| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Avira Antivir Live CD erkennt 27 TrojanerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
26.05.2015, 15:12
| #1 |
| |  Windows 7: Avira Antivir Live CD erkennt 27 Trojaner Hallo erstmal  Ich habe gerade eben meinen PC mit einer Live-CD von Avira Antivir gescannt und war ziemlich überrascht von den 27 Funden. Ich hoffe ihr könnt mir helfen diese loszuwerden. Hier das Logfile von Avira: Code:
ATTFilter Scan Report
Start: 12:08:07 End: 13:37:50
Detections: 27
Files treated: 27
Files scanned: 204786
Engine version: 8.3.30.38
VDF version: 7.11.235.54
Scan status: Finished
Update Report
Update finished successfully!Updated files:
vbase021.vdf 7.11.233.14 -> 7.11.233.89
vbase022.vdf 7.11.233.15 -> 7.11.233.149
vbase023.vdf 7.11.233.16 -> 7.11.234.176
vbase024.vdf 7.11.233.17 -> 7.11.234.231
vbase025.vdf 7.11.233.18 -> 7.11.234.232
vbase026.vdf 7.11.233.19 -> 7.11.234.233
vbase027.vdf 7.11.233.20 -> 7.11.234.234
vbase028.vdf 7.11.233.21 -> 7.11.234.235
vbase029.vdf 7.11.233.22 -> 7.11.234.236
vbase030.vdf 7.11.233.23 -> 7.11.234.237
vbase031.vdf 7.11.233.78 -> 7.11.235.54
aevdf.dat 7.11.233.78 -> 7.11.235.54
aecore.so 8.3.4.0 -> 8.3.6.2
aeheur.so 8.1.4.1684 -> 8.1.4.1702
aepack.so 8.4.0.76 -> 8.4.0.80
aescript.so 8.2.2.64 -> 8.2.2.66
aesbx.so 8.2.20.34 -> 8.2.21.0
aeset.dat 8.3.30.34 -> 8.3.30.38
Update finished successfully
Details
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir
Virus name: TR/Crypt.ZPACK.145794 (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir
Virus name: TR/Crypt.Xpack.188403 (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir
Virus name: TR/Kryptik.gtap (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir
Virus name: TR/Dldr.JRAF (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir" was already renamed.)
Virus Type: trojan
Detection: /target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir
Virus name: TR/Dldr.JRAF (File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir" was already renamed.)
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.gmx.net/inbox
Virus name: TR/Matsnu.A.113 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.gmx.net/trash
Virus name: TR/Matsnu.A.113 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web-1.de/inbox
Virus name: TR/Downloader.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web-1.de/trash
Virus name: TR/Matsnu.A.166 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web.de/inbox
Virus name: TR/Crypt.Xpack.87566 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/imap.web.de/trash
Virus name: TR/Crypt.ZPACK.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/trash
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-05 235354/backup files 2.zip
Virus name: TR/Dldr.JRAF file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 1.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 15.zip
Virus name: TR/Crypt.EPACK.33213 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 18.zip
Virus name: TR/Downloader.Gen7 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 19.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 1.zip
Virus name: TR/Yakes.ceky file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 6.zip
Virus name: TR/Cabhot.vuze file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 7.zip
Virus name: TR/Matsnu.A.260 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 1.zip
Virus name: TR/Matsnu.A.260 file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 4.zip
Virus name: TR/Cabhot.vuze file renamed
Virus Type: trojan
Detection: /target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 5.zip
Virus name: TR/Crypt.EPACK.33697 file renamed
Virus Type: trojan
Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:47 on 26/05/2015 (Thomas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 26-05-2015 15:51:14
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(AddGadgets) C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Spotify Ltd) C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Oracle Corporation) C:\Program Files (x86)\PCremote\mojjre\bin\javaw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [558672 2013-09-11] (Lavasoft)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]
Chrome:
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Lavasoft NewTab) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole [2015-01-21]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\chrome-newtab-search.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-26] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmp4F57.tmp [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 15:51 - 2015-05-26 15:51 - 00020694 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:50 - 2015-05-26 15:51 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-26 15:43 - 2015-05-26 15:43 - 00000000 ___HD () C:\OneDriveTemp
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-05-26 15:51 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-26 15:51 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-26 15:51 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-26 15:46 - 2014-11-26 16:23 - 02046586 _____ () C:\Windows\WindowsUpdate.log
2015-05-26 15:43 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-26 15:43 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-26 15:43 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-26 15:43 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-26 15:43 - 2015-01-07 20:25 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2015-05-26 15:43 - 2014-11-26 21:00 - 00047064 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-26 15:43 - 2014-11-26 20:31 - 00020607 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-26 15:43 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-26 15:43 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-26 15:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-26 15:43 - 2009-07-14 06:51 - 00069284 _____ () C:\Windows\setupact.log
2015-05-26 14:04 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-26 13:24 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-25 23:15 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-20 15:00 - 2010-11-21 05:47 - 00361018 _____ () C:\Windows\PFRO.log
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-18 14:14 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-04 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit
==================== Files in the root of some directories =======
2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-26 14:04 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg
Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js
Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sp-downloader.exe
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 17:46
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2015
Ran by Thomas at 2015-05-26 15:51:39
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1093152027-101576897-1014639688-500 - Administrator - Disabled)
Gast (S-1-5-21-1093152027-101576897-1014639688-501 - Limited - Disabled)
Thomas (S-1-5-21-1093152027-101576897-1014639688-1000 - Administrator - Enabled) => C:\Users\Thomas
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Ahnenblatt 2.83 (HKLM-x32\...\Ahnenblatt_is1) (Version: 2.83.0.1 - Dirk Böttcher)
AMD Catalyst Install Manager (HKLM\...\{AF88A32E-BC54-2AA3-2FC8-D63D86DF4A7A}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)
Brother MFL-Pro Suite MFC-J4410DW (HKLM-x32\...\{DD98C438-D769-4677-AA87-3481FA32D20C}) (Version: 2.0.0.0 - Brother Industries, Ltd.)
Capture One 6.4 (HKLM\...\CaptureOne6_is1) (Version: 6.4.65508.156 - Phase One A/S)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.5.0.11 - Swiss Academic Software)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version: - Colossal Order Ltd.)
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.2.1 - Crystal Dew World)
Easy Tune 6 B12.1121.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.1121.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.118 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.118 - Etron Technology) Hidden
foobar2000 v1.3.5 (HKLM-x32\...\foobar2000) (Version: 1.3.5 - Peter Pawlowski)
GIGABYTE OC_GURU II (HKLM-x32\...\InstallShield_{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}) (Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.)
GIGABYTE OC_GURU II (x32 Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\{DDCA236C-A28B-3979-8855-B7475BCAD806}) (Version: 66.30.49223 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
LibreOffice 4.3.4.1 (HKLM-x32\...\{7D983A32-F645-48AB-8E38-4ACD234F40BC}) (Version: 4.3.4.1 - The Document Foundation)
Logon Screen (HKLM\...\{1730D13B-7517-4321-A88B-64627CF67CDC}_is1) (Version: - Daniel Rebelo)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4719.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.2.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
Neat Image v7.4.0 Demo Standalone (32-bit) (HKLM-x32\...\Neat Image Standalone (32-bit)_is1) (Version: - Neat Image team, ABSoft)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
PCremote (HKLM-x32\...\PCremote) (Version: 1.4 - JakuSoft)
PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.4 - Andrea Vacondio)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.311.0 - Tracker Software Products Ltd)
Platform (x32 Version: 1.42 - VIA Technologies, Inc.) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.21 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.21.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Spotify) (Version: 1.0.5.186.ga9c24d6a - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.42 - VIA Technologies, Inc.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows-Treiberpaket - Leaf Imaging Ltd. Image (02/11/2010 ) (HKLM\...\A35BD68D4A1B3E191138E3C9AA417190A9468F7E) (Version: 02/11/2010 - Leaf Imaging Ltd.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{25815CC0-43F4-3C75-8C3A-A139D9ADE740}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {18493AC0-8A63-4389-B336-1D92ED6135B7} - System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90} => pcalua.exe -a C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe -d C:\Users\Thomas\Downloads
Task: {1E95EF8B-B3CF-48DA-ACAE-76E088C853E8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {5F2736EE-ED71-4488-BF62-BD100C3C84C7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {62093B6E-3116-4B9C-8035-0F588B18822C} - System32\Tasks\{C40D0927-D71A-45F4-8600-AE005A2E4FF8} => pcalua.exe -a "C:\Users\Thomas\Downloads\Eraser 6.0.10.2620.exe" -d C:\Users\Thomas\Downloads
Task: {6ECFD5BE-A3DC-4D73-AAAB-1962EC749502} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-18] (Adobe Systems Incorporated)
Task: {7F4CE648-3226-437E-9028-5CD75C4117BD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-19] (Microsoft Corporation)
Task: {A770A092-9852-44CD-A276-4BC7B2D2E0CE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {AAF9D9C9-A304-47D2-8F54-2F8BD97217B7} - System32\Tasks\Microsoft\Windows\OC GURU => C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2014-10-28] (GIGABYTE Technology Co.,Ltd.)
Task: {C4E76C96-AD0D-4135-A27B-DD96E19A86A9} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {D8161A5C-DBD7-4F97-8A79-605882FA8881} - System32\Tasks\PCMeter\Startup => C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe [2014-11-26] (AddGadgets)
Task: {D913D2E1-85D4-452F-A0EF-E6793C82C497} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-10] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2014-11-26 20:01 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-11-26 18:58 - 2005-04-22 06:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2012-01-13 15:04 - 2012-01-13 15:04 - 00219760 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
2014-11-26 16:41 - 2012-11-14 09:22 - 00078456 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2014-11-26 16:41 - 2012-11-14 09:22 - 00386168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00012520 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\CoreTempReader.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00015080 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\GetCoreTempInfoNET.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00014056 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\SystemInfo.dll
2012-08-06 13:07 - 2012-08-06 13:07 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-11-14 15:44 - 2012-11-14 15:44 - 02875463 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Normal.dll
2012-11-14 11:42 - 2012-11-14 11:42 - 00651331 _____ () C:\Program Files (x86)\GIGABYTE\ET6\work.dll
2012-09-17 17:25 - 2012-09-17 17:25 - 00106496 _____ () C:\Program Files (x86)\GIGABYTE\ET6\SF.dll
2008-05-07 16:22 - 2008-05-07 16:22 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\CIAMIB.dll
2012-05-08 16:01 - 2012-05-08 16:01 - 00069632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GPTT.dll
2011-09-14 18:12 - 2011-09-14 18:12 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\ycc.dll
2010-06-24 16:50 - 2010-06-24 16:50 - 00094208 _____ () C:\Program Files (x86)\GIGABYTE\ET6\IccLibDll.dll
2011-03-01 20:00 - 2011-03-01 20:00 - 00126976 _____ () C:\Program Files (x86)\GIGABYTE\ET6\StabilityLib.dll
2011-10-18 10:26 - 2011-10-18 10:26 - 00024576 _____ () C:\Program Files (x86)\GIGABYTE\ET6\STT.dll
2012-11-14 15:00 - 2012-11-14 15:00 - 01499204 _____ () C:\Program Files (x86)\GIGABYTE\ET6\OCK.dll
2012-09-18 15:45 - 2012-09-18 15:45 - 01335362 _____ () C:\Program Files (x86)\GIGABYTE\ET6\HM.dll
2012-11-09 17:51 - 2012-11-09 17:51 - 01429582 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GVTunner.dll
2003-02-14 15:11 - 2003-02-14 15:11 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Sound.dll
2010-06-10 16:52 - 2010-06-10 16:52 - 00110592 _____ () C:\Program Files (x86)\GIGABYTE\ET6\AMD8.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 04449632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Platform.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 00423256 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Device.dll
2012-11-20 18:38 - 2012-11-20 18:38 - 00311296 _____ () C:\Program Files (x86)\GIGABYTE\ET6\MFCCPU.DLL
2014-11-26 18:58 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 03350640 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-11-26 16:36 - 2013-09-16 13:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER Error getting ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: Spotify => "C:\Users\Thomas\AppData\Roaming\Spotify\Spotify.exe" -autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{868C0CDC-65DA-49AC-A1F2-6BFDDA2C89C3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1BD1A2B2-A869-4EF7-8E3B-D7EDB93AE82A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{23CEE1FD-936A-4506-98EA-5E99C37A376F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F306B483-0C4E-4FF2-BD80-74C5F1308B97}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{38FC26EE-E98A-4F73-97E2-4411B432EE9A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{2C908DCC-349F-4DE1-A735-D4342075F8A1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{858FAFD6-071B-4747-918E-B7216F59DD7E}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [{B46A5642-828F-4332-95F7-F2DA44D54F15}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{CD6C1ABC-B2F5-45AB-A118-D780458897E4}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{4415A1CA-2A15-4FB4-8FC2-AABAF4289610}] => (Allow) LPort=54925
FirewallRules: [{9876341E-0FD3-493B-A3D9-FE17E2B4C5A0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{123B2200-788A-4F2F-8145-102BEDCEFEF7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{FAB2983B-0E34-481C-927A-A37F369778A0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4000D441-7151-4E3E-A21D-5F0F0FBB4387}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{37485AC4-EFED-46D7-861A-89EAE634B670}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{4AC3ED3E-14E5-4FDD-AB67-45D300398043}] => (Allow) C:\Users\Thomas\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{99B295D4-B8AA-416E-ABA2-64B44CB6E71D}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [UDP Query User{0104D30B-0C24-410C-B9BD-6BB96605A62B}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{E78A5DAA-7DA4-4FF7-A704-D57DF575717C}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{033682DD-EB38-4EE5-B3B3-27DAECDB7146}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [TCP Query User{935720BD-85C1-4E6B-97D3-BB32EE4E5A16}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [UDP Query User{75D46140-7539-43FB-A209-64BC0DDB3503}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [TCP Query User{753A2F2A-4632-4D29-91CD-085B1093243F}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{19FF9810-C30E-4BB5-AD4B-931AF788F2F1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{D5EB4939-26EE-4A68-9C38-688CBCA91483}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [UDP Query User{620ED441-6F2C-44CB-ABB6-CA2E62106FEB}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{1686B007-6F2A-4D11-BE1A-1C023CDF9EA0}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{9E566A22-31D9-43B4-B910-15F7D5F4B50F}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{7B93A4F7-8817-4069-B342-F87046567E0E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5647E22E-EE4A-44E9-8E02-4EFBA294A997}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{AAC701D3-A708-4DA7-9EE1-5AE17BC6859F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B1EF69DD-51A0-4595-B586-FD80D90D50D3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{CA3FDC85-CCC6-4E0A-B41B-7AF5D365F013}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{DE1D455A-49AB-438B-A038-22B5FD24EA79}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{A6CE0C0A-401A-4494-8537-63BE8FA0A718}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{FC283BB9-E760-4735-AE9D-1D003822E500}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{6D451505-D915-4EFA-8C15-8C0DAA1B4BCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3671EBD3-F019-440B-814A-406EBC73A18C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3C113845-913E-494A-875D-92392CE2E4E8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{806A2F9B-08A4-48B9-84A9-DE297F5320DB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{C2645181-F524-4335-877D-75BF4581A73F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6a8
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}
Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3
Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
System errors:
=============
Error: (05/26/2015 03:43:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/26/2015 01:17:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/26/2015 00:30:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/25/2015 11:52:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/24/2015 10:15:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (05/23/2015 11:56:45 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}
Error: (05/22/2015 04:04:19 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Error: (05/22/2015 04:04:17 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.
Microsoft Office:
=========================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56a801d097a57e42f680C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllc1d526bf-0398-11e5-9f3d-94de8027c9ce
Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d0979f02baff4eC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dll463f932a-0392-11e5-ba73-94de8027c9ce
Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}
Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d096d077332206C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllbade77c8-02c3-11e5-a1db-94de8027c9ce
Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 30%
Total physical RAM: 8150.18 MB
Available physical RAM: 5703.33 MB
Total Pagefile: 16298.55 MB
Available Pagefile: 13267.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:238.47 GB) (Free:113.38 GB) NTFS
Drive d: (UUI) (Removable) (Total:3.91 GB) (Free:3.91 GB) FAT32
Drive e: (Daten) (Fixed) (Total:481.41 GB) (Free:328.42 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 1265228A)
Partition 1: (Not Active) - (Size=238.5 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E7E83165)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=481.4 GB) - (Type=07 NTFS)
========================================================
Disk: 2 (Size: 3.9 GB) (Disk ID: 6E652072)
No partition Table on disk 2.
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-26 15:57:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Crucial_CT256MX100SSD1 rev.MU01 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\Thomas\AppData\Local\Temp\uwdiipoc.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
---- EOF - GMER 2.1 ----
|
| Themen zu Windows 7: Avira Antivir Live CD erkennt 27 Trojaner |
| ad-aware, böttcher, fehlercode 0x5;, fehlercode 0xc0000005, fehlercode 22, fehlercode windows, flash player, newtab, office 365, onedrive, pup.optional.conduit.a, svchost.exe, this device is disabled. (code 22), tr/cabhot.vuze, tr/crypt.epack.33213, tr/crypt.epack.33697, tr/crypt.xpack.188403, tr/crypt.xpack.87566, tr/crypt.zpack.145794, tr/crypt.zpack.gen7, tr/dldr.jraf, tr/downloader.gen7, tr/kryptik.gtap, tr/matsnu.a.113, tr/matsnu.a.166, tr/matsnu.a.260, tr/yakes.ceky, tracker, trojaner, whatsapp |
Baum-Darstellung