temp\ReiSysUpdate.exe C:\Users\Marlin\AppData\Local\Temp\SkypeSetup.exe C:\Users\Marlin\AppData\Local\Temp\sqlite3.dll C:\Users\Marlin\AppData\Local\Temp\sqlite3.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-28 12:17 ==================== End Of Log ============================ --- --- --- --- --- --- Servus, hier die 2 Berichte.... |
|
28.04.2015, 17:54
| #27 | |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.B Hi, Bitte lasse die Datei aus der Code-Box bei  überprüfen.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
29.04.2015, 12:26
| #28 |
| | Trojan Spy: Win32/Shiotob.B https://www.virustotal.com/de/file/0ad7038b52e70de79c8a36284f8116d3df294546bfeeb0bcbd1e33c96645aa43/analysis/1430306590/ Halli hallo, hoffe, das ich es richtig gemacht habe..... So viel Arbeit mit diesem Trojaner, Mann, das tut mir Leid. Aber DANKE!!!! |
|
29.04.2015, 17:31
| #29 | |
| /// TB-Ausbilder /// Anleitungs-Guru | Trojan Spy: Win32/Shiotob.BZitat:
Auf geht's in die "letzte" Runde: Schritt 1  Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument: Code:
ATTFilter CloseProcesses:
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [defowin] => C:\Users\Marlin\AppData\Roaming\defowin.lnk [613 2015-04-26] ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Online_Downloaden_Toolbar -> {f6e6051c-0d37-44e3-8855-2308b314f6c2} -> C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] ()
Toolbar: HKLM - Online_Downloaden_Toolbar - {40090c1a-85c9-419d-b493-6119f95d97a4} - C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] ()
Toolbar: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File
C:\Program Files\Online-Downloaden-Service Limited
C:\Program Files\Enigma Software Group\
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
2015-04-26 19:42 - 2015-04-26 19:42 - 00245760 _____ (Marin Software) C:\Users\Marlin\AppData\Roaming\defowin.exe
Google Update Helper (Version: 1.3.23.0 - SaveSense) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Task: {704E81BD-D544-46BE-89E3-F19140D14368} - System32\Tasks\0 => Iexplore.exe
Task: {AC8CFCE7-352B-49E3-B07E-7A81BF9853A6} - System32\Tasks\4792 => Wscript.exe C:\Users\Marlin\AppData\Local\Temp\launchie.vbs
EmptyTemp:
Schritt 2  Upload:
Bitte um Rückmeldung ob es geklappt hat!  Danke für Deine Hilfe! Schritt 3 Bitte probier jetzt nochmal dieses Google Update Helper Zeug zu deinstallieren. Schritt 4 Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan. Bitte poste mir den Inhalt der beiden Logs die erstellt werden.
__________________ Gruß deeprybka Lob, Kritik, Wünsche? Spende fürs trojaner-board? _______________________________________________ „Neminem laede, immo omnes, quantum potes, iuva.“ Arthur Schopenhauer |
|
29.04.2015, 19:26
| #30 |
| | Trojan Spy: Win32/Shiotob.BCode:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 27-04-2015 01
Ran by Marlin at 2015-04-29 20:19:02 Run:1
Running from C:\Users\Marlin\Desktop\Trojaner 04.15
Loaded Profiles: Marlin (Available profiles: Marlin)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
CloseProcesses:
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\...\Run: [defowin] => C:\Users\Marlin\AppData\Roaming\defowin.lnk [613 2015-04-26] ()
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Online_Downloaden_Toolbar -> {f6e6051c-0d37-44e3-8855-2308b314f6c2} -> C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] ()
Toolbar: HKLM - Online_Downloaden_Toolbar - {40090c1a-85c9-419d-b493-6119f95d97a4} - C:\Program Files\Online-Downloaden-Service Limited\Online-Downloaden-Toolbar\adxloader.dll [2009-07-13] ()
Toolbar: HKU\S-1-5-21-2241634971-3471804435-397115952-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL No File
C:\Program Files\Online-Downloaden-Service Limited
C:\Program Files\Enigma Software Group\
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
2015-04-26 19:42 - 2015-04-26 19:42 - 00245760 _____ (Marin Software) C:\Users\Marlin\AppData\Roaming\defowin.exe
Google Update Helper (Version: 1.3.23.0 - SaveSense) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Task: {704E81BD-D544-46BE-89E3-F19140D14368} - System32\Tasks\0 => Iexplore.exe
Task: {AC8CFCE7-352B-49E3-B07E-7A81BF9853A6} - System32\Tasks\4792 => Wscript.exe C:\Users\Marlin\AppData\Local\Temp\launchie.vbs
EmptyTemp:
*****************
Processes closed successfully.
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Windows\CurrentVersion\Run\\defowin => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => Key deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f6e6051c-0d37-44e3-8855-2308b314f6c2}" => Key deleted successfully.
"HKCR\CLSID\{f6e6051c-0d37-44e3-8855-2308b314f6c2}" => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{40090c1a-85c9-419d-b493-6119f95d97a4} => value deleted successfully.
"HKCR\CLSID\{40090c1a-85c9-419d-b493-6119f95d97a4}" => Key deleted successfully.
HKU\S-1-5-21-2241634971-3471804435-397115952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
"HKCR\PROTOCOLS\Handler\livecall" => Key deleted successfully.
"HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F}" => Key deleted successfully.
"HKCR\PROTOCOLS\Handler\msnim" => Key deleted successfully.
HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => Key not found.
C:\Program Files\Online-Downloaden-Service Limited => Moved successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
esgiguard => Service deleted successfully.
C:\Users\Marlin\AppData\Roaming\defowin.exe => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\\SystemComponent => value deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\\SystemComponent => Value not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{704E81BD-D544-46BE-89E3-F19140D14368}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{704E81BD-D544-46BE-89E3-F19140D14368}" => Key deleted successfully.
C:\Windows\System32\Tasks\0 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\0" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{AC8CFCE7-352B-49E3-B07E-7A81BF9853A6}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AC8CFCE7-352B-49E3-B07E-7A81BF9853A6}" => Key deleted successfully.
C:\Windows\System32\Tasks\4792 => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\4792" => Key deleted successfully.
EmptyTemp: => Removed 854.9 MB temporary data.
The system needed a reboot.
==== End of Fixlog 20:20:18 ====
|
|
| Themen zu Trojan Spy: Win32/Shiotob.B |
| ahnung, anhang, entfernung, essen, essentials, guten, hilfe, microsoft, microsoft essentials, nichts, remote, scan, schei, screenshot, shiotob.b, spy, troja, trojan, virus, wiedermal, win |
Linear-Darstellung
