| |
| |||||||
Log-Analyse und Auswertung: Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
15.07.2015, 08:22
| #1 |
| /// Malwareteam  |  Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist. Hi, die Additions.txt ist unvollständig, bitte nochmal posten. Schritt # 1: FRST Fix Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
C:\Users\Hermann\Ti_2015_MR_64_Website.exe
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Schritt # 2: MBAM Downloade Dir bitte  Malwarebytes Anti-Malware
Schritt # 3: AdwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Schritt # 4: JRT Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Schritt # 5: FRST Bitte noch ein FRST-Log erstellen. Schritt # 6: Bitte Posten
|
|
15.07.2015, 11:45
| #2 |
 | Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist. Hallo Denis,
__________________anbei die benötigten Daten: erst die nochmal benötigte Additon.txt [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by Hermann at 2015-07-15 11:04:02
Running from C:\Users\Hermann\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1140857624-1230666902-1865050029-500 - Administrator - Disabled)
Gast (S-1-5-21-1140857624-1230666902-1865050029-501 - Limited - Disabled)
Hermann (S-1-5-21-1140857624-1230666902-1865050029-1002 - Administrator - Enabled) => C:\Users\Hermann
HomeGroupUser$ (S-1-5-21-1140857624-1230666902-1865050029-1003 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Trend Micro Internet Security (Disabled - Up to date) {8242D66F-41BD-4049-C2E6-E578E73B62A0}
AS: Trend Micro Internet Security (Disabled - Up to date) {3923378B-6787-4FC7-F856-DE0A9CBC281D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{49C639FB-E462-3CFD-9F6A-0F9033640CED}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.3207 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.3.3920 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4513 - CyberLink Corp.)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Foxit PhantomPDF (HKLM-x32\...\{5F3E0897-97AA-4FC2-A0A9-130A39D0FDFB}) (Version: 6.0.16.324 - Foxit Corporation)
Google Earth Pro (HKLM-x32\...\{44FC61F0-2F8A-11E3-8CAE-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{13133E99-B0D5-4143-B832-AAD55C62A41C}) (Version: 6.0.19.1 - Hewlett-Packard Company)
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.3.7.1864 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{C0ED9561-8312-457C-BB1B-BDC7EE034CED}) (Version: 4.7.4.1 - Hewlett-Packard Company)
HP Device Access Manager (HKLM\...\{DBE16A07-DDFF-4453-807A-212EF93916E0}) (Version: 8.3.2.0 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{53AE55F3-8E99-4776-A347-06222894ECD3}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.11.10 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{56C60843-5199-47F1-9087-AE440EFFB951}) (Version: 2.5.1 - Hewlett-Packard Company)
HP File Sanitizer (HKLM-x32\...\{6349342F-9CEF-4A70-995A-2CF3704C2603}) (Version: 8.4.20.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10284 - Realtek Semiconductor Corp.)
HP Hotkey Support (HKLM-x32\...\{445CC807-9384-47FA-A2B6-FFE970352B88}) (Version: 6.0.22.1 - Hewlett-Packard Company)
HP PageLift (HKLM-x32\...\{59202086-BEA1-411A-8AA4-A5DCD28FF537}) (Version: 1.0.13.1 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP SoftPaq Download Manager (HKLM-x32\...\{34FF930E-DBF9-4858-BAB5-BAC957BF616E}) (Version: 3.5.1.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{F6D61EC9-347B-4019-9F8E-E24169F7C330}) (Version: 8.7.5 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{8C696B4B-6AB1-44BC-9416-96EAC474CABE}) (Version: 7.5.2.12 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP System Default Settings (HKLM-x32\...\{B5BEF5F8-BD76-4174-A47D-05A06EA62615}) (Version: 2.7.1 - Hewlett-Packard Company)
HP Theft Recovery (HKLM-x32\...\InstallShield_{B1E569B6-A5EB-4C97-9F93-9ED2AA99AF0E}) (Version: 8.3.0.7 - Hewlett-Packard Company)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4112 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{978B5476-EAF9-4EB0-AD34-92689249A016}) (Version: 4.2.41.2499 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.1.41 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{4046F74A-28F8-48C6-A5D3-2AFC472574C1}) (Version: 12.2.0.145 - Apple Inc.)
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 - de-de (HKLM\...\ProPlusRetail - de-de) (Version: 15.0.4727.1003 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 34.0.5 - Mozilla)
NAVIGON Fresh 3.5.1 (HKLM-x32\...\NAVIGON Fresh) (Version: 3.5.1 - NAVIGON)
OEM Application Profile (HKLM-x32\...\{FA2905FA-6EB6-F61A-D565-30634F5F673E}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
OEM Application Profile (x32 Version: 1.00.0000 - Ihr Firmenname) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4727.1003 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 1.0.0.26 - REALTEK Semiconductor Corp.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.49 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.83.328.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7404 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{A5107464-AA9B-4177-8129-5FF2F42DD322}) (Version: 1.0.0.41 - REALTEK Semiconductor Corp.)
Rosetta Stone Language Training (HKLM-x32\...\{00384623-4937-4D7D-BDD9-23513D1C50AB}) (Version: 5.0.13.0 - Rosetta Stone, Ltd)
Rosetta Stone Ltd Services (HKLM-x32\...\{3165E4A6-D5DE-46B0-8597-D55E2B826B84}) (Version: 3.2.21 - Rosetta Stone Ltd.)
Secunia PSI (3.0.0.9016) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.9016 - Secunia)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.1.37.3 - Synaptics Incorporated)
Trend Micro Internet Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 8.0 - Trend Micro Inc.)
Trend Micro Titanium (Version: 8.0 - Trend Micro Inc.) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{ADAA7361-54B8-4FC8-804E-94EC6C11ED68}) (Version: 4.5.133.0 - Validity Sensors, Inc.)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-1140857624-1230666902-1865050029-1002_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
09-07-2015 19:17:37 Removed Rosetta Stone Ltd Services
09-07-2015 19:18:35 Removed Rosetta Stone Language Training
13-07-2015 18:38:24 Installed Rosetta Stone Ltd Services
13-07-2015 18:40:46 Installed Rosetta Stone TOTALe
13-07-2015 18:48:37 Installed Rosetta Stone Language Training
13-07-2015 21:19:05 Removed Rosetta Stone Ltd Services
13-07-2015 21:21:21 Removed Rosetta Stone Language Training
13-07-2015 21:28:49 Installed Rosetta Stone Ltd Services
13-07-2015 21:30:59 Installed Rosetta Stone TOTALe
13-07-2015 21:41:08 Installed Rosetta Stone Language Training
14-07-2015 09:39:25 Windows Update
14-07-2015 09:52:20 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1AEF737A-E226-4FB4-883E-17E66C0BE380} - System32\Tasks\{82398F1A-1133-486C-ABAF-0AB6082470DD} => Firefox.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {3C0C0479-C1E5-4A99-B7FF-AD5282789A16} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {4E047330-886F-4EA7-BFF0-EB5771AA5F05} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-05-19] (Microsoft Corporation)
Task: {59C68872-E349-4C49-B704-E9E41C18802D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {6508C247-B0AD-4D26-BC87-7EC386F70389} - System32\Tasks\HPCeeScheduleForHermann => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {853C9637-7A32-40F3-AAB1-403887541481} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2015-05-12] (Microsoft Corporation)
Task: {9A2D7416-B092-4803-AB70-CC40FB8BAA21} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {A71E5FFC-009B-4FE1-B298-0F0127330CFE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {B455239B-9980-4689-B7C7-9F09CCCAC0C4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {D5D12945-5DF9-43A5-B7D2-302B534AE86F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
Task: {E93DEC8E-17BF-4E21-A0DA-91D0F2DA9405} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-06-12] (Adobe Systems Incorporated)
Task: {ECA157F6-4A31-4004-A151-12D4A4B90AFE} - System32\Tasks\{C74C3684-AF2C-4A59-AFCA-0552345E40EE} => Firefox.exe hxxp://ui.skype.com/ui/0/7.0.0.102/de/abandoninstall?page=tsMain
Task: {F8B9A466-02D1-48A0-97B1-FA820F9F8A88} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2014-01-13] (Hewlett-Packard Company)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\windows\Tasks\HPCeeScheduleForHermann.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Loaded Modules (Whitelisted) ==============
2014-05-28 10:14 - 2014-05-28 10:14 - 00336056 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-05-22 21:51 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-06-15 18:36 - 2015-05-04 08:23 - 00018944 _____ () C:\Program Files\Trend Micro\Titanium\plugin\Pt\boost_system-vc110-mt-1_52.dll
2015-06-15 18:36 - 2015-05-04 08:23 - 00049664 _____ () C:\Program Files\Trend Micro\Titanium\plugin\Pt\boost_date_time-vc110-mt-1_52.dll
2015-06-15 18:36 - 2015-05-04 08:23 - 00089088 _____ () C:\Program Files\Trend Micro\Titanium\plugin\Pt\boost_thread-vc110-mt-1_52.dll
2015-06-15 18:36 - 2015-05-04 08:23 - 00761856 _____ () C:\Program Files\Trend Micro\Titanium\plugin\Pt\boost_regex-vc110-mt-1_52.dll
2014-09-02 07:00 - 2014-10-11 11:24 - 00098816 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-03-31 22:28 - 2014-03-31 22:28 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2013-09-07 02:06 - 2013-09-07 02:06 - 00198120 _____ () c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2013-09-07 02:06 - 2013-09-07 02:06 - 00054760 _____ () c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2013-09-07 02:05 - 2013-09-07 02:05 - 00034792 _____ () c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2014-03-19 17:00 - 2014-03-19 17:00 - 00514570 _____ () c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll
2014-10-10 10:37 - 2014-10-10 10:37 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2015-05-22 21:52 - 2015-05-22 21:52 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2014-09-02 07:07 - 2013-08-05 09:49 - 00627672 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-08-06 00:48 - 2013-08-06 00:48 - 00016856 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Hermann\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{B633DBEB-3C8E-4120-84F6-608433E8BFEB}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{A6BE67C8-2AED-4067-9BDA-AD3F3A594848}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9EAECEFD-3061-4C6A-B7B7-EF71C6CDB52F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{33D459DA-8D8C-4E07-A033-DAF65EF4D020}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{96A56104-5ABD-418E-AF30-7D35C885CCB6}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{6EBB38B0-BFC8-4165-92A3-54EA5B9C3A71}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
FirewallRules: [{69903480-D4B7-497D-93A4-7A37E7784112}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
FirewallRules: [{176D4293-9AFB-4037-9AFC-B62964872432}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe
FirewallRules: [{70339C3E-482E-4E57-9A5A-DBD2AFAB0C53}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{FA090F80-7150-4537-9102-DD8DC4DB061F}] => (Allow) c:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{47CFB2CF-0666-4A3F-B972-1241BE0EB357}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{22D7465F-9744-405D-AD4B-050E2AEB4EAA}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{E5F6F2B1-12EB-4C5B-B141-82300D8EBF41}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{16317276-FD5A-4285-BF8A-3035B2266FD8}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{75F7B0E8-CC51-4B4D-B3B2-5929C377A788}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{FBC6A734-32DB-4D83-8232-EBB215E30153}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{F70DE86D-490B-460C-91F1-82890EC7F585}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\Lync.exe
FirewallRules: [{3D175721-0533-4304-ABF9-81DD60EF8050}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{6BB1442C-4D9B-42A4-A406-68618D620160}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\UcMapi.exe
FirewallRules: [{34668DB0-3DB4-4D42-9CB0-17602842DAD9}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{8E2D888B-DD2A-4CF7-8F6A-49D7DC2D15CE}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneLtdServices.exe
FirewallRules: [{D71CC4A4-3C4C-4D4B-B06B-C8A036F1B8DF}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneLtdServices.exe
FirewallRules: [{3D2EF8E1-2E9D-49AB-9AAE-3A963A7FDAC9}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
FirewallRules: [{1FDF8696-1F8A-4454-8233-7A5F41463014}] => (Allow) C:\Program Files (x86)\RosettaStoneLtdServices\RosettaStoneDaemon.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/14/2015 03:29:38 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Outlook: Rejected Safe Mode action : Outlook konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.
Möchten Sie im abgesicherten Modus starten?.
Rejected Safe Mode action : Microsoft Outlook.
Error: (07/14/2015 01:44:46 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft Outlook: Rejected Safe Mode action : Outlook konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.
Möchten Sie im abgesicherten Modus starten?.
Rejected Safe Mode action : Microsoft Outlook.
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 244126
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 244126
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 243096
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 243096
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/14/2015 12:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 242066
Error: (07/14/2015 12:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 242066
System errors:
=============
Error: (07/15/2015 10:46:02 AM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 09:58:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "RosettaStoneDaemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/14/2015 08:44:19 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 08:28:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Trend Micro Solution Platform" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (07/14/2015 08:27:58 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 08:24:24 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 03:21:02 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 01:42:05 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (07/14/2015 12:41:10 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (07/14/2015 12:33:26 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Microsoft Office:
=========================
Error: (07/14/2015 03:29:38 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft OutlookOutlook konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.
Möchten Sie im abgesicherten Modus starten?
Error: (07/14/2015 01:44:46 PM) (Source: Microsoft Office 15) (EventID: 2001) (User: )
Description: Microsoft OutlookOutlook konnte beim letzten Mal nicht gestartet werden. Der abgesicherte Modus kann Ihnen bei der Problembehandlung behilflich sein. Einige Features sind aber in diesem Modus möglicherweise nicht verfügbar.
Möchten Sie im abgesicherten Modus starten?
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 244126
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 244126
Error: (07/14/2015 12:33:23 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 243096
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 243096
Error: (07/14/2015 12:33:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
Error: (07/14/2015 12:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 242066
Error: (07/14/2015 12:33:21 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 242066
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4510U CPU @ 2.00GHz
Percentage of memory in use: 37%
Total physical RAM: 8064.11 MB
Available physical RAM: 5068.52 MB
Total Virtual: 16126.43 MB
Available Virtual: 13101.98 MB
==================== Drives ================================
Drive c: (Windows) (Fixed) (Total:682.42 GB) (Free:604.86 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:13.21 GB) (Free:1.45 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.96 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 75916FA3)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=682.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0B)
==================== End of log ============================
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 15.07.2015 Suchlaufzeit: 11:37 Protokolldatei: mbam.txt Administrator: Ja Version: 2.1.8.1057 Malware-Datenbank: v2015.07.15.02 Rootkit-Datenbank: v2015.07.14.01 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Hermann Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 351964 Abgelaufene Zeit: 21 Min., 12 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 0 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.208 - Bericht erstellt 15/07/2015 um 12:12:04
# Aktualisiert 09/07/2015 von Xplode
# Datenbank : 2015-07-15.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Hermann - HERMANN-HP
# Gestarted von : C:\Users\Hermann\Desktop\AdwCleaner_4.208.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17840
-\\ Mozilla Firefox v39.0 (x86 de)
*************************
AdwCleaner[R0].txt - [796 Bytes] - [15/07/2015 12:10:27]
AdwCleaner[S0].txt - [717 Bytes] - [15/07/2015 12:12:04]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [775 Bytes] ##########
Code:
ATTFilter Fix result of Farbar Recovery Scan Tool (x64) Version:13-07-2015
Ran by Hermann at 2015-07-15 11:17:19 Run:1
Running from C:\Users\Hermann\Desktop
Loaded Profiles: Hermann (Available Profiles: Hermann)
Boot Mode: Normal
==============================================
fixlist content:
*****************
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM14/10
C:\Users\Hermann\Ti_2015_MR_64_Website.exe
*****************
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
C:\Users\Hermann\Ti_2015_MR_64_Website.exe => moved successfully.
==== End of Fixlog 11:17:19 ====
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.4.9 (07.14.2015:2)
OS: Windows 7 Professional x64
Ran by Hermann on 15.07.2015 at 12:21:53,31
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
Successfully deleted: [Folder] C:\Users\Hermann\appdata\local\DIGITA~1
Successfully deleted: [Folder] C:\Users\Hermann\AppData\Roaming\DIGITA~1
~~~ FireFox
Emptied folder: C:\Users\Hermann\AppData\Roaming\mozilla\firefox\profiles\nrpn4htb.default-1426757629194\minidumps [4 files]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15.07.2015 at 12:23:56,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-07-2015
Ran by Hermann (administrator) on HERMANN-HP on 15-07-2015 12:28:46
Running from C:\Users\Hermann\Desktop
Loaded Profiles: Hermann (Available Profiles: Hermann)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtWatchDog.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Platinum] => C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSessionAgent.exe [1266688 2015-05-04] (Trend Micro Inc.)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [320360 2014-06-25] (Intel Corporation)
HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [246304 2014-07-20] (Trend Micro Inc.)
HKLM-x32\...\Run: [HPConnectionManager] => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [185144 2014-04-10] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [YouCam Tray] => c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe [167488 2013-09-17] (CyberLink Corp.)
HKLM-x32\...\Run: [CLVirtualDrive] => c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [490760 2013-08-07] (CyberLink Corp.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-04-10] (Advanced Micro Devices, Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
Lsa: [Notification Packages] DPPassFilter scecli
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-04-11]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro1 (ErrorConflict)] -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro2 (SyncInProgress)] -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrivePro3 (InSync)] -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1140857624-1230666902-1865050029-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-05-19] (Microsoft Corporation)
BHO: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
BHO: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO: Trend Micro IE Protection -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe64.dll [2015-05-21] (Trend Micro Inc.)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: HP File Sanitizer -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2014-02-05] (Hewlett-Packard)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll [2015-05-12] (Microsoft Corporation)
BHO-x32: Trend Micro Security Toolbar Helper -> {43C6D902-A1C5-45c9-91F6-FD9E90337E18} -> C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
BHO-x32: TmIEPlugInBHO Class -> {959A5673-7971-48e6-AF54-58F745AC4ABC} -> C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: Trend Micro IE Protection -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe32.dll [2015-05-21] (Trend Micro Inc.)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL [2015-05-28] (Microsoft Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
Toolbar: HKLM - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Toolbar: HKLM-x32 - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-05-23] (Microsoft Corporation)
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe64.dll [2015-05-21] (Trend Micro Inc.)
Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\TmBpIe32.dll [2015-05-21] (Trend Micro Inc.)
Handler: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg.dll [2014-06-30] (Trend Micro Inc.)
Handler-x32: tmop - {69FD7CE3-4604-4fe6-967C-49B9735CEE70} - C:\Program Files\Trend Micro\AMSP\module\20013\3.5.1186\2.0.1039\TmopIEPlg32.dll [2014-06-30] (Trend Micro Inc.)
Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll [2014-07-20] (Trend Micro Inc.)
Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\plugin\ToolbarIE64\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)
Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll [2014-07-20] (Trend Micro Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B579DD91-C67A-42F5-84D5-B932A845AEB6}: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Hermann\AppData\Roaming\Mozilla\Firefox\Profiles\nrpn4htb.default-1426757629194
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-12-18] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2013-12-18] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2015-05-23] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-05-23] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\components\npChromeDPAgent.dll [2014-06-26] (DigitalPersona, Inc.)
FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension
FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension [2015-06-15]
FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\9.1.1022\9.1.1022\firefoxextension
FF HKLM-x32\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension
FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2014-11-14]
FF HKLM-x32\...\Firefox\Extensions: [{BBB77B49-9FF4-4d5c-8FE2-92B1D6CD696C}] - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension
FF Extension: Trend Micro Osprey Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension [2015-06-03]
FF HKLM-x32\...\Firefox\Extensions: [dpmaxz_ng@jetpack] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome
FF Extension: HP Client Security Manager - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome [2015-01-16]
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\BrowserExt\dpchrome.crx [2014-06-26]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
S2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [43224 2014-07-03] (Realtek Semiconductor Corporation)
S2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [98816 2014-10-11] () [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2739888 2015-05-19] (Microsoft Corporation)
S2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2014-03-31] () [File not signed]
S2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2014-07-28] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\windows\SysWOW64\flcdlock.exe [567608 2013-11-20] (Hewlett-Packard Company)
S2 HpDamServiceHost; c:\Program Files (x86)\Hewlett-Packard\HP Device Access Manager\HP.ProtectTools.DeviceAccessManager.ServiceHost.exe [18232 2013-11-15] (Hewlett-Packard Development Company)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-06-25] (Intel Corporation)
S2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344976 2015-05-22] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 ISCTAgent; c:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [198120 2013-09-07] ()
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 Platinum Host Service; C:\Program Files\Trend Micro\Titanium\plugin\Pt\PtSvcHost.exe [1187328 2015-05-04] (Trend Micro Inc.)
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2015-03-04] (Realtek Semiconductor)
S2 RtkBleServ; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\RtkBleServ.exe [50392 2014-07-03] (Realtek Semiconductor Corporation)
S2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-12-04] (Microsoft Corporation)
S2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36608 2013-12-14] (Advanced Micro Devices, Inc.)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [90608 2011-12-27] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-10-07] (Hewlett-Packard Company)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2014-06-25] (Intel Corporation)
R3 INETMON; C:\windows\System32\Drivers\INETMON.sys [29088 2013-08-08] ()
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-08-08] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2014-12-05] (WinMagic Inc.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 RtkA2dp; C:\Windows\System32\drivers\RtkA2dp.sys [179416 2014-05-09] (Realtek Semiconductor Corporation)
S3 RtkAvrcp; C:\Windows\system32\drivers\RtkAvrcp.sys [61152 2012-12-28] (Realtek Semiconductor Corporation)
R3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [585944 2015-01-20] (Realtek Semiconductor Corporation)
S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [476888 2015-03-05] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [9127128 2014-12-26] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3802328 2015-04-21] (Realtek Semiconductor Corporation )
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2014-12-05] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2014-12-05] (WinMagic Inc.)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [30448 2014-04-08] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [31472 2014-04-08] (Synaptics Incorporated)
R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [122432 2015-04-24] (Trend Micro Inc.)
R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [307344 2015-04-24] (Trend Micro Inc.)
R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2014-07-09] (Trend Micro Inc.)
R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [106296 2014-07-09] (Trend Micro Inc.)
R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [93616 2015-04-24] (Trend Micro Inc.)
R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [407864 2014-07-09] (Trend Micro Inc.)
R2 tmusa; C:\Windows\System32\DRIVERS\tmusa.sys [106296 2014-06-30] (Trend Micro Inc.)
S3 pmem; \??\C:\Users\Hermann\AppData\Local\Temp\_MEI56762\drivers\winpmem64.sys [X]
U2 TMAgent; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-15 12:28 - 2015-07-15 12:28 - 00020031 _____ C:\Users\Hermann\Desktop\FRST.txt
2015-07-15 12:23 - 2015-07-15 12:23 - 00000902 _____ C:\Users\Hermann\Desktop\JRT.txt
2015-07-15 12:22 - 2015-07-15 12:22 - 00000207 _____ C:\windows\tweaking.com-regbackup-HERMANN-HP-Windows-7-Professional-(64-bit).dat
2015-07-15 12:21 - 2015-07-15 12:21 - 00000000 ____D C:\RegBackup
2015-07-15 12:20 - 2015-07-15 12:20 - 03034989 _____ (Malwarebytes Corporation) C:\Users\Hermann\Desktop\JRT.exe
2015-07-15 12:16 - 2015-07-15 12:16 - 00000854 _____ C:\Users\Hermann\Desktop\AdwCleaner[S0].txt
2015-07-15 12:10 - 2015-07-15 12:12 - 00000000 ____D C:\AdwCleaner
2015-07-15 12:02 - 2015-07-15 12:02 - 00001212 _____ C:\Users\Hermann\Desktop\mbam.txt
2015-07-15 11:45 - 2015-07-15 11:45 - 02248704 _____ C:\Users\Hermann\Desktop\AdwCleaner_4.208.exe
2015-07-15 11:22 - 2015-07-15 11:22 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Hermann\Downloads\mbam-setup-2.1.6.1022(1).exe
2015-07-15 11:01 - 2015-07-15 11:01 - 02133504 _____ (Farbar) C:\Users\Hermann\Desktop\FRST64.exe
2015-07-15 10:46 - 2015-07-15 12:15 - 00001078 _____ C:\windows\system32dbgraw.bmp
2015-07-14 20:42 - 2015-07-14 20:42 - 00011152 _____ C:\Users\Hermann\Desktop\Gmer.txt
2015-07-14 20:29 - 2015-07-14 20:29 - 00380416 _____ C:\Users\Hermann\Desktop\Gmer-19357.exe
2015-07-14 20:21 - 2015-07-15 12:28 - 00000000 ____D C:\FRST
2015-07-14 20:21 - 2015-07-15 11:04 - 00031372 _____ C:\Users\Hermann\Desktop\Addition.txt
2015-07-14 20:11 - 2015-07-14 20:11 - 00000476 _____ C:\Users\Hermann\Desktop\defogger_disable.log
2015-07-14 19:50 - 2015-07-14 19:50 - 00000000 _____ C:\Users\Hermann\defogger_reenable
2015-07-13 23:11 - 2015-07-15 12:18 - 00003198 _____ C:\windows\System32\Tasks\HPCeeScheduleForHermann
2015-07-13 23:11 - 2015-07-15 12:18 - 00000340 _____ C:\windows\Tasks\HPCeeScheduleForHermann.job
2015-07-13 21:41 - 2015-07-13 21:41 - 00001156 _____ C:\Users\Public\Desktop\Rosetta Stone.lnk
2015-07-13 21:31 - 2015-07-13 21:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rosetta Stone
2015-07-13 21:31 - 2015-07-13 21:41 - 00000000 ____D C:\Program Files (x86)\Rosetta Stone
2015-07-13 21:29 - 2015-07-13 21:29 - 00000000 ____D C:\ProgramData\RosettaStoneLtdServices
2015-07-13 21:29 - 2015-07-13 21:29 - 00000000 ____D C:\Program Files (x86)\RosettaStoneLtdServices
2015-07-08 16:59 - 2015-06-29 20:01 - 00017856 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2015-07-08 16:59 - 2015-06-29 19:59 - 01085440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00765440 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00433664 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-07-08 16:59 - 2015-06-29 19:59 - 00067584 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-07-08 16:59 - 2015-06-29 19:50 - 01145856 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 02603008 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll
2015-07-08 16:59 - 2015-06-27 00:07 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll
2015-07-08 16:59 - 2015-06-27 00:06 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2015-07-08 16:59 - 2015-06-27 00:06 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2015-07-08 16:59 - 2015-06-27 00:06 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2015-07-08 16:59 - 2015-06-26 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll
2015-07-08 16:59 - 2015-06-26 19:55 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2015-07-08 16:30 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DCompiler_43.dll
2015-07-08 16:30 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_43.dll
2015-07-08 16:30 - 2009-09-04 17:29 - 01892184 _____ (Microsoft Corporation) C:\windows\SysWOW64\D3DX9_42.dll
2015-07-08 16:30 - 2009-09-04 17:29 - 00453456 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3dx10_42.dll
2015-07-08 16:30 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\windows\SysWOW64\xinput1_3.dll
2015-07-06 17:22 - 2015-07-06 17:22 - 00000126 _____ C:\Users\Hermann\Desktop\Bayern 3 Radio, br 3 - das Bayern 3 Webradio Radio Stream kostenlos online hören radio.de.URL
2015-07-06 09:57 - 2015-07-06 09:57 - 00001760 _____ C:\Users\Public\Desktop\iTunes.lnk
2015-07-06 09:57 - 2015-07-06 09:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-07-06 09:56 - 2015-07-06 09:57 - 00000000 ____D C:\Program Files\iTunes
2015-07-06 09:56 - 2015-07-06 09:56 - 00000000 ____D C:\Program Files\iPod
2015-07-06 09:56 - 2015-07-06 09:56 - 00000000 ____D C:\Program Files (x86)\iTunes
2015-07-03 15:19 - 2015-07-04 08:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-07-01 22:37 - 2015-07-01 22:37 - 17733128 _____ C:\Users\Hermann\Downloads\PowerDVD_12.0.29544.4919_DKA_R3_Patch_DVD150113-05_Normal(1).exe
2015-06-27 13:02 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2015-06-27 13:02 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2015-06-27 13:02 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2015-06-27 13:02 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2015-06-27 13:01 - 2015-05-09 20:26 - 00493504 _____ (Microsoft Corporation) C:\windows\system32\mcupdate_GenuineIntel.dll
2015-06-22 23:35 - 2015-06-22 23:35 - 00000000 ____D C:\ProgramData\ATI
2015-06-22 21:27 - 2015-06-22 21:27 - 00056720 _____ C:\windows\SysWOW64\CCCInstall_201506222127282021.log
2015-06-22 21:27 - 2015-06-22 21:27 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2015-06-22 21:26 - 2015-06-22 21:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-06-22 21:19 - 2015-06-22 21:18 - 33869312 _____ (Advanced Micro Devices Inc.) C:\windows\system32\amdocl64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 28771840 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\amdocl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 27918848 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atio6axx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 23375872 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atioglxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 16751616 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmdag.sys
2015-06-22 21:19 - 2015-06-22 21:18 - 15716352 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticaldd64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 14302208 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticaldd.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 08044976 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd6a.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 07207592 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdva.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 07028336 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiumdag.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 03471376 _____ C:\windows\SysWOW64\atiumdva.cap
2015-06-22 21:19 - 2015-06-22 21:18 - 03437632 _____ C:\windows\system32\atiumd6a.cap
2015-06-22 21:19 - 2015-06-22 21:18 - 00901120 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\atiadlxy.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00621056 _____ (AMD) C:\windows\system32\atieclxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00609416 _____ C:\windows\SysWOW64\atiapfxx.blb
2015-06-22 21:19 - 2015-06-22 21:18 - 00609416 _____ C:\windows\system32\atiapfxx.blb
2015-06-22 21:19 - 2015-06-22 21:18 - 00579584 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\atikmpag.sys
2015-06-22 21:19 - 2015-06-22 21:18 - 00367104 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiapfxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00239616 _____ (AMD) C:\windows\system32\atiesrxx.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00235008 _____ C:\windows\system32\clinfo.exe
2015-06-22 21:19 - 2015-06-22 21:18 - 00190976 _____ (AMD) C:\windows\system32\atitmm64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00146944 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6txx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00133632 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atigktxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00128384 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\amdhcp64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00118096 _____ (Advanced Micro Devices, Inc.) C:\windows\SysWOW64\amdhcp32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00102128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdave64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00100032 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiu9pag.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00098816 _____ (Advanced Micro Devices Inc.) C:\windows\system32\OpenVideo64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00096448 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdave32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atisamu64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00086528 _____ (Advanced Micro Devices Inc.) C:\windows\system32\OVDecode64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00083456 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\OpenVideo.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atisamu32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atimpc64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdpcom64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atig6pxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00073216 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\OVDecode.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atimpc32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdpcom32.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiglpxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiglpxx.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00065024 _____ (Khronos Group) C:\windows\system32\OpenCL.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00062464 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalrt64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00058880 _____ (Khronos Group) C:\windows\SysWOW64\OpenCL.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00055808 _____ (Advanced Micro Devices Inc.) C:\windows\system32\aticalcl64.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00052224 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalrt.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00049152 _____ (Advanced Micro Devices Inc.) C:\windows\SysWOW64\aticalcl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00048128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\amdmmcl6.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\Drivers\ati2erec.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00037888 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\amdmmcl.dll
2015-06-22 21:19 - 2015-06-22 21:18 - 00031232 _____ (AMD) C:\windows\system32\atimuixx.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-07-15 12:25 - 2009-07-14 06:51 - 00452798 _____ C:\windows\setupact.log
2015-07-15 12:22 - 2009-07-14 06:45 - 00037184 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-15 12:22 - 2009-07-14 06:45 - 00037184 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-15 12:21 - 2015-01-17 20:46 - 01339598 _____ C:\Users\Hermann\AppData\Local\BTServer.log
2015-07-15 12:18 - 2015-03-04 21:16 - 00006467 _____ C:\windows\SysWOW64\Gms.log
2015-07-15 12:18 - 2014-11-13 20:49 - 00003946 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{B9CB2285-0914-4E35-BFE3-B897EA36700C}
2015-07-15 12:14 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2015-07-15 12:12 - 2014-11-13 20:42 - 01135117 _____ C:\windows\WindowsUpdate.log
2015-07-15 11:34 - 2015-05-25 11:25 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-15 11:33 - 2015-05-25 11:23 - 00001113 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-07-15 11:33 - 2015-05-25 11:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-07-15 11:33 - 2015-05-25 11:23 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-07-15 11:18 - 2014-11-16 13:01 - 00000000 ____D C:\Users\Hermann\Documents\Outlook-Dateien
2015-07-15 11:17 - 2014-11-13 20:48 - 00000000 ____D C:\Users\Hermann
2015-07-14 09:52 - 2015-04-03 14:43 - 00000000 ___SD C:\windows\SysWOW64\GWX
2015-07-14 09:52 - 2015-04-03 14:43 - 00000000 ___SD C:\windows\system32\GWX
2015-07-13 21:23 - 2014-11-21 17:41 - 00082136 _____ C:\Users\Hermann\Downloads\detekt.log
2015-07-13 18:40 - 2015-05-30 12:37 - 00000000 ____D C:\ProgramData\Rosetta Stone Backups
2015-07-12 10:08 - 2014-09-02 07:17 - 00700378 _____ C:\windows\system32\perfh007.dat
2015-07-12 10:08 - 2014-09-02 07:17 - 00149984 _____ C:\windows\system32\perfc007.dat
2015-07-12 10:08 - 2009-07-14 07:13 - 01622694 _____ C:\windows\system32\PerfStringBackup.INI
2015-07-09 18:15 - 2014-11-23 17:27 - 00000000 ____D C:\Users\Hermann\AppData\Local\CrashDumps
2015-07-08 18:13 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2015-07-08 17:00 - 2014-12-10 19:49 - 00000000 ____D C:\windows\system32\appraiser
2015-07-08 17:00 - 2014-11-14 01:29 - 00000000 ___SD C:\windows\system32\CompatTel
2015-07-08 16:55 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-07-08 16:48 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-07-07 14:50 - 2009-07-14 07:09 - 00000000 ____D C:\windows\System32\Tasks\WPD
2015-07-06 17:32 - 2014-11-23 15:14 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-07-06 09:56 - 2015-04-18 12:17 - 00000000 ____D C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-07-06 09:56 - 2015-04-18 12:15 - 00000000 ____D C:\Program Files\Common Files\Apple
2015-07-04 08:42 - 2014-11-14 10:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-07-04 08:42 - 2010-11-21 05:47 - 01415376 _____ C:\windows\PFRO.log
2015-07-01 22:39 - 2014-05-22 14:25 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-06-27 13:14 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions
2015-06-26 18:17 - 2014-12-26 10:24 - 00003886 _____ C:\windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 20:18 - 2015-05-22 21:51 - 00000000 ____D C:\Program Files\Microsoft Office 15
2015-06-23 13:30 - 2010-11-21 05:27 - 00300704 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-06-22 21:27 - 2014-09-02 06:50 - 00000000 ____D C:\ProgramData\AMD
2015-06-22 21:18 - 2015-03-05 23:37 - 09313424 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atidxx32.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 01115648 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\aticfx32.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 00827392 _____ (AMD) C:\windows\system32\coinst_14.30.dll
2015-06-22 21:18 - 2015-03-05 23:37 - 00126848 _____ (Advanced Micro Devices, Inc. ) C:\windows\SysWOW64\atiuxpag.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 10887776 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atidxx64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 08295784 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiumd64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 01338128 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\aticfx64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 01211392 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atiadlxx.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\windows\system32\atidemgy.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00144328 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiuxp64.dll
2015-06-22 21:18 - 2014-09-02 06:43 - 00118096 _____ (Advanced Micro Devices, Inc. ) C:\windows\system32\atiu9p64.dll
2015-06-22 21:18 - 2014-03-29 01:26 - 00000000 ____D C:\SWSETUP
2015-06-21 15:25 - 2014-11-15 21:05 - 00000000 ____D C:\Users\Hermann\AppData\Local\Adobe
2015-06-19 17:16 - 2014-11-16 21:31 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2015-06-18 08:41 - 2015-05-25 11:23 - 00109272 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2015-06-18 08:41 - 2015-05-25 11:23 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2015-06-18 08:41 - 2015-05-25 11:23 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
==================== Files in the root of some directories =======
2015-01-17 20:46 - 2015-07-15 12:21 - 1339598 _____ () C:\Users\Hermann\AppData\Local\BTServer.log
2014-11-14 12:58 - 2014-11-14 12:58 - 0000036 _____ () C:\Users\Hermann\AppData\Local\housecall.guid.cache
2014-09-02 06:36 - 2015-01-16 21:23 - 14953458 _____ () C:\ProgramData\hpcsmmsilogs.log
2014-09-02 07:13 - 2014-09-02 07:13 - 1262966 _____ () C:\ProgramData\hpdam_install_log.txt
2014-09-02 07:13 - 2014-09-02 07:13 - 0544160 _____ () C:\ProgramData\HPFileSanitizer_Install_Log.txt
Some files in TEMP:
====================
C:\Users\Hermann\AppData\Local\Temp\Quarantine.exe
C:\Users\Hermann\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-07-13 11:19
==================== End of log ============================
Hoffe das alles passt Gruß Basti  |
|
| Themen zu Windows 7: PC friert oft ein. Auch wenn nur Outlook offen ist. |
| adobe, adware, bonjour, browser, defender, device driver, einfrieren, explorer, firefox, firefox 39.0, google, installation, maus, monitor, mozilla, programm, realtek, registry, scan, security, services.exe, software, super, system, temp, updates, usb, warum, windows |
Hybrid-Darstellung
