| |
| |||||||
Log-Analyse und Auswertung: QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
06.05.2015, 19:03
| #1 |
| |  QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo zusammen, vor ca. 2 Jahren hat ryder in dem Thread "QuickShare & Snap.do auf Rechner: Deinstallation nicht möglich" (hxxp://tinyurl.com/ljcoj78) das Problem eines Nutzers gelöst, so dass auch ich hoffen kann, bei Euch abschließende Hilfe zu finden. Auf meinen Rechner hat sich das Schad-Programm "QuickShare" eingeschlichen. Bisher habe ich keine Anhaltspunkte, die auch auf Snap.do hinweisen. AVG AntiVirus (erworbene Vollversion 2015.0.5941) schlug am 05.05.2015 Alarm. Ein Scan am 06.05.2015 förderte 68 Bedrohungen zutage, die AVG als "mittelschwer" einstufte und in die Viren-Quarantäne isoliert hat. Da die einzelnen Ergebnis-Meldungen jeweils den Fund "MalSign.Linkury.33E" erwähnten, habe ich dies in den Titel übernommen. Hier also die AVG-Ergebnisse: Code:
ATTFilter "";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\ar
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\BrowserHelper.exe";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\de
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\es
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\he
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\fr
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components
\SmartbarFireFoxRemotePlugin_18.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components
\SmartbarFireFoxRemotePlugin_19.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\Interop.SHDocVw.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\it
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\MACTrackBarLib.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\nl
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\NDde.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\pt
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\ru
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\Smartbar.GUI.Docking.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\Smartbar.GUI.Controls.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.GUI.Multimedia.Loader.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.BusinessEntities.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Core.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.EventManager.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.Base.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.DefaultBrowser.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.GUI.MainClient.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.ShareManagerLocalPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Infrastructure.Utilities.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Personalization.BusinessEntities.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Personalization.Common.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Personalization.BusinessLogic.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Windows\Installer\b65ffa.msi";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Personalization.Settings.UserSettingsManager.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.AutomaticUpdates.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.BrowserHelperUtils.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.LanguageSettings.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.HistoryAndStatsWrapper.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.ProcessDownMonitor.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.ProductsRemovalLibary.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.ProductUninstaller.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.SetBrowsersSettings.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.ShortcutsLibrary.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.SideBySide.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.SocialNetsSharer.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.Translations.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.UninstallScreen.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.UrlHistorySupplier.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\Smartbar.Resources.Utilities.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\SmartbarInternetExplorerBHO2.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application
\SmartbarInternetExplorerExtension2.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\System.Data.SQLite.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Application\tr
\Smartbar.Resources.LanguageSettings.resources.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.DMP.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.NotepadPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.UninstallProductsPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.ScreenCapturePlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Documents and Settings\Administrator\AppData\Local\Smartbar\Common\ServicesPlugins
\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll";"Gesichert"
"";"MalSign.Linkury.33E gefunden, C:\Windows\assembly\GAC_MSIL\Interop.SHDocVw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll";"Gesichert"
"";"Beschädigte ausführbare Datei, C:\Documents and Settings\Administrator\AppData\Local\Temp\SkypeSetup.exe";"Gesichert"
"";"Beschädigte ausführbare Datei, C:\Documents and Settings\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files
\Content.IE5\3JWNN7QU\SkypeSetupFull[1].exe";"Gesichert"
Immerhin kann ich die AdwCleaner-Logdatei vorlegen. Code:
ATTFilter # AdwCleaner v4.203 - Bericht erstellt 06/05/2015 um 09:23:33
# Aktualisiert 30/04/2015 von Xplode
# Datenbank : 2015-04-30.2 [Lokal]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Administrator - IBM2012
# Gestarted von : D:\EDV - Lenovo 535\Software\Online\AdwCleaner_4.203.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\ADMINI~1\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Assistant
Ordner Gelöscht : C:\Users\Administrator\AppData\Local\Smartbar
Ordner Gelöscht : C:\Users\Administrator\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Administrator\AppData\Roaming\pdfforge
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\smartbarbackup
Schlüssel Gelöscht : HKCU\Software\smartbarlog
Schlüssel Gelöscht : HKCU\Software\Local AppWizard-Generated Applications
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4
***** [ Internetbrowser ] *****
-\\ Internet Explorer v0.0.0.0
*************************
AdwCleaner[R0].txt - [4651 Bytes] - [06/05/2015 09:08:37]
AdwCleaner[S0].txt - [4331 Bytes] - [06/05/2015 09:23:33]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [4390 Bytes] ##########
Aber: Das Progamm "QuickShare" lässt sich über die Win7-Deinstallationsroutine nicht löschen (Meldung: "Die Installationsquelle für dieses Produkt steht nicht zur Verfügung. Stellen Sie sicher, dass die Quelle existiert und dass Sie darauf zugreifen können"). Die Hinweise darauf, dass individuelle Lösungen erforderlich sind, lässt mich vor weiteren Schritten zurückschrecken. Vielleicht sollte ich noch anmerken, dass ich zwar schon seit einigen Jahren PCs nutze, aber doch eher ein "User" bin. Allzu vertiefte Kenntnisse dürftet Ihr also wohl nicht unterstellen. Vielleicht ist das Problem durch AVG und AdwCleaner schon weitgehend beseitigt, aber ich hätte doch gerne Euren profunden Rat. Insoweit besten Dank im Voraus! JCK_2015 |
|
06.05.2015, 20:05
| #2 |
| /// TB-Ausbilder   | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Danke für deine Mitarbeit! Zur ersten Analyse bitte FRST ausführen: Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
|
|
06.05.2015, 21:18
| #3 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo Matthias!
__________________Verbindlichen Dank für die freundliche und schnelle Reaktion! Es folgen die erbetenen Files, die offenbar einige Hinweise auf ein fehlerhaftes Produkt QuickShare enthalten. Gute Nacht Jan FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2015 01
Ran by Administrator (administrator) on IBM2012 on 06-05-2015 21:57:00
Running from D:\Internet
Loaded Profiles: Administrator (Available profiles: JCK2012 & Administrator)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(AuthenTec, Inc) C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AVerMedia) C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe
() C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe
(TrueCrypt Foundation) C:\Program Files\TrueCrypt\TrueCrypt.exe
(Secomba GmbH) C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe
(Callicia) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
() C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
(AVerMedia TECHNOLOGIES, Inc.) C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\FRITZVPN.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Deutsche Telekom AG) C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
(QNAP Systems, Inc.) C:\Program Files (x86)\QNAP\Qsync\Qsync.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
() C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(AuthenTec Inc.) C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exe
(AuthenTec Inc.) C:\Program Files\Lenovo Fingerprint Reader\x86\BioMonitor.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_31\bin\javaw.exe
() C:\Program Files (x86)\Streamripper\streamripper.exe
() C:\Program Files (x86)\Streamripper\streamripper.exe
(PortableApps.com) C:\Portable Software\Firefox Portable\FirefoxPortable.exe
(Mozilla Corporation) C:\Portable Software\Firefox Portable\App\Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [222720 2012-06-21] (Lenovo.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [887968 2012-06-14] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-25] (CANON INC.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1213848 2010-09-14] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2010-09-09] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3745232 2015-04-15] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2013-01-23] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4509184 2012-12-27] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsInd00] => C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe [1885184 2012-12-18] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Sound Blaster Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster\Sound Blaster Control Panel\SBCP.exe [930304 2014-07-16] (Creative Technology Ltd)
HKLM-x32\...\Run: [Qsync] => C:\Program Files (x86)\QNAP\Qsync\Qsync.exe [14824656 2015-04-01] (QNAP Systems, Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2014-04-08] (TrueCrypt Foundation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [Boxcryptor.exe] => C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe [1063168 2014-04-08] (Secomba GmbH)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [BirdieSync] => C:\Program Files (x86)\BirdieSync\BirdieSync.exe [998912 2014-07-26] (Callicia)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [455392 2015-04-10] (Sony)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\MountPoints2: {fd150f38-4eca-11e2-af08-005056c00008} - F:\AutoRun.exe
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\MountPoints2: {fd150f49-4eca-11e2-af08-005056c00008} - G:\AutoRun.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-09-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!Fernzugang.lnk [2015-04-24]
ShortcutTarget: FRITZ!Fernzugang.lnk -> C:\Program Files\FRITZ!Fernzugang\FRITZVPN.exe (AVM Berlin)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk [2014-04-23]
ShortcutTarget: Mediencenter.lnk -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk [2012-09-14]
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVerQuick.lnk [2012-09-14]
ShortcutTarget: AVerQuick.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe (AVerMedia TECHNOLOGIES, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2012-09-11]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
SSODL: EldosMountNotificator-cbfs4 - {A18FEDFC-D96F-49FD-AA90-1B5F433256C1} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {A18FEDFC-D96F-49FD-AA90-1B5F433256C1} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [ QsyncEx_Icon1] -> {9EF65B94-EC0D-49F7-B46D-006B388EB03E} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon2] -> {15A36E9F-69F5-4FE9-8752-1BD4F9B90DCD} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon3] -> {70ADB694-0DFE-49CF-A35B-92FE001C37A7} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs4] -> {814B7613-1A49-4450-91C0-5893D066B662} => C:\Windows\system32\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs4] -> {814B7613-1A49-4450-91C0-5893D066B662} => C:\Windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO: TrueSuite Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2012-06-07] (AuthenTec Inc.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: TrueSuite Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll [2012-06-07] (AuthenTec Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://files.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://files.creative.com/Web/softwareupdate/ocx/150323/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2011-04-23] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2011-04-22] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2011-04-23] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2011-04-22] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{C82A5402-CF07-4458-BA15-A26B625DBCEC}: [NameServer] 193.189.244.225 193.189.244.206
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF HKLM-x32\...\Sunbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Sunbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Sunbird Service [2014-12-09]
FF HKLM-x32\...\Thunderbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Thunderbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Thunderbird Service [2014-12-09]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [cdkedefaddcdlpmiafhicjnkbogjiogj] - C:\Program Files\Lenovo Fingerprint Reader\x86\tschrome.crx [2012-03-13]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
R2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2009-10-31] (AVerMedia) [File not signed]
R2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [397312 2009-12-07] () [File not signed]
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3438032 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [311792 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-10-07] () [File not signed]
R2 FPLService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [328552 2012-06-07] (AuthenTec, Inc)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Crypkey License; crypserv.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
S3 AVerAF15DMBTH64; C:\Windows\System32\Drivers\AVerAF15DMBTH64.sys [592256 2009-07-27] (AVerMedia TECHNOLOGIES, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [284128 2015-04-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [213984 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [256992 2015-04-15] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [344544 2015-03-11] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [137184 2015-04-03] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [291296 2015-04-07] (AVG Technologies CZ, s.r.o.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [163368 2012-04-01] (Broadcom Corporation.)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [246224 2009-12-07] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-04-08] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-04-08] (Acronis International GmbH)
S3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-07] (ThinkVantage Communications Utility)
S3 UHSfiltv; C:\Windows\System32\drivers\UHSfiltv.sys [23552 2014-12-22] (Creative Technology Ltd.)
U5 UnlockerDriver5; C:\Portable Software\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [12400 1999-10-13] (Microsoft Corporation) [File not signed]
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-04-08] (Acronis International GmbH)
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33496 2015-01-16] (VMware, Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S1 NetworkX; \SystemRoot\system32\ckldrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-06 21:56 - 2015-05-06 21:57 - 00000000 ____D () C:\FRST
2015-05-06 09:08 - 2015-05-06 09:23 - 00000000 ____D () C:\AdwCleaner
2015-05-06 08:02 - 2015-05-06 09:39 - 00000022 _____ () C:\Windows\S.dirmngr
2015-05-05 21:04 - 2014-07-29 23:40 - 00002770 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2015-05-04 14:51 - 2015-05-04 14:52 - 00007601 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2015-05-01 09:02 - 2015-05-01 09:02 - 00008488 _____ () C:\Windows\DPINST.LOG
2015-04-24 11:21 - 2015-04-24 11:21 - 00001876 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\QNAP Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00001870 _____ () C:\Users\Public\Desktop\Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00001870 _____ () C:\ProgramData\Desktop\Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Local\QNAP
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\Program Files (x86)\QNAP
2015-04-24 10:43 - 2015-04-24 10:48 - 00000000 ____D () C:\Program Files\FRITZ!Fernzugang
2015-04-24 10:43 - 2015-04-24 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Fernzugang
2015-04-24 10:43 - 2015-04-24 10:43 - 00000000 ____D () C:\ProgramData\AVM
2015-04-24 10:38 - 2015-04-24 10:38 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\TeamViewer
2015-04-23 17:54 - 2015-04-23 17:54 - 00001217 _____ () C:\Users\Administrator\Desktop\Sound Blaster Systemsteuerung.lnk
2015-04-23 17:54 - 2015-04-23 17:54 - 00000000 ____D () C:\Users\Public\Documents\Creative
2015-04-23 17:54 - 2015-04-23 17:54 - 00000000 ____D () C:\ProgramData\Documents\Creative
2015-04-23 17:47 - 2015-04-23 17:47 - 00000000 ____D () C:\ProgramData\Creative
2015-04-23 17:39 - 2015-04-23 17:39 - 00466520 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00445016 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00123480 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00109144 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2015-04-23 17:39 - 2014-10-13 10:45 - 01898496 ____N (Creative) C:\Windows\system32\Sens_oal.dll
2015-04-23 17:39 - 2014-10-13 10:36 - 01609728 ____N (Creative) C:\Windows\SysWOW64\Sens_oal.dll
2015-04-23 17:38 - 2015-04-23 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2015-04-23 17:38 - 2015-04-23 17:38 - 00002133 _____ () C:\Users\Public\Desktop\Creative-Produktregistrierung.lnk
2015-04-23 17:38 - 2015-04-23 17:38 - 00002133 _____ () C:\ProgramData\Desktop\Creative-Produktregistrierung.lnk
2015-04-23 17:38 - 2014-02-26 17:20 - 02584576 ____N (Creative Technology Ltd.) C:\Windows\SysWOW64\HsMalc32.dll
2015-04-23 17:38 - 2014-02-24 23:30 - 00145408 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTHIDRpA.hsf
2015-04-23 17:38 - 2014-02-24 23:30 - 00095232 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTHID.hsf
2015-04-23 17:38 - 2011-07-12 13:12 - 00098304 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTIntrfu.hsf
2015-04-23 17:38 - 2006-10-06 14:17 - 00053248 ____N (Creative Technology Ltd ) C:\Windows\Ctregrun.exe
2015-04-23 17:38 - 2003-06-12 23:25 - 00007062 _____ () C:\Windows\SysWOW64\audiopid.vxd
2015-04-23 17:37 - 2015-04-23 17:39 - 00000000 ____D () C:\Program Files (x86)\Creative
2015-04-23 17:37 - 2015-04-23 17:38 - 00000414 ___RH () C:\Windows\ctfile.rfc
2015-04-23 17:37 - 2015-04-23 17:37 - 00000000 ____D () C:\Program Files\Creative
2015-04-23 17:37 - 2015-01-05 11:13 - 00033905 _____ () C:\Windows\system32\UHS.ini
2015-04-23 17:37 - 2015-01-05 11:13 - 00001900 _____ () C:\Windows\SBRoar.ini
2015-04-23 17:37 - 2014-11-28 13:41 - 00089600 _____ () C:\Windows\system32\CmdRtr64.DLL
2015-04-23 17:37 - 2014-11-28 13:41 - 00074240 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2015-04-23 17:37 - 2014-11-28 13:40 - 00365568 _____ () C:\Windows\system32\APOMgr64.DLL
2015-04-23 17:37 - 2014-11-28 13:38 - 00274944 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2015-04-22 09:29 - 2015-04-22 09:29 - 00000496 _____ () C:\Windows\PFRO.log
2015-04-15 13:06 - 2015-04-15 13:06 - 00256992 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2015-04-15 09:56 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 09:56 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 09:56 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 09:55 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 09:55 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 09:55 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 09:55 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 09:55 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 09:55 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 09:55 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 09:55 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 09:55 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 09:55 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 09:55 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 09:55 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 09:55 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 09:55 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 09:55 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 09:55 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 09:55 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 09:55 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 09:55 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 09:55 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 09:55 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 09:55 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 09:55 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 09:55 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 09:55 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 09:55 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 09:55 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 09:53 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 09:53 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 09:53 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-13 11:37 - 2015-04-13 11:37 - 00000000 ____D () C:\Users\Administrator\Documents\Beck
2015-04-13 11:34 - 2015-04-13 11:37 - 00001702 _____ () C:\Users\Administrator\Desktop\Beck ProzFormB.lnk
2015-04-09 21:15 - 2015-01-16 18:15 - 00064728 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys
2015-04-09 21:15 - 2015-01-16 18:14 - 00033496 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMkbd.sys
2015-04-09 21:15 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vsock.sys
2015-04-09 21:15 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\Windows\system32\vsocklib.dll
2015-04-09 21:15 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll
2015-04-09 21:14 - 2015-04-09 21:14 - 00002120 _____ () C:\Users\Public\Desktop\VMware Player.lnk
2015-04-09 21:14 - 2015-04-09 21:14 - 00002120 _____ () C:\ProgramData\Desktop\VMware Player.lnk
2015-04-09 21:14 - 2015-04-09 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2015-04-09 21:14 - 2015-04-09 21:14 - 00000000 ____D () C:\Program Files\Common Files\VMware
2015-04-09 21:14 - 2015-01-16 18:15 - 00931032 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll
2015-04-09 21:14 - 2015-01-16 18:15 - 00437976 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2015-04-09 21:14 - 2015-01-16 18:15 - 00359128 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-09 21:14 - 2015-01-16 18:15 - 00031448 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-09 21:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\Windows\system32\Drivers\hcmon.sys
2015-04-09 21:14 - 2014-08-21 08:06 - 00046144 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmusb.sys
2015-04-09 21:13 - 2015-04-09 21:13 - 00000000 ____D () C:\Program Files (x86)\VMware
2015-04-09 14:11 - 2015-04-09 14:11 - 00284128 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-04-07 12:39 - 2015-04-07 12:39 - 00291296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-06 21:57 - 2013-04-26 09:08 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2015-05-06 21:57 - 2012-09-14 11:29 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2015-05-06 21:42 - 2013-04-30 10:43 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Foxit Software
2015-05-06 21:20 - 2013-10-03 15:22 - 00000000 ____D () C:\ProgramData\MFAData
2015-05-06 20:15 - 2011-04-12 09:43 - 00702388 _____ () C:\Windows\system32\perfh007.dat
2015-05-06 20:15 - 2011-04-12 09:43 - 00151022 _____ () C:\Windows\system32\perfc007.dat
2015-05-06 20:15 - 2009-07-14 07:13 - 01628890 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-06 14:41 - 2012-09-11 21:15 - 01819493 _____ () C:\Windows\WindowsUpdate.log
2015-05-06 13:16 - 2009-07-14 06:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-06 13:16 - 2009-07-14 06:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-06 09:42 - 2012-09-13 01:05 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Dropbox
2015-05-06 09:39 - 2015-03-31 08:26 - 00002617 _____ () C:\Windows\setupact.log
2015-05-06 09:39 - 2012-09-13 14:59 - 00000000 ____D () C:\ProgramData\VMware
2015-05-06 09:39 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-06 08:14 - 2014-11-13 10:18 - 00000000 ____D () C:\ProgramData\AVG2015
2015-05-06 03:27 - 2012-09-14 15:59 - 00000000 ____D () C:\Users\Administrator\Documents\AVerTV
2015-05-05 22:25 - 2012-09-14 15:57 - 00000000 ____D () C:\Users\Administrator\AppData\Local\AVerMedia
2015-05-05 09:52 - 2012-09-13 15:01 - 00000000 ____D () C:\Users\Administrator\AppData\Local\VMware
2015-05-05 09:43 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-05 09:39 - 2012-09-13 15:00 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\VMware
2015-05-01 09:02 - 2014-12-14 23:03 - 00002026 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2015-05-01 09:02 - 2014-12-14 23:03 - 00002026 _____ () C:\ProgramData\Desktop\Sony PC Companion 2.1.lnk
2015-05-01 09:02 - 2014-12-14 23:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-05-01 09:01 - 2012-09-11 17:05 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-30 12:59 - 2013-03-01 22:56 - 00011807 _____ () C:\Users\Administrator\gsview64.ini
2015-04-30 08:59 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-26 16:52 - 2012-09-13 01:08 - 00001040 _____ () C:\Users\Administrator\Desktop\Dropbox.lnk
2015-04-26 16:52 - 2012-09-13 01:05 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-17 09:56 - 2014-11-13 10:20 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-04-17 09:56 - 2014-11-13 10:20 - 00000981 _____ () C:\ProgramData\Desktop\AVG 2015.lnk
2015-04-17 09:56 - 2014-04-01 09:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-04-16 08:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-04-15 21:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-15 10:03 - 2012-09-13 01:17 - 01603170 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 10:02 - 2013-08-26 09:13 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 09:58 - 2012-09-13 01:18 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2012-09-14 19:06 - 2013-11-20 17:33 - 1178624 _____ (CPUID) C:\Users\Administrator\AppData\Roaming\siw_sdk.dll
2013-01-17 19:54 - 2013-01-17 19:54 - 0003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-17 21:49 - 2013-03-11 12:13 - 0000600 _____ () C:\Users\Administrator\AppData\Local\PUTTY.RND
2015-05-05 21:04 - 2014-07-29 23:40 - 0002770 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2015-05-04 14:51 - 2015-05-04 14:52 - 0007601 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2012-09-25 19:24 - 2012-09-25 19:24 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmdbikl.dll
C:\Users\Administrator\AppData\Local\Temp\jna1235580835793683299.dll
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-04 17:23
==================== End Of Log ============================
--- --- --- --- --- --- Additional scan result of Farbar Recovery Scan Tool Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2015 01
Ran by Administrator at 2015-05-06 21:58:48
Running from D:\Internet
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1988550429-4052914518-1190181641-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-1988550429-4052914518-1190181641-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1988550429-4052914518-1190181641-1002 - Limited - Enabled)
JCK2012 (S-1-5-21-1988550429-4052914518-1190181641-1000 - Administrator - Enabled) => C:\Users\JCK2012
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.00.595.5857 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.595.5857 - ABBYY) Hidden
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.3.26.0 - AppEx Networks)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.72.00 - )
Audioactive Production Studio (HKLM-x32\...\Audioactive Production Studio) (Version: - )
AVerMedia A850 USB DMB-TH 1.0.64.28 (HKLM-x32\...\AVerMedia A850 USB DMB-TH) (Version: 1.0.64.28 - AVerMedia TECHNOLOGIES, Inc.)
AVerTV (HKLM-x32\...\InstallShield_{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}) (Version: 6.0.18 - AVerMedia Technologies, Inc.)
AVerTV (x32 Version: 6.0.18 - AVerMedia Technologies, Inc.) Hidden
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5941 - AVG Technologies)
AVG 2015 (Version: 15.0.4342 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5941 - AVG Technologies) Hidden
Back4Sure 3.4.0 (HKLM-x32\...\Back4Sure_is1) (Version: - Ulrich Krebs)
BirdieSync 2.4.10.0 (HKLM-x32\...\BirdieSync) (Version: 2.4.10.0 - Callicia)
Boxcryptor 2.0 (HKLM-x32\...\{EBFEBFC7-B128-4700-ADBC-E839BFC833AE}) (Version: 2.0.419.376 - Secomba GmbH)
Brother MFL-Pro Suite MFC-1810 series (HKLM-x32\...\{90C24B16-9C28-44AB-8C63-BB9822218E18}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
Brother MFL-Pro Suite MFC-7420 (HKLM-x32\...\{C2530D63-B66B-48B5-BB50-7C6281FE7AA6}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon MP Navigator EX 4.1 (HKLM-x32\...\MP Navigator EX 4.1) (Version: - )
Canon MX880 series Benutzerregistrierung (HKLM-x32\...\Canon MX880 series Benutzerregistrierung) (Version: - )
Canon MX880 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX880_series) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.42.0 - Conexant)
Creative Systeminformationen (HKLM-x32\...\SysInfo) (Version: 1.10 - Creative Technology Limited)
Dropbox (HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.32 - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
eXPert PDF 6 (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 6.20.400.0 - Avanquest software)
Fingerprint Reader (HKLM\...\{C5BB9380-D729-410A-A440-061EBCADCCB9}) (Version: 5.4.100.232 - AuthenTec, Inc.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Google Books Downloader version 2.3 (HKLM-x32\...\{216729B6-014A-F413-814F-F17F74FBA113}_is1) (Version: 2.3 - GBOOKSDOWNLOADER.COM)
Gpg4win (2.2.1) (HKLM-x32\...\GPG4Win) (Version: 2.2.1 - The Gpg4win Project)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Integrated Camera Driver Installer Package Ver.1.2.1.18 (HKLM-x32\...\{A78800AF-1779-4AE8-8EBE-16E1BE727C71}) (Version: 1.2.1.18 - RICOH)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.11 - )
Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{A7BB9BBD-DFE4-4276-820A-7CD141FC09E6}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{1C83CB66-D345-4D6C-95A2-63A03269ADA0}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Image Composite Editor (HKLM\...\{B821CDAA-34DE-46FD-87C9-E6EE7158DB5D}) (Version: 1.4.4 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 16.002.03.02.511 - Huawei Technologies Co.,Ltd)
OVTScanner_X64 (HKLM-x32\...\{AE09704D-9051-4C25-B940-77F889F0C93F}) (Version: 1.00.0000 - Ihr Firmenname)
PDF Expert 6 - Installer (HKLM-x32\...\{4F09C764-E4DB-4DED-8489-55119833FAF7}_is1) (Version: - Avanquest GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PhonerLite 2.08 (HKLM-x32\...\PhonerLite_is1) (Version: 2.08 - Heiko Sommerfeldt)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
QNAP Qsync (HKLM-x32\...\Qsync) (Version: 1.4.0.0401 - QNAP Systems, Inc.)
QuickShare (HKLM-x32\...\{6903918F-8A5A-4C72-9573-0F2D1559F28C}) (Version: 1.6.1.945 - Linkury Inc.) <==== ATTENTION
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)
ReOrganize! (HKLM-x32\...\ReOrganize_is1) (Version: 2.3.1 - Oliver Frietsch)
SilverFast AFL 6.6.2r3 (HKLM-x32\...\SilverFast AFL) (Version: - LaserSoft Imaging AG)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype™ 6.6 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.6.106 - Skype Technologies S.A.)
Sony PC Companion 2.10.259 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.259 - Sony)
Sound Blaster (HKLM-x32\...\{0DB55276-875C-43BA-AD29-E73F6E5F3C3C}) (Version: 1.00.02 - Creative Technology Limited)
Sound Blaster Extras (HKLM-x32\...\{469CFC5B-8924-4EE6-B5C9-B37801C883AC}) (Version: 1.0 - Creative Technology Limited)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version: - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17311226DF01}) (Version: 1.00.0031.1 - REALTEK Semiconductor Corp.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.5 - Lenovo)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.5 - VMware, Inc)
VMware Player (Version: 6.0.5 - VMware, Inc.) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.2700 - Broadcom Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
04-05-2015 17:29:30 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {52C4CC27-3CB6-4EC5-98A0-353772E2B426} - System32\Tasks\{82D964E7-E2D7-4A70-9797-74891AA23934} => pcalua.exe -a "C:\Portable Software\ReOrganize\reorganize-2.3.exe" -d "C:\Portable Software\ReOrganize"
Task: {DF61C7C2-7A62-42A0-A810-F57DFC6FBC8C} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {E3B075E4-8ED4-45C3-8855-560C6A6C0BFA} - System32\Tasks\{BC3F0491-99F7-4E20-BCCA-13B61F7AC639} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
==================== Loaded Modules (whitelisted) ==============
2009-11-19 06:01 - 2009-11-19 06:01 - 00022016 _____ () C:\Windows\System32\sugw2l6.dll
2012-12-19 16:32 - 2012-12-19 16:32 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2012-09-14 15:57 - 2009-12-07 07:13 - 00397312 _____ () C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe
2013-10-07 16:54 - 2013-10-07 16:54 - 00218112 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2015-04-01 10:57 - 2015-04-01 10:57 - 00297680 _____ () C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll
2012-09-14 16:50 - 2012-05-16 06:32 - 00103936 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-09-25 19:23 - 2010-10-26 12:40 - 00049056 _____ () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2012-09-14 15:57 - 2009-08-01 03:06 - 00155648 _____ () C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe
2014-12-14 23:02 - 2014-06-23 09:07 - 00113376 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
2013-09-17 10:29 - 2013-09-17 10:29 - 00819200 _____ () C:\Program Files (x86)\BirdieSync\Android\Adb\1.0.31\adb.exe
2012-12-19 16:32 - 2012-12-19 16:32 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2012-06-07 00:03 - 2012-06-07 00:03 - 01163624 _____ () C:\Program Files\Lenovo Fingerprint Reader\DataManager.dll
2012-06-07 00:04 - 2012-06-07 00:04 - 00087912 _____ () C:\Program Files\Lenovo Fingerprint Reader\ssutil.dll
2013-10-01 10:32 - 2013-10-01 10:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2009-03-31 06:10 - 2009-03-31 06:10 - 00024576 _____ () C:\Program Files (x86)\Streamripper\streamripper.exe
2013-10-07 16:49 - 2013-10-07 16:49 - 00221184 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-10-07 16:47 - 2013-10-07 16:47 - 00037888 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-07 16:44 - 2013-10-07 16:44 - 00050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-10-07 16:49 - 2013-10-07 16:49 - 00069632 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-10-07 16:49 - 2013-10-07 16:49 - 00628224 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2015-01-16 18:15 - 2015-01-16 18:15 - 01301720 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2014-03-26 14:23 - 2014-03-26 14:23 - 00799232 _____ () C:\Program Files (x86)\BirdieSync\BirdieSync.Lib\sqlite3.dll
2014-07-26 11:55 - 2014-07-26 11:55 - 00029696 _____ () C:\Program Files (x86)\BirdieSync\BirdieSync.Lib\QtSolutions_SingleApplication-head.dll
2014-12-14 23:02 - 2012-04-30 11:57 - 00039936 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\TMonitorAPI.dll
2014-12-14 23:02 - 2014-12-04 15:18 - 00241152 _____ () C:\Program Files (x86)\Sony\Sony PC Companion\MExplorer.dll
2015-05-06 09:40 - 2015-05-06 09:40 - 00043008 _____ () c:\Users\Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmdbikl.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00750080 _____ () C:\Users\Administrator\AppData\Roaming\Dropbox\bin\libGLESv2.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00047616 _____ () C:\Users\Administrator\AppData\Roaming\Dropbox\bin\libEGL.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00865280 _____ () C:\Users\Administrator\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll
2015-03-04 23:45 - 2015-03-04 23:45 - 00200704 _____ () C:\Users\Administrator\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll
2013-08-11 12:26 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00036672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2013-10-10 12:02 - 2013-10-10 12:02 - 00013120 _____ () C:\Program Files (x86)\Common Files\Acronis\TibMounter\icudt38.dll
2015-03-12 11:16 - 2015-03-12 11:16 - 00116224 _____ () C:\Program Files (x86)\QNAP\Qsync\RdiffDll.dll
2014-07-04 10:33 - 2014-07-04 10:33 - 00163840 _____ () C:\Program Files (x86)\QNAP\Qsync\IOTCAPIs.dll
2014-07-04 10:33 - 2014-07-04 10:33 - 00086016 _____ () C:\Program Files (x86)\QNAP\Qsync\P2PTunnelAPIs.dll
2014-07-04 10:33 - 2014-07-04 10:33 - 00094208 _____ () C:\Program Files (x86)\QNAP\Qsync\RDTAPIs.dll
2014-02-04 18:28 - 2014-02-04 18:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
2009-03-31 06:10 - 2009-03-31 06:10 - 00200704 _____ () C:\Program Files (x86)\Streamripper\streamripper.dll
2005-12-31 18:18 - 2005-12-31 18:18 - 00040960 _____ () C:\Program Files (x86)\Streamripper\ogg.dll
2005-12-31 18:15 - 2005-12-31 18:15 - 01150976 _____ () C:\Program Files (x86)\Streamripper\vorbis.dll
2008-09-15 02:12 - 2008-09-15 02:12 - 01465925 _____ () C:\Program Files (x86)\Streamripper\libiconv-2.dll
2008-09-15 02:12 - 2008-09-15 02:12 - 00490650 _____ () C:\Program Files (x86)\Streamripper\libintl-8.dll
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\Control Panel\Desktop\\Wallpaper -> C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: LENOVO.TPKNRRES => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
MSCONFIG\startupreg: vspdfprsrv.exe => C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe --background
==================== FirewallRules (whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [TCP Query User{E0794C75-51B0-405C-A0CB-024B9ECB4DA2}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Allow) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{6BB9F0B3-927C-451C-95A1-B223845F76CD}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Allow) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [{3D95A739-7F2A-4400-A50C-0E01F50DFA5C}] => (Allow) C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C7BC8372-902B-4129-A2DC-980E6DFA2C31}] => (Allow) C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{F56DAAF5-A41B-4885-A14B-E012D86B0F13}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Block) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{1C2F20E3-A6FA-41A5-82B5-40793C841CD8}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Block) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [{6EF65702-3348-438F-B417-5F01F482A678}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{BB01EB0C-379D-4C02-B7BE-052F43B925C3}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [UDP Query User{4925C806-4344-4D6D-8B18-EB8B8A3504F5}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{3FFE524A-4FDB-4BDD-AB36-989B4CF05A59}] => (Block) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{4491D6DF-4462-4F6C-9789-0AACE55942D2}] => (Block) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{F94DFBBC-253B-4794-A497-CE230262325B}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{69E2FCC2-2AB9-4807-952F-81CE1BD68E20}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{B1A44FD4-B70C-4A66-8FE7-163BD42DD7EA}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{215E7707-D79F-443C-89B8-D864782CEC50}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{D5BA8CA3-FE64-4E2C-95B1-2583931C023A}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{567B5F01-57B4-4ED2-9652-B07E46F38C31}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{E4652D12-7EB9-4705-A938-D256F9EE8D32}] => (Allow) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
FirewallRules: [{9CB37AEE-2113-4119-AB3E-B9FFD589A4E7}] => (Allow) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
FirewallRules: [TCP Query User{E31C3700-B381-4BBE-BA2F-A74219245C41}C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe] => (Allow) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [UDP Query User{84451407-AD95-4D56-9091-AD58F1164C79}C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe] => (Allow) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [{6C9421A3-5945-44CD-A7F9-D7751D58EA7A}] => (Block) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [{3CD36139-7DF7-47B5-93C5-26F6D241B076}] => (Block) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [TCP Query User{A64CA42D-9406-44BC-A443-031DE244D6E7}C:\portable software\firefox portable\app\firefox\firefox.exe] => (Allow) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{387D5346-9670-4C39-8116-E57A6DD0DA8F}C:\portable software\firefox portable\app\firefox\firefox.exe] => (Allow) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{35AE65BE-548F-4E14-AF0B-759CD6F892C0}] => (Block) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{C747FA3C-86A0-4CB9-88D3-4D3782E43EAC}] => (Block) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{B5598505-1B8E-4D01-9DEC-FD3A069A7FA0}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{182FB336-4185-41E1-B61C-FE21A63412FA}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{D60802F1-BD55-4095-8195-2F70A67299D2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{E8CDB05E-0217-429E-8CA5-13EF5533C0A9}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{690C5CAD-8FD1-4BF7-88C7-EC7D7490F9C2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{072FDB81-042F-42E8-A2B1-A9A7A61B1D2F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{FE47882D-1E98-4DDF-9CFA-39DBD7403298}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{73E7F4EA-58AB-43A7-B9F6-9A8CB9808243}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [TCP Query User{FD2D0632-7455-41AF-BB1E-9B9B9524A066}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [UDP Query User{8E12A9A7-F23C-4A82-A3E9-3E8D12940D82}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [{D2C9EE95-9B90-42FC-98BD-D5D6F714C073}] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [{979089F1-8350-4FC0-83FC-55F6D1D0F9FB}] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/06/2015 09:40:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 09:40:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 09:39:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 08:20:16 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI9DB8.tmp
Error: (05/06/2015 08:20:15 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSI99E0.tmp
Error: (05/06/2015 08:20:07 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI6661.tmp
Error: (05/06/2015 08:20:01 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSID6BF.tmp
Error: (05/06/2015 08:03:23 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 08:03:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 08:03:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/06/2015 08:25:33 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error: (05/06/2015 07:53:03 PM) (Source: ACPI) (EventID: 13) (User: )
Description: : Der eingebettete Controller (EC) hat nicht innerhalb des angegebenen Zeitlimits reagiert. Dies deutet auf einen Fehler in der EC-Hardware oder -Firmware hin bzw. darauf, dass das BIOS auf falsche Art auf den EC zugreift. Fragen Sie den Computerhersteller nach einem aktualisierten BIOS. Dieser Fehler kann in einigen Situationen zur Folge haben, dass der Computer fehlerhaft läuft.
Error: (05/06/2015 09:40:41 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (05/06/2015 09:39:41 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
NetworkX
Error: (05/06/2015 09:39:30 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Crypkey License" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/06/2015 09:27:47 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\System32\bcmihvsrv64.dll
Error: (05/06/2015 09:27:47 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\System32\bcmihvsrv64.dll
Error: (05/06/2015 09:27:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo PM Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/06/2015 09:27:33 AM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\Windows\System32\bcmihvsrv64.dll
Error: (05/06/2015 09:24:15 AM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Microsoft Office Sessions:
=========================
Error: (05/06/2015 09:40:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 09:40:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 09:39:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 08:20:16 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI9DB8.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/06/2015 08:20:15 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSI99E0.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/06/2015 08:20:07 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI6661.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/06/2015 08:20:01 AM) (Source: MsiInstaller) (EventID: 11723) (User: IBM2012)
Description: Product: QuickShare -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSID6BF.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (05/06/2015 08:03:23 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 08:03:22 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 08:03:08 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: AMD A6-4400M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 42%
Total physical RAM: 3512.95 MB
Available physical RAM: 2018.93 MB
Total Pagefile: 8312.09 MB
Available Pagefile: 5795.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:97.56 GB) (Free:33.87 GB) NTFS
Drive d: (Daten) (Fixed) (Total:368.1 GB) (Free:198.34 GB) NTFS
Drive x: (Boxcryptor) (Fixed) (Total:368.1 GB) (Free:198.34 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 5837352B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
06.05.2015, 21:27
| #4 | |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Zukünftig bitte beachten: Zitat:
Bitte alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind. Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen. Alle Tools bis zum Ende der Bereinigung auf dem Desktop lassen, evtl. benötigen wir manche öfter. Schritt 1 Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt 2 Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt 3
Bitte poste mit deiner nächsten Antwort
|
|
07.05.2015, 10:33
| #5 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo Matthias, ich gelobe, brav sein zu wollen! ;o) Hier die drei erbetenen Logfiles (JRT und FRST bei temporär abgeschaltetem AVG): Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 06.05.2015 Suchlauf-Zeit: 23:26:24 Logdatei: mbam.txt Administrator: Ja Version: 2.01.6.1022 Malware Datenbank: v2015.05.06.05 Rootkit Datenbank: v2015.04.21.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Administrator Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 378246 Verstrichene Zeit: 11 Min, 50 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 2 PUP.Optional.QuickShare.A, HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [8de0513ff595b97db5a765215ba854ac], PUP.Optional.QuickShare.A, HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}, In Quarantäne, [8de0513ff595b97db5a765215ba854ac], Registrierungswerte: 1 PUP.Optional.SmartBar.A, HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|Browser Infrastructure Helper, C:\Users\JCK2012\AppData\Local\Smartbar\Application\QuickShare.exe startup, In Quarantäne, [b4b90e8297f3181e8657db55eb1a3dc3] Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.8 (05.06.2015:1)
OS: Windows 7 Home Premium x64
Ran by Administrator on 07.05.2015 at 11:18:15,55
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 07.05.2015 at 11:21:38,07
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-05-2015 01
Ran by Administrator (administrator) on IBM2012 on 07-05-2015 11:22:10
Running from C:\Users\Administrator\Desktop
Loaded Profiles: JCK2012 & Administrator (Available profiles: JCK2012 & Administrator)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser not detected!)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\avmike.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\certsrv.exe
(AVM Berlin) C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [222720 2012-06-21] (Lenovo.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [887968 2012-06-14] (Conexant Systems, Inc.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2782096 2010-07-25] (CANON INC.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [519408 2013-07-18] (Acronis)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508256 2012-04-23] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1213848 2010-09-14] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2010-09-09] (CANON INC.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3745232 2015-04-15] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [7843744 2014-02-04] (Acronis)
HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [1104616 2013-10-10] (Acronis International GmbH)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2013-01-23] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4509184 2012-12-27] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsInd00] => C:\Program Files (x86)\BrownyInd\Brother\BrIndicator.exe [1885184 2012-12-18] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Sound Blaster Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster\Sound Blaster Control Panel\SBCP.exe [930304 2014-07-16] (Creative Technology Ltd)
HKLM-x32\...\Run: [Qsync] => C:\Program Files (x86)\QNAP\Qsync\Qsync.exe [14824656 2015-04-01] (QNAP Systems, Inc.)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2014-04-08] (TrueCrypt Foundation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Run: [Boxcryptor.exe] => C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe [1063168 2014-04-08] (Secomba GmbH)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Run: [BirdieSync] => C:\Program Files (x86)\BirdieSync\BirdieSync.exe [998912 2014-07-26] (Callicia)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [455392 2015-04-10] (Sony)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\RunOnce: [ProdReg] => C:\Program Files (x86)\Creative\Product Registration\ProdReg.exe [1690112 2014-02-24] (Creative Technology Ltd)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\RunOnce: [CTPostBootSequencer] => "C:\Users\ADMINI~1\AppData\Local\Temp\CTPBSeq.exe" /reglaunch /self_destruct <===== ATTENTION
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\MountPoints2: {fd150f38-4eca-11e2-af08-005056c00008} - F:\AutoRun.exe
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\MountPoints2: {fd150f49-4eca-11e2-af08-005056c00008} - G:\AutoRun.exe
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AppexAcceleratorUI.exe [1000288 2012-05-22] (AppEx Networks Corporation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [TrueCrypt] => C:\Program Files\TrueCrypt\TrueCrypt.exe [1516496 2014-04-08] (TrueCrypt Foundation)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [Boxcryptor.exe] => C:\Program Files (x86)\Boxcryptor\Boxcryptor.exe [1063168 2014-04-08] (Secomba GmbH)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [BirdieSync] => C:\Program Files (x86)\BirdieSync\BirdieSync.exe [998912 2014-07-26] (Callicia)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [455392 2015-04-10] (Sony)
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x91000000
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\MountPoints2: {fd150f38-4eca-11e2-af08-005056c00008} - F:\AutoRun.exe
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\MountPoints2: {fd150f49-4eca-11e2-af08-005056c00008} - G:\AutoRun.exe
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2012-09-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!Fernzugang.lnk [2015-04-24]
ShortcutTarget: FRITZ!Fernzugang.lnk -> C:\Program Files\FRITZ!Fernzugang\FRITZVPN.exe (AVM Berlin)
Startup: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk [2014-04-23]
ShortcutTarget: Mediencenter.lnk -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\Mediencenter.exe (Deutsche Telekom AG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVer HID Receiver.lnk [2012-09-14]
ShortcutTarget: AVer HID Receiver.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerHIDReceiver.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AVerQuick.lnk [2012-09-14]
ShortcutTarget: AVerQuick.lnk -> C:\Program Files (x86)\Common Files\AVerMedia\AVerQuick\AVerQuick.exe (AVerMedia TECHNOLOGIES, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2012-09-11]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
SSODL: EldosMountNotificator-cbfs4 - {A18FEDFC-D96F-49FD-AA90-1B5F433256C1} - C:\Windows\system32\cbfsMntNtf4.dll (EldoS Corporation)
SSODL-x32: EldosMountNotificator-cbfs4 - {A18FEDFC-D96F-49FD-AA90-1B5F433256C1} - C:\Windows\SysWOW64\cbfsMntNtf4.dll (EldoS Corporation)
ShellIconOverlayIdentifiers: [ QsyncEx_Icon1] -> {9EF65B94-EC0D-49F7-B46D-006B388EB03E} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon2] -> {15A36E9F-69F5-4FE9-8752-1BD4F9B90DCD} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: [ QsyncEx_Icon3] -> {70ADB694-0DFE-49CF-A35B-92FE001C37A7} => C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll [2015-04-01] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [01Mediencenter_InSync] -> {77BC4082-DB5F-439A-8DC8-F9E24A63B0DE} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [02Mediencenter_ToSync] -> {528EE335-5034-4EFC-834E-63E5F02D2BC2} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [03Mediencenter_Failed] -> {6066ADF0-9EB0-43E5-ADB6-990F5A3B979C} => C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll [2013-10-01] (Deutsche Telekom AG)
ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2013-10-01] ()
ShellIconOverlayIdentifiers: [EldosIconOverlay-cbfs4] -> {814B7613-1A49-4450-91C0-5893D066B662} => C:\Windows\system32\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
ShellIconOverlayIdentifiers-x32: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll [2015-02-11] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [EldosIconOverlay-cbfs4] -> {814B7613-1A49-4450-91C0-5893D066B662} => C:\Windows\SysWOW64\cbfsMntNtf4.dll [2013-11-15] (EldoS Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1988550429-4052914518-1190181641-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO: TrueSuite Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\Lenovo Fingerprint Reader\IEBHO.DLL [2012-06-07] (AuthenTec Inc.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-13] (Advanced Micro Devices)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: TrueSuite Browser Helper Object -> {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} -> C:\Program Files\Lenovo Fingerprint Reader\x86\IEBHO.dll [2012-06-07] (AuthenTec Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://files.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://files.creative.com/Web/softwareupdate/ocx/150323/CTPID.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2011-04-23] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2011-04-22] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2011-04-23] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2011-04-22] (Microsoft Corporation)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C82A5402-CF07-4458-BA15-A26B625DBCEC}: [NameServer] 193.189.244.225 193.189.244.206
FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF HKLM-x32\...\Sunbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Sunbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Sunbird Service [2014-12-09]
FF HKLM-x32\...\Thunderbird\Extensions: [{A69F5EC7-88F0-4902-A15C-E569DFA33C3A}] - C:\Program Files (x86)\BirdieSync\Thunderbird Service
FF Extension: BirdieSync - C:\Program Files (x86)\BirdieSync\Thunderbird Service [2014-12-09]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [cdkedefaddcdlpmiafhicjnkbogjiogj] - C:\Program Files\Lenovo Fingerprint Reader\x86\tschrome.crx [2012-03-13]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [File not signed]
S2 AVerRemote; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe [348160 2009-10-31] (AVerMedia) [File not signed]
S2 AVerScheduleService; C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe [397312 2009-12-07] () [File not signed]
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3438032 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [311792 2015-04-15] (AVG Technologies CZ, s.r.o.)
R2 avmike; C:\Program Files\FRITZ!Fernzugang\avmike.exe [337824 2012-11-28] (AVM Berlin)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [File not signed]
R2 certsrv; C:\Program Files\FRITZ!Fernzugang\certsrv.exe [143776 2012-11-28] (AVM Berlin)
S2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-10-07] () [File not signed]
S2 FPLService; C:\Program Files\Lenovo Fingerprint Reader\TrueSuiteService.exe [328552 2012-06-07] (AuthenTec, Inc)
S2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 nwtsrv; C:\Program Files\FRITZ!Fernzugang\nwtsrv.exe [191328 2013-06-10] (AVM Berlin)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Crypkey License; crypserv.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
S3 AVerAF15DMBTH64; C:\Windows\System32\Drivers\AVerAF15DMBTH64.sys [592256 2009-07-27] (AVerMedia TECHNOLOGIES, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [284128 2015-04-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [213984 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [256992 2015-04-15] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [344544 2015-03-11] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [137184 2015-04-03] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [291296 2015-04-07] (AVG Technologies CZ, s.r.o.)
S3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [163368 2012-04-01] (Broadcom Corporation.)
R1 cbfs4; C:\Windows\system32\drivers\cbfs4.sys [387776 2013-11-15] (EldoS Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [246224 2009-12-07] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 NWIM; C:\Windows\System32\DRIVERS\avmnwim.sys [412024 2011-07-05] (AVM Berlin)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [259688 2011-10-27] (Realtek Semiconductor Corp.)
R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1120032 2014-04-08] (Acronis International GmbH)
R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [198432 2014-04-08] (Acronis International GmbH)
S3 tvtvcamd; C:\Windows\System32\DRIVERS\tvtvcamd.sys [27432 2011-12-07] (ThinkVantage Communications Utility)
S3 UHSfiltv; C:\Windows\System32\drivers\UHSfiltv.sys [23552 2014-12-22] (Creative Technology Ltd.)
U5 UnlockerDriver5; C:\Portable Software\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usbscan; C:\Windows\SysWOW64\DRIVERS\usbscan.sys [12400 1999-10-13] (Microsoft Corporation) [File not signed]
R0 vidsflt; C:\Windows\System32\DRIVERS\vidsflt.sys [117024 2014-04-08] (Acronis International GmbH)
R3 vmkbd2; C:\Windows\system32\drivers\VMkbd.sys [33496 2015-01-16] (VMware, Inc.)
R3 vpnpbus; C:\Windows\System32\DRIVERS\vpnpbus.sys [18624 2013-11-15] (EldoS Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [73296 2013-10-08] (VMware, Inc.)
S1 NetworkX; \SystemRoot\system32\ckldrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-07 11:22 - 2015-05-07 11:22 - 00025360 _____ () C:\Users\Administrator\Desktop\FRST.txt
2015-05-07 11:21 - 2015-05-07 11:21 - 00000742 _____ () C:\Users\Administrator\Desktop\JRT.txt
2015-05-07 11:18 - 2015-05-07 11:18 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-IBM2012-Windows-7-Home-Premium-(64-bit).dat
2015-05-07 11:18 - 2015-05-07 11:18 - 00000000 ____D () C:\RegBackup
2015-05-07 11:16 - 2015-05-07 11:16 - 02716843 _____ (Thisisu) C:\Users\Administrator\Desktop\JRT.exe
2015-05-07 11:15 - 2015-05-07 11:14 - 00001872 _____ () C:\Users\Administrator\Desktop\mbam.txt
2015-05-07 09:16 - 2015-05-07 09:16 - 00000022 _____ () C:\Windows\S.dirmngr
2015-05-06 23:23 - 2015-05-07 11:12 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-06 23:22 - 2015-05-06 23:22 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-06 23:22 - 2015-05-06 23:22 - 00001102 _____ () C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-06 23:22 - 2015-05-06 23:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-05-06 23:22 - 2015-05-06 23:22 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-06 23:22 - 2015-05-06 23:22 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-05-06 23:22 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-06 23:22 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-06 23:22 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-06 21:56 - 2015-05-07 11:22 - 00000000 ____D () C:\FRST
2015-05-06 21:56 - 2015-05-06 21:56 - 02102272 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2015-05-06 09:08 - 2015-05-06 09:23 - 00000000 ____D () C:\AdwCleaner
2015-05-05 21:04 - 2014-07-29 23:40 - 00002770 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2015-05-04 14:51 - 2015-05-04 14:52 - 00007601 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2015-05-01 09:02 - 2015-05-01 09:02 - 00008488 _____ () C:\Windows\DPINST.LOG
2015-04-24 11:21 - 2015-04-24 11:21 - 00001876 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\QNAP Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00001870 _____ () C:\Users\Public\Desktop\Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00001870 _____ () C:\ProgramData\Desktop\Qsync.lnk
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\Users\Administrator\AppData\Local\QNAP
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QNAP
2015-04-24 11:21 - 2015-04-24 11:21 - 00000000 ____D () C:\Program Files (x86)\QNAP
2015-04-24 10:43 - 2015-04-24 10:48 - 00000000 ____D () C:\Program Files\FRITZ!Fernzugang
2015-04-24 10:43 - 2015-04-24 10:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FRITZ!Fernzugang
2015-04-24 10:43 - 2015-04-24 10:43 - 00000000 ____D () C:\ProgramData\AVM
2015-04-24 10:38 - 2015-04-24 10:38 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\TeamViewer
2015-04-23 17:54 - 2015-04-23 17:54 - 00001217 _____ () C:\Users\Administrator\Desktop\Sound Blaster Systemsteuerung.lnk
2015-04-23 17:54 - 2015-04-23 17:54 - 00000000 ____D () C:\Users\Public\Documents\Creative
2015-04-23 17:54 - 2015-04-23 17:54 - 00000000 ____D () C:\ProgramData\Documents\Creative
2015-04-23 17:47 - 2015-04-23 17:47 - 00000000 ____D () C:\ProgramData\Creative
2015-04-23 17:39 - 2015-04-23 17:39 - 00466520 _____ (Creative Labs) C:\Windows\system32\wrap_oal.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00445016 _____ (Creative Labs) C:\Windows\SysWOW64\wrap_oal.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00123480 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\system32\OpenAL32.dll
2015-04-23 17:39 - 2015-04-23 17:39 - 00109144 _____ (Portions (C) Creative Labs Inc. and NVIDIA Corp.) C:\Windows\SysWOW64\OpenAL32.dll
2015-04-23 17:39 - 2014-10-13 10:45 - 01898496 ____N (Creative) C:\Windows\system32\Sens_oal.dll
2015-04-23 17:39 - 2014-10-13 10:36 - 01609728 ____N (Creative) C:\Windows\SysWOW64\Sens_oal.dll
2015-04-23 17:38 - 2015-04-23 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative
2015-04-23 17:38 - 2015-04-23 17:38 - 00002133 _____ () C:\Users\Public\Desktop\Creative-Produktregistrierung.lnk
2015-04-23 17:38 - 2015-04-23 17:38 - 00002133 _____ () C:\ProgramData\Desktop\Creative-Produktregistrierung.lnk
2015-04-23 17:38 - 2014-02-26 17:20 - 02584576 ____N (Creative Technology Ltd.) C:\Windows\SysWOW64\HsMalc32.dll
2015-04-23 17:38 - 2014-02-24 23:30 - 00145408 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTHIDRpA.hsf
2015-04-23 17:38 - 2014-02-24 23:30 - 00095232 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTHID.hsf
2015-04-23 17:38 - 2011-07-12 13:12 - 00098304 ____N (Creative Technology Ltd) C:\Windows\SysWOW64\CTIntrfu.hsf
2015-04-23 17:38 - 2006-10-06 14:17 - 00053248 ____N (Creative Technology Ltd ) C:\Windows\Ctregrun.exe
2015-04-23 17:38 - 2003-06-12 23:25 - 00007062 _____ () C:\Windows\SysWOW64\audiopid.vxd
2015-04-23 17:37 - 2015-04-23 17:39 - 00000000 ____D () C:\Program Files (x86)\Creative
2015-04-23 17:37 - 2015-04-23 17:38 - 00000414 ___RH () C:\Windows\ctfile.rfc
2015-04-23 17:37 - 2015-04-23 17:37 - 00000000 ____D () C:\Program Files\Creative
2015-04-23 17:37 - 2015-01-05 11:13 - 00033905 _____ () C:\Windows\system32\UHS.ini
2015-04-23 17:37 - 2015-01-05 11:13 - 00001900 _____ () C:\Windows\SBRoar.ini
2015-04-23 17:37 - 2014-11-28 13:41 - 00089600 _____ () C:\Windows\system32\CmdRtr64.DLL
2015-04-23 17:37 - 2014-11-28 13:41 - 00074240 _____ () C:\Windows\SysWOW64\CmdRtr.DLL
2015-04-23 17:37 - 2014-11-28 13:40 - 00365568 _____ () C:\Windows\system32\APOMgr64.DLL
2015-04-23 17:37 - 2014-11-28 13:38 - 00274944 _____ () C:\Windows\SysWOW64\APOMngr.DLL
2015-04-22 09:29 - 2015-05-07 09:16 - 00001214 _____ () C:\Windows\PFRO.log
2015-04-15 13:06 - 2015-04-15 13:06 - 00256992 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys
2015-04-15 09:56 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-15 09:56 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-15 09:56 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-15 09:55 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-15 09:55 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-15 09:55 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-15 09:55 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-15 09:55 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-15 09:55 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-15 09:55 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-15 09:55 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-15 09:55 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-15 09:55 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-15 09:55 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-15 09:55 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-15 09:55 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-15 09:55 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-15 09:55 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-15 09:55 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-15 09:55 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-15 09:55 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-15 09:55 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-15 09:55 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-15 09:55 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-15 09:55 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-15 09:55 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-15 09:55 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-15 09:55 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-15 09:55 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-15 09:55 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-15 09:55 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-15 09:55 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-15 09:55 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-15 09:55 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-15 09:55 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-15 09:55 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-15 09:55 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 09:53 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-15 09:53 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-15 09:53 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-13 11:37 - 2015-04-13 11:37 - 00000000 ____D () C:\Users\Administrator\Documents\Beck
2015-04-13 11:34 - 2015-04-13 11:37 - 00001702 _____ () C:\Users\Administrator\Desktop\Beck ProzFormB.lnk
2015-04-09 21:15 - 2015-01-16 18:15 - 00064728 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmx86.sys
2015-04-09 21:15 - 2015-01-16 18:14 - 00033496 _____ (VMware, Inc.) C:\Windows\system32\Drivers\VMkbd.sys
2015-04-09 21:15 - 2013-10-08 18:21 - 00073296 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vsock.sys
2015-04-09 21:15 - 2013-10-08 18:21 - 00067664 _____ (VMware, Inc.) C:\Windows\system32\vsocklib.dll
2015-04-09 21:15 - 2013-10-08 18:21 - 00063568 _____ (VMware, Inc.) C:\Windows\SysWOW64\vsocklib.dll
2015-04-09 21:14 - 2015-04-09 21:14 - 00002120 _____ () C:\Users\Public\Desktop\VMware Player.lnk
2015-04-09 21:14 - 2015-04-09 21:14 - 00002120 _____ () C:\ProgramData\Desktop\VMware Player.lnk
2015-04-09 21:14 - 2015-04-09 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
2015-04-09 21:14 - 2015-04-09 21:14 - 00000000 ____D () C:\Program Files\Common Files\VMware
2015-04-09 21:14 - 2015-01-16 18:15 - 00931032 _____ (VMware, Inc.) C:\Windows\system32\vnetlib64.dll
2015-04-09 21:14 - 2015-01-16 18:15 - 00437976 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
2015-04-09 21:14 - 2015-01-16 18:15 - 00359128 _____ (VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
2015-04-09 21:14 - 2015-01-16 18:15 - 00031448 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmnetuserif.sys
2015-04-09 21:14 - 2014-08-21 08:07 - 00054976 _____ (VMware, Inc.) C:\Windows\system32\Drivers\hcmon.sys
2015-04-09 21:14 - 2014-08-21 08:06 - 00046144 _____ (VMware, Inc.) C:\Windows\system32\Drivers\vmusb.sys
2015-04-09 21:13 - 2015-04-09 21:13 - 00000000 ____D () C:\Program Files (x86)\VMware
2015-04-09 14:11 - 2015-04-09 14:11 - 00284128 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-04-07 12:39 - 2015-04-07 12:39 - 00291296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-07 11:20 - 2013-10-03 15:22 - 00000000 ____D () C:\ProgramData\MFAData
2015-05-07 11:17 - 2013-04-26 09:08 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Mozilla
2015-05-07 11:17 - 2012-09-14 11:29 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Mozilla
2015-05-07 11:15 - 2013-04-30 10:43 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Foxit Software
2015-05-07 09:25 - 2009-07-14 06:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-07 09:25 - 2009-07-14 06:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-07 09:23 - 2012-09-11 21:15 - 01853587 _____ () C:\Windows\WindowsUpdate.log
2015-05-07 09:23 - 2011-04-12 09:43 - 00702388 _____ () C:\Windows\system32\perfh007.dat
2015-05-07 09:23 - 2011-04-12 09:43 - 00151022 _____ () C:\Windows\system32\perfc007.dat
2015-05-07 09:23 - 2009-07-14 07:13 - 01628890 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-07 09:19 - 2012-09-13 01:05 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Dropbox
2015-05-07 09:16 - 2015-03-31 08:26 - 00002729 _____ () C:\Windows\setupact.log
2015-05-07 09:16 - 2012-09-13 14:59 - 00000000 ____D () C:\ProgramData\VMware
2015-05-07 09:16 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-07 02:17 - 2012-09-14 15:59 - 00000000 ____D () C:\Users\Administrator\Documents\AVerTV
2015-05-06 23:50 - 2012-09-14 15:57 - 00000000 ____D () C:\Users\Administrator\AppData\Local\AVerMedia
2015-05-06 08:14 - 2014-11-13 10:18 - 00000000 ____D () C:\ProgramData\AVG2015
2015-05-05 09:52 - 2012-09-13 15:01 - 00000000 ____D () C:\Users\Administrator\AppData\Local\VMware
2015-05-05 09:43 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-05-05 09:39 - 2012-09-13 15:00 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\VMware
2015-05-01 09:02 - 2014-12-14 23:03 - 00002026 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2015-05-01 09:02 - 2014-12-14 23:03 - 00002026 _____ () C:\ProgramData\Desktop\Sony PC Companion 2.1.lnk
2015-05-01 09:02 - 2014-12-14 23:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-05-01 09:01 - 2012-09-11 17:05 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-30 12:59 - 2013-03-01 22:56 - 00011807 _____ () C:\Users\Administrator\gsview64.ini
2015-04-30 08:59 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-26 16:52 - 2012-09-13 01:08 - 00001040 _____ () C:\Users\Administrator\Desktop\Dropbox.lnk
2015-04-26 16:52 - 2012-09-13 01:05 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-04-17 09:56 - 2014-11-13 10:20 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-04-17 09:56 - 2014-11-13 10:20 - 00000981 _____ () C:\ProgramData\Desktop\AVG 2015.lnk
2015-04-17 09:56 - 2014-04-01 09:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-04-16 08:45 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-04-15 21:52 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-15 10:03 - 2012-09-13 01:17 - 01603170 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-15 10:02 - 2013-08-26 09:13 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 09:58 - 2012-09-13 01:18 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
==================== Files in the root of some directories =======
2012-09-14 19:06 - 2013-11-20 17:33 - 1178624 _____ (CPUID) C:\Users\Administrator\AppData\Roaming\siw_sdk.dll
2013-01-17 19:54 - 2013-01-17 19:54 - 0003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-09-17 21:49 - 2013-03-11 12:13 - 0000600 _____ () C:\Users\Administrator\AppData\Local\PUTTY.RND
2015-05-05 21:04 - 2014-07-29 23:40 - 0002770 _____ () C:\Users\Administrator\AppData\Local\recently-used.xbel
2015-05-04 14:51 - 2015-05-04 14:52 - 0007601 _____ () C:\Users\Administrator\AppData\Local\Resmon.ResmonCfg
2012-09-25 19:24 - 2012-09-25 19:24 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpn28myg.dll
C:\Users\Administrator\AppData\Local\Temp\Quarantine.exe
C:\Users\Administrator\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-04 17:23
==================== End Of Log ============================
--- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 06-05-2015 01
Ran by Administrator at 2015-05-07 11:23:21
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1988550429-4052914518-1190181641-500 - Administrator - Enabled) => C:\Users\Administrator
Gast (S-1-5-21-1988550429-4052914518-1190181641-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1988550429-4052914518-1190181641-1002 - Limited - Enabled)
JCK2012 (S-1-5-21-1988550429-4052914518-1190181641-1000 - Administrator - Enabled) => C:\Users\JCK2012
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus 2015 (Enabled - Up to date) {4D41356F-32AD-7C42-C820-63775EE4F413}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus 2015 (Enabled - Up to date) {F620D48B-1497-73CC-F290-58052563BEAE}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.00.595.5857 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.00.595.5857 - ABBYY) Hidden
Acronis True Image 2014 (HKLM-x32\...\{3ECDD663-5AF8-489B-9E3C-561F33A271BD}Visible) (Version: 17.0.6673 - Acronis)
Acronis True Image 2014 (x32 Version: 17.0.6673 - Acronis) Hidden
AMD Catalyst Install Manager (HKLM\...\{5E03A267-415E-5383-FA8F-3CE4145663B9}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 3.3.26.0 - AppEx Networks)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.72.00 - )
Audioactive Production Studio (HKLM-x32\...\Audioactive Production Studio) (Version: - )
AVerMedia A850 USB DMB-TH 1.0.64.28 (HKLM-x32\...\AVerMedia A850 USB DMB-TH) (Version: 1.0.64.28 - AVerMedia TECHNOLOGIES, Inc.)
AVerTV (HKLM-x32\...\InstallShield_{E28B1E6F-E0AA-4228-AB89-DB4A0C89D426}) (Version: 6.0.18 - AVerMedia Technologies, Inc.)
AVerTV (x32 Version: 6.0.18 - AVerMedia Technologies, Inc.) Hidden
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5941 - AVG Technologies)
AVG 2015 (Version: 15.0.4342 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5941 - AVG Technologies) Hidden
Back4Sure 3.4.0 (HKLM-x32\...\Back4Sure_is1) (Version: - Ulrich Krebs)
BirdieSync 2.4.10.0 (HKLM-x32\...\BirdieSync) (Version: 2.4.10.0 - Callicia)
Boxcryptor 2.0 (HKLM-x32\...\{EBFEBFC7-B128-4700-ADBC-E839BFC833AE}) (Version: 2.0.419.376 - Secomba GmbH)
Brother MFL-Pro Suite MFC-1810 series (HKLM-x32\...\{90C24B16-9C28-44AB-8C63-BB9822218E18}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
Brother MFL-Pro Suite MFC-7420 (HKLM-x32\...\{C2530D63-B66B-48B5-BB50-7C6281FE7AA6}) (Version: 1.0.1.0 - Brother Industries, Ltd.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version: - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: - )
Canon MP Navigator EX 4.1 (HKLM-x32\...\MP Navigator EX 4.1) (Version: - )
Canon MX880 series Benutzerregistrierung (HKLM-x32\...\Canon MX880 series Benutzerregistrierung) (Version: - )
Canon MX880 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX880_series) (Version: - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version: - )
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.54.42.0 - Conexant)
Creative Systeminformationen (HKLM-x32\...\SysInfo) (Version: 1.10 - Creative Technology Limited)
Dropbox (HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Dropbox) (Version: 3.4.3 - Dropbox, Inc.)
Dropbox (HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Dropbox) (Version: 3.4.4 - Dropbox, Inc.)
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.32 - )
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
eXPert PDF 6 (HKLM-x32\...\{FC279721-37A6-4777-AFD8-7A56681EBA14}) (Version: 6.20.400.0 - Avanquest software)
Fingerprint Reader (HKLM\...\{C5BB9380-D729-410A-A440-061EBCADCCB9}) (Version: 5.4.100.232 - AuthenTec, Inc.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
FRITZ!Fernzugang (HKLM\...\{DD57CC22-8864-4CCA-94D4-600D024C1207}) (Version: 1.3.1 - AVM Berlin)
Google Books Downloader version 2.3 (HKLM-x32\...\{216729B6-014A-F413-814F-F17F74FBA113}_is1) (Version: 2.3 - GBOOKSDOWNLOADER.COM)
Gpg4win (2.2.1) (HKLM-x32\...\GPG4Win) (Version: 2.2.1 - The Gpg4win Project)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.07) (Version: 9.07 - Artifex Software Inc.)
GSview 5.0 (HKLM\...\GSview 5.0) (Version: 5.0 - Ghostgum Software Pty Ltd)
Integrated Camera Driver Installer Package Ver.1.2.1.18 (HKLM-x32\...\{A78800AF-1779-4AE8-8EBE-16E1BE727C71}) (Version: 1.2.1.18 - RICOH)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.11 - )
Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{A7BB9BBD-DFE4-4276-820A-7CD141FC09E6}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{1C83CB66-D345-4D6C-95A2-63A03269ADA0}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.09.03 - )
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG)
Mediencenter 3.9.1055.64 (HKU\S-1-5-21-1988550429-4052914518-1190181641-500\...\Mediencenter) (Version: 3.9.1055.64 - Deutsche Telekom AG)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Image Composite Editor (HKLM\...\{B821CDAA-34DE-46FD-87C9-E6EE7158DB5D}) (Version: 1.4.4 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobile Partner (HKLM-x32\...\Mobile Partner) (Version: 16.002.03.02.511 - Huawei Technologies Co.,Ltd)
OVTScanner_X64 (HKLM-x32\...\{AE09704D-9051-4C25-B940-77F889F0C93F}) (Version: 1.00.0000 - Ihr Firmenname)
PDF Expert 6 - Installer (HKLM-x32\...\{4F09C764-E4DB-4DED-8489-55119833FAF7}_is1) (Version: - Avanquest GmbH)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
PhonerLite 2.08 (HKLM-x32\...\PhonerLite_is1) (Version: 2.08 - Heiko Sommerfeldt)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
QNAP Qsync (HKLM-x32\...\Qsync) (Version: 1.4.0.0401 - QNAP Systems, Inc.)
QuickShare (HKLM-x32\...\{6903918F-8A5A-4C72-9573-0F2D1559F28C}) (Version: 1.6.1.945 - Linkury Inc.) <==== ATTENTION
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.29005 - Realtek Semiconductor Corp.)
ReOrganize! (HKLM-x32\...\ReOrganize_is1) (Version: 2.3.1 - Oliver Frietsch)
SilverFast AFL 6.6.2r3 (HKLM-x32\...\SilverFast AFL) (Version: - LaserSoft Imaging AG)
SIW version 2011.10.29 (HKLM-x32\...\{AB67580-257C-45FF-B8F4-C8C30682091A}_is1) (Version: 2011.10.29 - Topala Software Solutions)
Skype™ 6.6 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.6.106 - Skype Technologies S.A.)
Sony PC Companion 2.10.259 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.259 - Sony)
Sound Blaster (HKLM-x32\...\{0DB55276-875C-43BA-AD29-E73F6E5F3C3C}) (Version: 1.00.02 - Creative Technology Limited)
Sound Blaster Extras (HKLM-x32\...\{469CFC5B-8924-4EE6-B5C9-B37801C883AC}) (Version: 1.0 - Creative Technology Limited)
Streamripper (Remove only) (HKLM-x32\...\Streamripper) (Version: - )
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17311226DF01}) (Version: 1.00.0031.1 - REALTEK Semiconductor Corp.)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.5 - Lenovo)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
Unlocker 1.9.1-x64 (HKLM\...\Unlocker) (Version: 1.9.1 - Cedrick Collomb)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 6.0.5 - VMware, Inc)
VMware Player (Version: 6.0.5 - VMware, Inc.) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.2700 - Broadcom Corporation)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{268502F4-815D-4358-A8D6-B783FDB58EF0}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.ContextMenuHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{528EE335-5034-4EFC-834E-63E5F02D2BC2}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{6066ADF0-9EB0-43E5-ADB6-990F5A3B979C}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{77BC4082-DB5F-439A-8DC8-F9E24A63B0DE}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Telekom\MediencenterSync\DTAG.Mediencenter.IconOverlayHandler.dll (Deutsche Telekom AG)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Administrator\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
==================== Restore Points =========================
04-05-2015 17:29:30 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {52C4CC27-3CB6-4EC5-98A0-353772E2B426} - System32\Tasks\{82D964E7-E2D7-4A70-9797-74891AA23934} => pcalua.exe -a "C:\Portable Software\ReOrganize\reorganize-2.3.exe" -d "C:\Portable Software\ReOrganize"
Task: {DF61C7C2-7A62-42A0-A810-F57DFC6FBC8C} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe
Task: {E3B075E4-8ED4-45C3-8855-560C6A6C0BFA} - System32\Tasks\{BC3F0491-99F7-4E20-BCCA-13B61F7AC639} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/abandoninstall?page=tsMain
==================== Loaded Modules (whitelisted) ==============
2015-04-01 10:57 - 2015-04-01 10:57 - 00297680 _____ () C:\Program Files (x86)\QNAP\Qsync\QsyncExt.dll
2012-09-14 16:50 - 2012-05-16 06:32 - 00103936 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2013-10-01 10:32 - 2013-10-01 10:32 - 02818216 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2009-11-19 06:01 - 2009-11-19 06:01 - 00022016 _____ () C:\Windows\System32\sugw2l6.dll
2014-02-04 18:25 - 2014-02-04 18:25 - 00028992 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-02-04 18:28 - 2014-02-04 18:28 - 00420160 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\ulxmlrpcpp.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1988550429-4052914518-1190181641-1000\Control Panel\Desktop\\Wallpaper ->
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\Control Panel\Desktop\\Wallpaper -> C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: LENOVO.TPKNRRES => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
MSCONFIG\startupreg: vspdfprsrv.exe => C:\Program Files (x86)\Visagesoft\eXPert PDF 6\vspdfprsrv.exe --background
==================== FirewallRules (whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [TCP Query User{E0794C75-51B0-405C-A0CB-024B9ECB4DA2}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Allow) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{6BB9F0B3-927C-451C-95A1-B223845F76CD}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Allow) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [{3D95A739-7F2A-4400-A50C-0E01F50DFA5C}] => (Allow) C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [{C7BC8372-902B-4129-A2DC-980E6DFA2C31}] => (Allow) C:\Users\Administrator\AppData\Roaming\Dropbox\bin\Dropbox.exe
FirewallRules: [TCP Query User{F56DAAF5-A41B-4885-A14B-E012D86B0F13}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Block) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{1C2F20E3-A6FA-41A5-82B5-40793C841CD8}C:\portable software\skype portable\app\skype\phone\skype.exe] => (Block) C:\portable software\skype portable\app\skype\phone\skype.exe
FirewallRules: [{6EF65702-3348-438F-B417-5F01F482A678}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{BB01EB0C-379D-4C02-B7BE-052F43B925C3}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [UDP Query User{4925C806-4344-4D6D-8B18-EB8B8A3504F5}C:\program files (x86)\phonerlite\phonerlite.exe] => (Allow) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{3FFE524A-4FDB-4BDD-AB36-989B4CF05A59}] => (Block) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{4491D6DF-4462-4F6C-9789-0AACE55942D2}] => (Block) C:\program files (x86)\phonerlite\phonerlite.exe
FirewallRules: [{F94DFBBC-253B-4794-A497-CE230262325B}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{69E2FCC2-2AB9-4807-952F-81CE1BD68E20}] => (Allow) C:\Program Files (x86)\AVG\AVG2014\avgmfapx.exe
FirewallRules: [{B1A44FD4-B70C-4A66-8FE7-163BD42DD7EA}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{215E7707-D79F-443C-89B8-D864782CEC50}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{D5BA8CA3-FE64-4E2C-95B1-2583931C023A}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{567B5F01-57B4-4ED2-9652-B07E46F38C31}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe
FirewallRules: [{E4652D12-7EB9-4705-A938-D256F9EE8D32}] => (Allow) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
FirewallRules: [{9CB37AEE-2113-4119-AB3E-B9FFD589A4E7}] => (Allow) C:\Program Files (x86)\BirdieSync\BirdieSync.exe
FirewallRules: [TCP Query User{E31C3700-B381-4BBE-BA2F-A74219245C41}C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe] => (Allow) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [UDP Query User{84451407-AD95-4D56-9091-AD58F1164C79}C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe] => (Allow) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [{6C9421A3-5945-44CD-A7F9-D7751D58EA7A}] => (Block) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [{3CD36139-7DF7-47B5-93C5-26F6D241B076}] => (Block) C:\portable software\thunderbird portable\app\thunderbird\thunderbird.exe
FirewallRules: [TCP Query User{A64CA42D-9406-44BC-A443-031DE244D6E7}C:\portable software\firefox portable\app\firefox\firefox.exe] => (Allow) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{387D5346-9670-4C39-8116-E57A6DD0DA8F}C:\portable software\firefox portable\app\firefox\firefox.exe] => (Allow) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{35AE65BE-548F-4E14-AF0B-759CD6F892C0}] => (Block) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{C747FA3C-86A0-4CB9-88D3-4D3782E43EAC}] => (Block) C:\portable software\firefox portable\app\firefox\firefox.exe
FirewallRules: [{B5598505-1B8E-4D01-9DEC-FD3A069A7FA0}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{182FB336-4185-41E1-B61C-FE21A63412FA}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{D60802F1-BD55-4095-8195-2F70A67299D2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{E8CDB05E-0217-429E-8CA5-13EF5533C0A9}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
FirewallRules: [{690C5CAD-8FD1-4BF7-88C7-EC7D7490F9C2}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{072FDB81-042F-42E8-A2B1-A9A7A61B1D2F}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgdiagex.exe
FirewallRules: [{FE47882D-1E98-4DDF-9CFA-39DBD7403298}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [{73E7F4EA-58AB-43A7-B9F6-9A8CB9808243}] => (Allow) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
FirewallRules: [TCP Query User{FD2D0632-7455-41AF-BB1E-9B9B9524A066}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [UDP Query User{8E12A9A7-F23C-4A82-A3E9-3E8D12940D82}C:\program files (x86)\qnap\qsync\qsync.exe] => (Allow) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [{D2C9EE95-9B90-42FC-98BD-D5D6F714C073}] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
FirewallRules: [{979089F1-8350-4FC0-83FC-55F6D1D0F9FB}] => (Block) C:\program files (x86)\qnap\qsync\qsync.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/07/2015 09:17:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/07/2015 09:17:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/07/2015 09:16:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 11:55:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: TouchControl.exe, Version: 5.4.100.232, Zeitstempel: 0x4fd0279e
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18798, Zeitstempel: 0x5507b87a
Ausnahmecode: 0x80004004
Fehleroffset: 0x000000000001aaad
ID des fehlerhaften Prozesses: 0x1038
Startzeit der fehlerhaften Anwendung: 0xTouchControl.exe0
Pfad der fehlerhaften Anwendung: TouchControl.exe1
Pfad des fehlerhaften Moduls: TouchControl.exe2
Berichtskennung: TouchControl.exe3
Error: (05/06/2015 11:42:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 11:42:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 11:42:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 09:40:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 09:40:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (05/06/2015 09:39:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (05/07/2015 11:18:58 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Acronis Sync Agent Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/07/2015 11:18:57 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "BrYNSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo Auto Scroll" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "VMware Authorization Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo Hotkey Client Loader" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Lenovo Microphone Mute" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "VMware DHCP Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "VMware NAT Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 1000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Anzeige am Bildschirm" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (05/07/2015 11:18:52 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Conexant SmartAudio service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (05/07/2015 09:17:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/07/2015 09:17:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/07/2015 09:16:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 11:55:27 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: TouchControl.exe5.4.100.2324fd0279eKERNELBASE.dll6.1.7601.187985507b87a80004004000000000001aaad103801d088458bb04038C:\Program Files\Lenovo Fingerprint Reader\TouchControl.exeC:\Windows\system32\KERNELBASE.dll9aa70a59-f43a-11e4-921d-005056c00008
Error: (05/06/2015 11:42:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 11:42:41 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 11:42:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/06/2015 09:40:15 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 09:40:14 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFCLOC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"C:\Program Files (x86)\Canon\Solution Menu EX\MFC80U.DLL
Error: (05/06/2015 09:39:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: AMD A6-4400M APU with Radeon(tm) HD Graphics
Percentage of memory in use: 34%
Total physical RAM: 3512.95 MB
Available physical RAM: 2308.52 MB
Total Pagefile: 7024.09 MB
Available Pagefile: 5670.3 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:97.56 GB) (Free:34.48 GB) NTFS
Drive d: (Daten) (Fixed) (Total:368.1 GB) (Free:196.86 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 5837352B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=97.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=368.1 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
07.05.2015, 14:02
| #6 |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Servus, wir müssen noch etwas tiefer graben, um Quickshare komplett entfernen zu können: Lade dir die passende Version von SystemLook vom folgenden Spiegel herunter und speichere das Tool auf dem Desktop: SystemLook (32 bit) | SystemLook (64 bit)
|
|
07.05.2015, 16:14
| #7 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo Matthias! Puh! Das klingt nach Schwerarbeit! Ich hatte SystemLook gestern schon heruntergeladen, um Euch gleich mit einem Logfile bedienen zu können. Der Scan lief in der Tat "einige Zeit", nämlich ca. 5 Stunden. Um wieder (wenigstens eingeschränkt) an dem befallenen Rechner arbeiten zu können, habe ich ihn dann aber doch abbrechen müssen. Mein Vorschlag wäre, den Scan die Nacht über in der Hoffnung durchlaufen zu lassen, dass uns morgen entlastende Nachrichten vorliegen. Sofern keine Einwände bestehen, mache ich es so. Ggf. bis morgen! Jan |
|
07.05.2015, 19:25
| #8 |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Servus Jan, SystemLook ist eigentlich gar nicht so langsam... die Suche in der Registry kann zwar etwas dauern, aber länger als 10 min hatte ich noch nie... und das obwohl ich nach deutlich mehr Begriffen suchen hab lassen als die 3 bei dir. Führe einfach SystemLook wie beschrieben aus und poste die Logdatei. Ggf. kannst du die .txt auch zippen und dann als Anhang hochladen, wenn sie zu groß sein sollte. |
|
08.05.2015, 10:48
| #9 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo Matthias, hier das Logfile, das SystemLook auf dem Desktop generiert hat: Code:
ATTFilter SystemLook 30.07.11 by jpshortstuff
Log created at 00:31 on 08/05/2015 by Administrator
Administrator - Elevation successful
========== folderfind ==========
Searching for "*QuickShare*"
Nach Mitternacht und einem Neustart des Rechners sowie der Beendigung nicht benötigter Autostart-Software (z. B. Dropbox etc.) habe ich den Scan erneut (vom Desktop) gestartet und eben - nach gut acht Stunden - mit obigem Ergebnis abgebrochen. SystemLook belegt auf meinem Rechner *dauerhaft* zwischen 1,3 bis 1,8 GB RAM und ca. 50% Prozessorleistung. Zwei Screenshots unter: tinyurl.com/lz33ea9 Beste Grüße Jan Nachtrag: Diverse Versuche mit der 32-Bit-Version von SystemLook oder Anfragen mit reduziertem Umfang verliefen so ergebnislos wie die bisherigen Scans. Screenshots: tinyurl.com/ob4gwbc  |
|
08.05.2015, 19:32
| #10 |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Servus, du weißt aber schon, dass du die 64-bit Version von SystemLook verwenden musst? Starte deinen Rechner nach dieser Anleitung und führe das Tool im abgesicherten Modus aus. |
|
08.05.2015, 21:29
| #11 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hallo Matthias! Hmm, das war eine rhetorische Frage zur Version, nicht wahr? ;o) Im Ernst: Der Versuch eines Scans mit SystemLook im abgesicherten Modus erbrachte kein anderes Ergebnis als die bisherigen Scans: SystemLook füllt den RAM meines Rechners komplett auf und hält die CPU bei konstant 50% Leistung - mehr nicht. Screenshots dazu: tinyurl.com/lz33ea9 Nachdem Du gestern mitgeteilt hast, dass der Scan nicht mehr als 10 Minuten dauert, habe ich nach 30 Minuten (entnervt) abgebrochen. Schönen Abend noch! Jan |
|
08.05.2015, 21:32
| #12 |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Servus, dann versuchen wir jetzt eine Registry-Suche mit FRST:
|
|
08.05.2015, 21:40
| #13 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Hi Matthias, besten Dank für Deine Geduld und Hilfe! FRST64 funzt: Code:
ATTFilter Farbar Recovery Scan Tool (x64) Version: 06-05-2015 01
Ran by Administrator at 2015-05-08 22:36:05
Running from C:\Users\Administrator\Desktop
Boot Mode: Normal
================== Search Registry: "QuickShare;Linkury;Snap.do" ===========
===================== Search result for "QuickShare" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1988550429-4052914518-1190181641-500\Products\F8193096A5A827C45937F0D251952FC8\InstallProperties]
"URLInfoAbout"="hxxp://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C}]
"URLInfoAbout"="hxxp://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8]
"ProductName"="QuickShare"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"QuickShare.exe"="8888"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List]
"File2"="D:\EDV - Lenovo 535\_QuickShare\SystemLook64 AbgesModus Screenshot-05.jpg"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Windows\CurrentVersion\Applets\Paint\Recent File List]
"File4"="D:\EDV - Lenovo 535\_QuickShare\SystemLook64 AbgesModus Screenshot-03.jpg"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Smartbar]
"ExeName"="QuickShare.exe"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache]
"D:\EDV - Lenovo 535\_QuickShare\FRST64.exe"="Farbar Recovery Scan Tool"
===================== Search result for "Linkury" ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1988550429-4052914518-1190181641-500\Products\F8193096A5A827C45937F0D251952FC8\InstallProperties]
"HelpLink"="hxxp://www.linkury.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1988550429-4052914518-1190181641-500\Products\F8193096A5A827C45937F0D251952FC8\InstallProperties]
"URLInfoAbout"="hxxp://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C}]
"HelpLink"="hxxp://www.linkury.com"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C}]
"URLInfoAbout"="hxxp://www.linkury.com/faq/NS/faq.aspx?c=QuickShare"
[HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8\SourceList]
"PackageName"="LinkuryInstaller.msi"
====== End Of Search ======
|
|
08.05.2015, 21:44
| #14 |
| /// TB-Ausbilder | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 2 h) dauern. Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg. Schritt 1 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter start
CloseProcesses:
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C}
DeleteKey: HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8
DeleteKey: HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Smartbar
RemoveProxy:
EmptyTemp:
end
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte  SecurityCheck und:
Bitte poste mit deiner nächsten Antwort
|
|
09.05.2015, 06:49
| #15 |
| | QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) 08.05.2015: FRST ist abgestürzt, hat aber offenbar ein intaktes Fixlog erzeugen können: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-05-2015 01
Ran by Administrator at 2015-05-08 22:57:11 Run:1
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available profiles: JCK2012 & Administrator)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
start
CloseProcesses:
DeleteKey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C}
DeleteKey: HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8
DeleteKey: HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Smartbar
RemoveProxy:
EmptyTemp:
end
*****************
Processes closed successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6903918F-8A5A-4C72-9573-0F2D1559F28C} => Key Deleted successfully.
HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8 => Failed to delete key at first attempt (Error: C0000121), see next line.
HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Microsoft\Installer\Products\F8193096A5A827C45937F0D251952FC8 => Key Deleted Successfully.
HKEY_USERS\S-1-5-21-1988550429-4052914518-1190181641-500\Software\Smartbar => Key Deleted successfully.
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value deleted successfully.
HKU\S-1-5-21-1988550429-4052914518-1190181641-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value deleted successfully.
========= End of RemoveProxy: =========
Nach FRST hier nun die Ergebnisse von ESET (12 Funde nach ca. 4 Stunden) und Security-Check: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=abf2312d4afb67458bb4e87d575b8dcd
# engine=23762
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-09 01:26:02
# local_time=2015-05-09 03:26:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='AVG AntiVirus 2015'
# compatibility_mode=1054 16777213 100 100 65116 118265146 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 50428138 182764612 0 0
# scanned=288842
# found=12
# cleaned=0
# scan_time=14648
sh=54073C7A75DD71551658C741AB916556DB661945 ft=0 fh=0000000000000000 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Smartbar\Application\1Extension.crx.vir"
sh=48C826EF00938F035C91C9F6B3E167CB21D96633 ft=1 fh=59fac0a23423ab50 vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_16.dll.vir"
sh=45F4ABE93E1FB333545719948B418FB1207A5085 ft=1 fh=3a58b09db4698b9d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_17.dll.vir"
sh=C7E054C7BA58AE2D703DB29C52346A3ED84FEF57 ft=1 fh=53532950b9749a4f vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_20.dll.vir"
sh=C546BA3CA78F93EB65DCCEA191BC40B9F940E2EA ft=1 fh=6fd80785d353cf5d vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Administrator\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_21.dll.vir"
sh=0BFF84AA6CC4CCF580EAE2FBF4C129FA6EA612C4 ft=1 fh=9fe1a4845276fe8f vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\Ablage\Programmsammlung\Unlocker1.9.1-x64.exe"
sh=8563AC611EF330792E8D376115854AAE1F77DEE8 ft=1 fh=ec2e90040c7779e6 vn="Variante von Win32/Toolbar.Funmoods.B evtl. unerwünschte Anwendung" ac=I fn="D:\EDV - Lenovo 535\Software\Multimedia\agsetup183se.exe"
sh=4B3B53C00DBDDB5564D6CA9ECD2D0FFEC79B5332 ft=1 fh=086f60695f796502 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\EDV - Lenovo 535\Software\Multimedia\FreeWebMVideoConverter.exe"
sh=6E45431B698CDB7BE8F1A41266BE7B327F33AD38 ft=1 fh=e5f91a3476785862 vn="Win32/Adware.ADON evtl. unerwünschte Anwendung" ac=I fn="D:\EDV - Lenovo 535\Software\Tools\Unlocker1.9.1.exe"
sh=3921CD27F4BD81B0FF0DE29A855DF6026AF3D15C ft=1 fh=bd7257891175493f vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Virtual Machines\Windows XP Home Edition (Exchange-Ordner)\Programmsammlung\Free Video Studio\FreeStudio.exe"
sh=5292E1E064935067EC41DDB53199480BBFC3BF7E ft=1 fh=f4c2c613567db936 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Virtual Machines\Windows XP Home Edition (Exchange-Ordner)\Programmsammlung\Free Video Studio\FreeVideoToJPGConverter.exe"
sh=E65E22F2173FB6DD85543B9E4514D0C5910C6F9B ft=1 fh=686c686677f10e67 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="D:\Virtual Machines\Windows XP Home Edition (Exchange-Ordner)\Programmsammlung\Free Video Studio\FreeVideoToJPGConverter_5.0.17.903.exe"
Code:
ATTFilter Results of screen317's Security Check version 1.001
Windows 7 Service Pack 1 x64 (UAC is enabled)
``````````````Antivirus/Firewall Check:``````````````
AVG AntiVirus 2015
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Java 8 Update 31
Java version 32-bit out of Date!
````````Process Check: objlist.exe by Laurent````````
AVG avgwdsvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Kannst Du mir etwas (Beruhigendes) zu dem Risiko sagen, dass mein Rechner während der Zeit, in der wegen "ESET Online Scanner" trotz bestehender Internetverbindung die Firewall abgeschaltet und der AVG-Schutz deaktiviert war, angegriffen wurde? Welches der Tools wäre geeignet, um hier vorsorglich zu ermitteln? Und überhaupt: Welchen Wert hat eine (kommerzielle) Anti-Viren-Software, die den Nutzer alarmiert und mit der Mitteilung in (trügerische?) Sicherheit wiegt, die Bedrohung sei "gelöst"? Die Erfahrungen mit Dir lassen mich annehmen, dass AVG wenig unternommen hat, um den von der Pest befallenen Rechner wirklich zu befreien, oder? Nochmals vielen Dank für Deine bisherige Unterstützung! Schönen Samstag noch! Jan  Geändert von JCK_2015 (09.05.2015 um 07:11 Uhr) |
|
| Themen zu QuickShare lässt sich nicht deinstallieren (MalSign.Linkury.33E) |
| administrator, antivirus, appdata, bericht, datei, dateien, gelöscht, gültigkeit, home, internet explorer, lokal, löschen, mac, microsoft, nicht mehr, online, ordner, problem, rechner, registry, roaming, scan, software, temp, windows |
Linear-Darstellung
