| RedHot1982 | 17.02.2015 01:28 |
Positive Finds Add + Schrift verzerrt
Hallo!
Ich habe letzte Woche irgendwie Positive Finds auf meinem Notebook installiert. Es gingen ständig Werbungen auf. Weiters ist mir aufgefallen, dass die Schrift im Google, Mails, teilweise Homepages verzerrt sind.
Die Positive Finds Add habe ich in Firefox und IE gelöscht (über Adds-Funktionen deaktiviert bzw. gelöscht). Leider dürfte ich noch immer ein Problem haben, da die Schriften in Mails nicht mehr so klar lesbar sind (Schriften wirken verzerrt - es erscheint, wie wenn es ein bisschen ausgefranzt ist).
Habe auch schon AdwCleaner installiert. Beim Löschen bleibt jedoch der Balken gleich nach dem Start stehen (bei ca. 10%) und es passiert nichts mehr.
Weiters kam nach Löschen des Positive Finds Add und nach Durchführung von Screenings mit Malwarebytes, dass nun ein unbekanntes Objekt vorhanden ist (PNP-Gerätesteuerung: ROOT\LEGACY_TUNEUPUTILITIESDRV\0000).
Danke für eure Hilfe!!!! Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:44 on 16/02/2015 (Markus)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)
-=E.O.F=-
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-02-2015
Ran by Markus (administrator) on MARKUS-PC on 17-02-2015 00:06:18
Running from C:\Users\Markus\Desktop
Loaded Profiles: Markus (Available profiles: Markus & Beruf)
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcsrvx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ArcSoft Inc.) C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgwdsvc.exe
(OptionNV) C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe
() C:\Program Files\Canon\IJPLM\ijplmsvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Nero AG) C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgnsx.exe
(Prolific Technology Inc.) C:\Windows\System32\IoctlSvc.exe
() C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgemcx.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(AVG Technologies) C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
(S3 Graphics Co., Ltd.) C:\Windows\System32\s3trayp.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Windows\System32\ESB.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Nuance Communications, Inc.) C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Chicony Electronics Co., Ltd.) C:\Windows\System32\DVAPTray.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Geek Software GmbH) C:\Program Files\pdf24\pdf24.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgui.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(ArcSoft) C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Nero AG) C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realsched.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\Update\realonemessagecenter.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 10.0\Reader\reader_sl.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2015\avgcfgex.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4018176 2006-11-20] (Realtek Semiconductor)
HKLM\...\Run: [S3Trayp] => S3trayp.exe -chkautorun
HKLM\...\Run: [ESB] => C:\Windows\system32\ESB.EXE [266240 2006-05-29] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [869936 2007-05-24] (Synaptics, Inc.)
HKLM\...\Run: [LanguageShortcut] => C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe [52256 2007-01-08] ()
HKLM\...\Run: [PaperPort PTD] => C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] => C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2007-10-11] (Nuance Communications, Inc.)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [DVAPTray] => C:\Windows\System32\DVAPTray.exe [188416 2009-10-30] (Chicony Electronics Co., Ltd.)
HKLM\...\Run: [PAC7302_Monitor] => C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [PDFPrint] => C:\Program Files\pdf24\pdf24.exe [191016 2014-05-14] (Geek Software GmbH)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2015\avgui.exe [3667472 2014-12-18] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [1828136 2008-02-28] (Nero AG)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {12d6d0f5-521e-11df-933d-0040d0e86c2a} - G:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {1c89ada2-4977-11df-a25c-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {5d86b4c8-e6df-11dd-854a-0015afd3cc7a} - F:\LaunchU3.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {6f152377-3e1f-11df-9976-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {717e6b46-e95f-11de-bf93-0015afd3cc7a} - F:\setup.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {750db5e0-4e36-11df-b467-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {90bbca4d-48f3-11e0-b8e4-0040d0e86c2a} - explorer.exe hxxp://www.drei.at/inside3
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282eb9-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {9b282ec7-49fb-11df-8789-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a75-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a47e2a82-3da7-11df-b946-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {a71f3ffc-4974-11df-a7ab-0015afd3cc7a} - F:\AutoRun.exe
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {b4c891f2-1010-11df-abcb-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {d0c934e2-100a-11df-ad9e-0015afd3cc7a} - F:\.\Autorun.exe AUTORUN=1
HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\MountPoints2: {dace676e-5937-11df-b566-0040d0e86c2a} - F:\AutoRun.exe
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL => C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll [146432 2008-07-24] (Google)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Device Monitor.lnk
ShortcutTarget: Device Monitor.lnk -> C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe (ArcSoft)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\.DEFAULT -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\.DEFAULT -> {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = hxxp://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms}
SearchScopes: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
BHO: Skype add-on (mastermind) -> {22BF413B-C6D2-4d91-82A9-A0F997BA588C} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: DivX HiQ -> {593DDEC6-7468-4cdd-90E1-42DADAA222E9} -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {A057A204-BACC-4D26-9990-79A187E2698E} - No File
Toolbar: HKU\S-1-5-21-349582430-969671104-3874210206-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab
DPF: {CAFEEFAC-0018-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.8.0/jinstall-1_8_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @canon.com/EPPEX -> C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin: @divx.com/DivX OVS Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 -> C:\Program Files\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @real.com/nppl3260;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlchromebrowserrecordext;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlhtml5videoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprndlpepperflashvideoshim;version=1.3.0 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=16.0.0.282 -> c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-349582430-969671104-3874210206-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdbplug.dll (DNAML Pty Ltd)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml
FF Extension: DownloadHelper - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2015-02-15]
FF Extension: ProxTube - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\ich@maltegoetz.de.xpi [2015-02-15]
FF Extension: Adblock Plus - C:\Users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\4nj2b5pe.default-1423956989169\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-15]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-09]
FF HKLM\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-01-16]
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2012-12-18]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM\...\Chrome\Extension: [fnjbmmemklcjgepojigaapkoodmkgbae] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\wpa\wpa.crx [2010-12-08]
CHR HKLM\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2012-11-29]
CHR HKLM\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files\AVG\AVG2012\Chrome\safesearch.crx [Not Found]
CHR HKLM\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files\DivX\DivX Plus Web Player\google_chrome\html5video\html5video.crx [2010-12-08]
========================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 ACDaemon; C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVGIDSAgent; C:\Program Files\AVG\AVG2015\avgidsagent.exe [3432976 2014-12-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\AVG2015\avgwdsvc.exe [298080 2014-12-18] (AVG Technologies CZ, s.r.o.)
S3 FirebirdServerMAGIXInstance; C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe [1527900 2005-11-17] (MAGIX®) [File not signed]
S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe [69120 2008-07-24] (Google) [File not signed]
R2 GtDetectSc; C:\Program Files\telering\tele.ring Mobile Internet\GtDetectSc.exe [196704 2007-12-18] (OptionNV) [File not signed]
S2 gupdate1ca10806b390478; C:\Program Files\Google\Update\GoogleUpdate.exe [107912 2014-10-26] (Google Inc.)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [File not signed]
R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-01-09] ()
S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed]
S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 TuneUp.UtilitiesSvc; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [2161976 2015-02-12] (AVG Technologies)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 Afc; C:\Windows\System32\drivers\Afc.sys [18688 2006-11-10] (Arcsoft, Inc.)
R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208152 2014-12-08] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [154904 2014-11-18] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [192792 2014-08-28] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [230680 2014-07-18] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-10-05] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-18] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [200984 2014-10-10] (AVG Technologies CZ, s.r.o.)
S3 BrSerIf; C:\Windows\System32\Drivers\BrSerIf.sys [52224 2006-12-12] (Brother Industries Ltd.) [File not signed]
S3 camfilt2; C:\Windows\System32\DRIVERS\camfilt2.sys [94720 2007-08-06] (Guillemot Corporation)
R3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc. )
S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-10-09] () [File not signed]
S3 GT72NDISIPXP; C:\Windows\System32\DRIVERS\Gt51Ip.sys [106624 2008-02-18] (Option N.V.)
S3 GT72UBUS; C:\Windows\System32\DRIVERS\gt72ubus.sys [59648 2008-02-08] (Option N.V.)
S3 GTPTSER; C:\Windows\System32\DRIVERS\gtptser.sys [8064 2007-03-30] (Option N.V.)
S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [103040 2009-06-15] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [458752 2007-11-08] (PixArt Imaging Inc.)
R3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [252416 2007-06-01] (Realtek Semiconductor Corporation )
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [90536 2008-05-27] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-05-27] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [122152 2008-05-27] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [115496 2008-05-27] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [25768 2008-05-27] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [111912 2008-05-27] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [117672 2008-05-27] (MCCI Corporation)
R3 S3GIGP; C:\Windows\System32\DRIVERS\VTGKModeDX32.sys [791040 2007-07-20] (S3 Graphics Co., Ltd.)
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10371072 2007-07-17] (Sonix Co. Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2009-07-21] (Duplex Secure Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2015-01-13] (TuneUp Software)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 tcpipBM; No ImagePath
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-17 00:06 - 2015-02-17 00:07 - 00024303 _____ () C:\Users\Markus\Desktop\FRST.txt
2015-02-17 00:05 - 2015-02-17 00:06 - 00000000 ____D () C:\FRST
2015-02-16 23:44 - 2015-02-16 23:44 - 00000634 _____ () C:\Users\Markus\Desktop\defogger_disable.log
2015-02-16 23:44 - 2015-02-16 23:44 - 00000020 _____ () C:\Users\Markus\defogger_reenable
2015-02-16 23:43 - 2015-02-16 23:43 - 00380416 _____ () C:\Users\Markus\Desktop\Gmer-19357.exe
2015-02-16 23:42 - 2015-02-16 23:42 - 01125888 _____ (Farbar) C:\Users\Markus\Desktop\FRST.exe
2015-02-16 23:41 - 2015-02-16 23:41 - 00050477 _____ () C:\Users\Markus\Desktop\Defogger.exe
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\AVG2015
2015-02-15 21:37 - 2015-02-15 21:37 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg2015
2015-02-15 21:35 - 2015-02-15 21:35 - 00000000 ____D () C:\Users\Beruf\AppData\Local\Avg
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-15 13:45 - 2015-02-15 13:45 - 00000000 _____ () C:\Windows\setupact.log
2015-02-15 13:39 - 2015-02-15 13:39 - 00001857 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001849 _____ () C:\Users\Public\Desktop\AVG 1-Klick-Wartung.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00001845 _____ () C:\Users\Public\Desktop\AVG PC TuneUp 2015.lnk
2015-02-15 13:39 - 2015-02-15 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2015
2015-02-15 13:38 - 2015-02-15 13:38 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG
2015-02-15 13:32 - 2015-02-15 13:33 - 00000000 ____D () C:\Users\Markus\Desktop\Strategiebesprechung
2015-02-15 13:29 - 2015-02-15 13:29 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg
2015-02-15 13:26 - 2015-02-15 13:48 - 00000000 ____D () C:\ProgramData\AVG
2015-02-15 13:16 - 2015-02-15 13:16 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\AVG2015
2015-02-15 13:15 - 2015-02-15 13:15 - 00000822 _____ () C:\Users\Public\Desktop\AVG 2015.lnk
2015-02-15 13:15 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-02-15 13:12 - 2015-02-15 13:15 - 00000000 ____D () C:\ProgramData\AVG2015
2015-02-15 13:10 - 2015-02-15 13:32 - 00000000 ____D () C:\Program Files\AVG
2015-02-15 13:09 - 2015-02-15 13:46 - 00000000 ____D () C:\Users\Markus\AppData\Local\Avg2015
2015-02-15 13:03 - 2015-02-15 13:03 - 00000000 ____D () C:\OETemp
2015-02-15 11:35 - 2015-02-15 21:28 - 00007556 _____ () C:\Windows\PFRO.log
2015-02-15 02:27 - 2015-02-15 02:27 - 00000000 ____D () C:\Programᡄ
2015-02-15 02:20 - 2011-06-21 11:24 - 00032768 _____ () C:\Windows\system32\Drivers\sp_rsdrv2.sys
2015-02-15 02:18 - 2015-02-12 17:39 - 00037176 _____ (AVG Technologies) C:\Windows\system32\TURegOpt.exe
2015-02-15 02:18 - 2015-02-12 17:39 - 00025912 _____ (AVG Technologies) C:\Windows\system32\authuitu.dll
2015-02-15 02:16 - 2015-02-15 02:16 - 02112512 _____ () C:\Users\Markus\Desktop\adwcleaner_4.110.exe
2015-02-15 00:34 - 2015-02-16 23:16 - 00000000 ____D () C:\AdwCleaner
2015-02-14 21:37 - 2015-02-16 23:54 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-14 21:36 - 2015-02-14 21:36 - 00000863 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-14 21:36 - 2015-02-14 21:36 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-02-14 21:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-14 21:36 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-14 21:35 - 2015-02-14 21:35 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Chip Digital GmbH
2015-02-12 23:03 - 2015-02-12 22:57 - 00146432 _____ (Oracle Corporation) C:\Windows\system32\javacpl.cpl
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-02-12 23:00 - 2015-02-12 22:57 - 00176552 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-02-12 22:00 - 2015-01-09 01:20 - 02063360 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-12 22:00 - 2014-11-26 03:05 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-12 21:59 - 2015-01-13 02:39 - 00974848 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-12 21:55 - 2015-01-15 05:13 - 00440760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-12 21:50 - 2014-12-08 02:59 - 00306176 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-12 21:48 - 2015-02-03 12:57 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-02-12 21:48 - 2015-02-03 12:55 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-02-12 21:48 - 2015-02-03 12:53 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 06004736 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-12 21:48 - 2015-02-03 12:52 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 11084288 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-12 21:48 - 2015-02-03 12:51 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-12 21:48 - 2015-02-03 12:51 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-12 21:48 - 2015-02-03 12:49 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-12 21:48 - 2015-02-03 11:13 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-02-12 21:48 - 2015-02-03 09:29 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-12 21:47 - 2015-02-03 12:52 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-02-12 21:47 - 2015-02-03 12:51 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-12 21:47 - 2015-02-03 12:49 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-02-12 21:47 - 2015-02-03 09:29 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-12 21:47 - 2015-02-03 09:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-02-12 21:47 - 2015-02-03 09:26 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-09 21:27 - 2015-02-15 13:15 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\TuneUp Software
2015-02-09 21:27 - 2015-02-09 21:27 - 00000000 ____D () C:\Users\Markus\AppData\Local\TuneUp Software
2015-02-09 21:21 - 2015-02-09 21:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\FreeVideoFlipAndRotate
2015-02-09 21:20 - 2015-02-09 21:37 - 00000000 ____D () C:\ProgramData\TuneUp Software
2015-02-09 21:20 - 2015-02-09 21:20 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\RHEng
2015-01-29 22:04 - 2015-02-14 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-01-22 23:35 - 2015-01-22 23:40 - 00014336 _____ () C:\Users\Markus\Desktop\Wok Grill.xls
2015-01-21 21:58 - 2015-01-21 21:58 - 140980086 _____ () C:\Users\Markus\Desktop\Video first production Pizzaschiffchen salami.mov
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-16 23:58 - 2009-09-06 21:47 - 01225263 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 23:57 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-16 23:54 - 2009-07-29 20:13 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-16 23:53 - 2009-04-04 20:40 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-02-16 23:49 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-16 23:49 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-16 23:49 - 2006-11-02 13:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-16 23:45 - 2006-11-02 14:01 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-02-16 23:44 - 2008-10-18 11:21 - 00000000 ____D () C:\Users\Markus
2015-02-16 23:33 - 2012-07-25 19:07 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-16 23:11 - 2009-07-29 20:13 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-16 21:54 - 2012-06-07 12:03 - 00000000 ____D () C:\ProgramData\MFAData
2015-02-16 21:53 - 2012-06-21 21:13 - 00000398 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job
2015-02-15 21:37 - 2010-09-16 18:46 - 00000000 ____D () C:\Users\Beruf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Home Cinema
2015-02-15 14:50 - 2008-10-27 20:21 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\Skype
2015-02-15 14:49 - 2008-06-25 14:09 - 00000000 ____D () C:\Windows\Panther
2015-02-15 14:47 - 2013-11-10 17:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-15 13:42 - 2009-07-29 20:10 - 00001052 _____ () C:\Windows\Tasks\Google Software Updater.job
2015-02-15 12:02 - 2008-10-18 13:23 - 00000000 ____D () C:\Users\Markus\Documents\PRIVAT
2015-02-15 02:05 - 2008-06-26 05:39 - 00000000 ____D () C:\Program Files\Common Files\Java
2015-02-15 01:48 - 2012-04-20 19:26 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\DVDVideoSoft
2015-02-15 00:56 - 2014-12-07 18:15 - 00000000 ____D () C:\Users\Markus\AppData\Local\RGMService
2015-02-14 23:50 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-02-14 23:13 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-02-12 23:06 - 2013-11-10 17:37 - 00000000 ____D () C:\ProgramData\Oracle
2015-02-12 22:57 - 2014-11-13 19:25 - 00272296 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2015-02-12 22:45 - 2006-11-02 13:47 - 03707464 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 22:11 - 2013-08-18 19:37 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 22:01 - 2006-11-02 11:24 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-02-11 23:02 - 2008-11-19 10:30 - 00000000 ____D () C:\Users\Markus\AppData\Local\PokerStars
2015-02-11 22:37 - 2009-12-16 11:07 - 00000000 ____D () C:\Users\Markus\AppData\Roaming\vlc
2015-02-09 21:43 - 2008-10-29 10:14 - 00069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-02-09 21:18 - 2008-01-21 08:16 - 00006650 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-04 21:33 - 2012-07-25 19:07 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-02-04 21:33 - 2011-06-20 19:36 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-02-02 20:18 - 2012-11-07 22:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
==================== Files in the root of some directories =======
2009-07-21 21:23 - 2009-07-21 21:23 - 4182178 _____ (The Public) C:\Users\Markus\AppData\Roaming\Avisynth.exe
2009-07-21 21:23 - 2009-07-21 21:23 - 5243208 _____ ( ) C:\Users\Markus\AppData\Roaming\AvsP.exe
2009-07-28 20:46 - 2011-01-16 19:49 - 0000166 _____ () C:\Users\Markus\AppData\Roaming\Default.PLS
2009-07-21 21:23 - 2009-07-21 21:25 - 4284535 _____ (ffdshow ) C:\Users\Markus\AppData\Roaming\ffdshow.exe
2010-09-28 22:36 - 2010-09-28 22:44 - 0176128 _____ () C:\Users\Markus\AppData\Roaming\fontdb.mdb
2009-07-21 21:23 - 2009-07-21 21:45 - 2040451 _____ (LIGHTNING UK!) C:\Users\Markus\AppData\Roaming\Imgburn.exe
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Piano Med
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pianos and Keyboards
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\Users\Markus\AppData\Roaming\Pick Bass
2009-07-21 21:23 - 2009-07-21 21:23 - 0642685 _____ (Xvid team ) C:\Users\Markus\AppData\Roaming\xvid.exe
2012-04-21 09:07 - 2012-06-20 23:07 - 0000680 _____ () C:\Users\Markus\AppData\Local\d3d9caps.dat
2008-10-29 10:14 - 2015-02-09 21:43 - 0069632 _____ () C:\Users\Markus\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-12-15 11:12 - 2013-06-10 22:07 - 0823012 _____ () C:\Users\Markus\AppData\Local\Optimizer.txt
2012-10-11 21:09 - 2012-10-11 21:09 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT
2012-10-11 21:09 - 2013-03-24 18:27 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT
2012-10-11 21:09 - 2012-10-11 21:18 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Planets
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plants
2012-10-11 21:09 - 2012-10-11 21:09 - 0000268 ___RH () C:\ProgramData\Plug-In Settings
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Profiles
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Quartz Composer
2012-10-11 21:09 - 2012-10-11 21:09 - 0000012 ___RH () C:\ProgramData\Receipts
Some content of TEMP:
====================
C:\Users\Beruf\AppData\Local\Temp\avgnt.exe
C:\Users\Beruf\AppData\Local\Temp\~convert1837889909121605377.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4109784010493011813.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4209830696876608383.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4485552456435490824.exe
C:\Users\Beruf\AppData\Local\Temp\~convert4816294060936977035.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5129652577971428585.exe
C:\Users\Beruf\AppData\Local\Temp\~convert530476614210965046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5388659676246649071.exe
C:\Users\Beruf\AppData\Local\Temp\~convert5767244083265548046.exe
C:\Users\Beruf\AppData\Local\Temp\~convert6259682022611103149.exe
C:\Users\Beruf\AppData\Local\Temp\~convert7283267209106047323.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8207960948104172192.exe
C:\Users\Beruf\AppData\Local\Temp\~convert8651104764550743687.exe
C:\Users\Markus\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Markus\AppData\Local\Temp\nofkkbaq.dll
C:\Users\Markus\AppData\Local\Temp\Quarantine.exe
C:\Users\Markus\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Markus\AppData\Local\Temp\sqlite3.dll
C:\Users\Markus\AppData\Local\Temp\TUUUninstallHelper.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-02-16 23:58
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 15-02-2015
Ran by Markus at 2015-02-17 00:08:22
Running from C:\Users\Markus\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2015 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AC3Filter (remove only) (HKLM\...\AC3Filter) (Version: - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)
Adobe Community Help (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Download Assistant (HKLM\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.0.6 - Adobe Systems Incorporated)
Adobe Dreamweaver CS5 (HKLM\...\{C79312BD-3E76-4474-A10C-1435D1856A4B}) (Version: 11.0 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Professional CS5.5 (HKLM\...\{23E445D5-FD83-4C50-A211-EB26A2975317}) (Version: 11.5 - Adobe Systems Incorporated)
Adobe InDesign CS5 (HKLM\...\{F9766AC1-1461-1033-B862-DF8FE1C033BE}) (Version: 7.0 - Adobe Systems Incorporated)
Adobe Media Player (HKLM\...\com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.8 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Apple Application Support (HKLM\...\{553255F3-78FD-40F1-A6F8-6882140265FE}) (Version: 1.2.1 - Apple Inc.)
ArcSoft MediaConverter 3 (HKLM\...\{EE27AA87-8593-4B8A-A595-29E289C5520F}) (Version: 3.1.8.81 - ArcSoft)
Avanquest update (HKLM\...\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}) (Version: 1.19 - Avanquest Software)
AVG 2015 (HKLM\...\AVG) (Version: 2015.0.5645 - AVG Technologies)
AVG 2015 (Version: 15.0.4284 - AVG Technologies) Hidden
AVG 2015 (Version: 15.0.5645 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (de-DE) (Version: 15.0.1001.393 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM\...\AVG PC TuneUp) (Version: 15.0.1001.393 - AVG Technologies)
AVG PC TuneUp 2015 (Version: 15.0.1001.393 - AVG Technologies) Hidden
Canon Inkjet Printer/Scanner/Fax Extended Survey Program (HKLM\...\CANONIJPLM100) (Version: - )
Canon MG2100 series Benutzerregistrierung (HKLM\...\Canon MG2100 series Benutzerregistrierung) (Version: - )
Canon MG2100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG2100_series) (Version: - )
Canon MG2100 series On-screen Manual (HKLM\...\Canon MG2100 series On-screen Manual) (Version: - )
Canon MP Navigator EX 5.0 (HKLM\...\MP Navigator EX 5.0) (Version: - )
Canon My Printer (HKLM\...\CanonMyPrinter) (Version: - )
Canon Solution Menu EX (HKLM\...\CanonSolutionMenuEX) (Version: - )
CCleaner (remove only) (HKLM\...\CCleaner) (Version: - Piriform)
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6021.5000 - Microsoft Corporation)
ConvertHelper 2.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1) (Version: - DownloadHelper)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.1109a - CyberLink Corp.)
DataLogger (HKLM\...\ST6UNST #3) (Version: - )
DHTML Menu Studio (HKLM\...\DHTML Menu Studio Standard Demo_is1) (Version: 5.0.0.150 - Xtreeme GmbH)
DL2005 (C:\Program Files\DL2005\) (HKLM\...\ST6UNST #2) (Version: - )
DL2005 (HKLM\...\ST6UNST #1) (Version: - )
DVAPTray (HKLM\...\{30D1B542-44E0-44F0-8A31-2A101CB626B5}) (Version: 1.0.0.7 - )
Easy Start Button (HKLM\...\ESB) (Version: - )
ffdshow [rev 3026] [2009-07-05] (HKLM\...\ffdshow_is1) (Version: 1.0 - )
Firebird SQL Server - MAGIX Edition (HKLM\...\Firebird SQL Server D) (Version: 2.0.1.13 - MAGIX AG)
Google Desktop (HKLM\...\Google Desktop) (Version: - - Google)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Google Updater (HKLM\...\Google Updater) (Version: 2.4.2432.1652 - Google Inc.)
Hercules Classic Silver Webcam (HKLM\...\{FD4FE0F7-91FC-43A2-9C3A-187553991FFF}) (Version: 2.8.0.0 - Hercules)
HOFER Bestellsoftware 4.13.0 (HKLM\...\HOFER Bestellsoftware) (Version: 4.13.0 - ORWO Net)
Hofer Foto Manager Free (HKLM\...\Hofer Foto Manager Free D) (Version: 3.4.0.466 - MAGIX AG)
Hofer Foto Service (HKLM\...\Hofer Foto Service D) (Version: 1.12.0.95 - MAGIX AG)
Hofer Fotobuch und Kalender Druck Service (HKLM\...\Pixelspeed_LayouterH) (Version: - )
Hofer Online Druck Service 3.0.6.0 (D) (HKLM\...\Hofer Online Druck Service D) (Version: 3.0.6.0 - MAGIX AG)
IrfanView (remove only) (HKLM\...\IrfanView) (Version: - )
Japanese Fonts Support For Adobe Reader 8 (HKLM\...\{AC76BA86-7AD7-5760-0000-800000000003}) (Version: 8.0 - Adobe Systems)
Macromedia Extension Manager (HKLM\...\{A5BA14E0-7384-11D4-BAE7-00409631A2C8}) (Version: 1.5 - Macromedia)
Macromedia Fireworks MX 2004 (HKLM\...\{E583ED6F-BD99-4066-A420-C815BF692B69}) (Version: 7 - Macromedia)
Macromedia Flash MX (HKLM\...\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}) (Version: 6 - Macromedia)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Matrox VFW Software Codecs, build 28 (HKLM\...\Matrox VFW Software Codecs) (Version: - )
MDI viewer 0.1 (HKLM\...\MDI (Microsoft Office Document Image) Viewer_is1) (Version: 0.1 - )
MediaShow (HKLM\...\{D5A9B7C0-8751-11D8-9D75-000129760D75}) (Version: 3.0.4325 - CyberLink Corporation)
MEDION Fotos auf CD Hofer (HKLM\...\MEDION Fotos auf CD Hofer D) (Version: 6.0.2.0 - MAGIX AG)
Medion GoPal Assistant 4.03.006 (HKLM\...\Medion GoPal Assistant) (Version: 4.3.6.0 - Medion)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office XP Professional mit FrontPage (HKLM\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.2701.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.0.61118.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Web Embedding Fonts Tool (III) (HKLM\...\WEFT) (Version: - )
Mobile Partner (HKLM\...\Mobile Partner) (Version: 11.300.05.00.152 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 35.0.1 (x86 de) (HKLM\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB936181) (HKLM\...\{C04E32E0-0416-434D-AFB9-6969D703A9EF}) (Version: 4.20.9848.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB941833) (HKLM\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero 8 Essentials (HKLM\...\{47948554-90C6-4AAC-8CFA-D23CE11C1031}) (Version: 8.3.124 - Nero AG)
Nikon File Uploader 2 (HKLM\...\{D1E7142C-6BC3-49EB-A71A-E5D7ADAC7599}) (Version: 2.0.2 - Nikon)
Nikon Message Center 2 (HKLM\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.0.1 - Nikon)
PaperPort Image Printer (HKLM\...\{2BC2781A-F7F6-452E-95EB-018A522F1B2C}) (Version: 1.00.0000 - Nuance Communications, Inc.)
PC Connectivity Solution (HKLM\...\{34610DE0-3C13-42CA-8E32-01FFA38AB6E8}) (Version: 8.47.7.0 - Nokia)
PDF Settings CS5 (Version: 10.0 - Adobe Systems Incorporated) Hidden
PDF24 Creator 6.4.1 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PhotoNow! (HKLM\...\{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.0.4310 - CyberLink Corp.)
Picture Control Utility (HKLM\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.1 - Nikon)
PowerDirector (HKLM\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 6.5.2209a - CyberLink Corp.)
PowerDirector (Version: 6.5.2209a - CyberLink Corp.) Hidden
PowerDVD (HKLM\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 7.0.3118.0 - CyberLink Corporation)
PowerProducer (HKLM\...\{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 4.2.2219 - CyberLink Corp.)
Prolific USB-Serial Comm Port Driver (HKLM\...\{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}) (Version: 1.0.0.3 - Prolific Electronics Industries co.,ltd)
QuickShare (HKLM\...\{11D4FAA0-A577-4FA8-B24E-D24283D861D1}) (Version: 11.24.60.15709 - Linkury Inc.) <==== ATTENTION
QuickTime (HKLM\...\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}) (Version: 7.66.71.0 - Apple Inc.)
RealDownloader (Version: 1.3.0 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5464 - )
RealUpgrade 1.1 (Version: 1.1.0 - RealNetworks, Inc.) Hidden
Revo Uninstaller 1.94 (HKLM\...\Revo Uninstaller) (Version: 1.94 - VS Revo Group)
ScanSoft PaperPort 11 (HKLM\...\{FA0E44BC-3731-42D5-BA98-E99DD5D70A83}) (Version: 11.1.0000 - Nuance Communications, Inc.)
SDP Downloader (HKLM\...\{B547CB8D-549A-436E-97B5-E79F911B11E2}) (Version: 2.3.0 - SDP Multimedia)
Skype web features (HKLM\...\{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}) (Version: 1.0.3971 - Skype Technologies S.A.)
Skype™ 4.1 (HKLM\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.1.179 - Skype Technologies S.A.)
SPAMfighter (Version: 7.6.104 - Spamfighter ApS) Hidden
StreamTransport version: 1.0.2.2171 (HKLM\...\{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1) (Version: - )
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.2.7.0 - Synaptics)
tele.ring Mobile Internet (HKLM\...\{E665E293-442E-4B34-B515-1412F9921B8C}_x) (Version: 2.6.0.384 - Option nv)
tele.ring Mobile Internet (Version: 2.6.0.384 - Option nv) Hidden
Telescope Driver (HKLM\...\{B2920232-19DA-44FC-835F-68E427EAE2CE}) (Version: 10.30.09 - PixArt)
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.340 - TuneUp Software) Hidden
Unity Web Player (HKU\S-1-5-21-349582430-969671104-3874210206-1000\...\UnityWebPlayer) (Version: - Unity Technologies ApS)
VCRedistSetup (Version: 1.0.0 - Nero AG) Hidden
VIA Display Vista Driver 7.14.14.0019 (HKLM\...\VIA Chrome9 HC IGP Family Windows Vista Display) (Version: - )
ViewNX 2 (HKLM\...\{DDD62492-32A7-412B-8AF1-2CF032AD42E3}) (Version: 2.0.2 - Nikon)
Vista Buttons (HKLM\...\Vista Buttons) (Version: - )
Visual Studio 2012 x86 Redistributables (HKLM\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 1.0.3 (HKLM\...\VLC media player) (Version: 1.0.3 - VideoLAN Team)
Windows Movie Maker 2.6 (HKLM\...\{B3DAF54F-DB25-4586-9EF1-96D24BB14088}) (Version: 2.6.4040.0 - Microsoft Corporation)
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) (HKLM\...\504244733D18C8F63FF584AEB290E3904E791693) (Version: 08/22/2008 7.0.0.0 - Nokia)
WinMerge 2.14.0 (HKLM\...\WinMerge_is1) (Version: 2.14.0 - Thingamahoochie Software)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Markus\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{9E385F0A-0BA2-430C-96AA-4399C5E40F6C}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{BB6410D8-F879-4184-9C5C-6A02D16AE0B3}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{CA1073A2-5F3F-4445-8E5E-7109BDCEDDBE}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{D5A55D2D-C59D-42C3-A5BF-4C08EEE74339}\InprocServer32 -> C:\Program Files\Skype\Plugin Manager\ezPMUtils.dll (EasyBits Media AS)
CustomCLSID: HKU\S-1-5-21-349582430-969671104-3874210206-1000_Classes\CLSID\{DCA74850-096D-40CD-BB81-17034E51ACB6}\localserver32 -> C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
==================== Restore Points =========================
15-01-2015 22:01:55 Windows Update
09-02-2015 21:37:57 Revo Uninstaller's restore point - TuneUp Utilities 2014
09-02-2015 21:39:37 TuneUp Utilities 2014 wird entfernt
09-02-2015 22:21:42 TuneUp Utilities 2014 (de-DE) wird entfernt
11-02-2015 23:01:59 Revo Uninstaller's restore point - PokerStars
12-02-2015 21:47:39 Windows Update
14-02-2015 18:20:20 Windows Update
14-02-2015 19:12:42 Revo Uninstaller's restore point - Positive Finds
14-02-2015 20:30:57 Windows-Modulinstallation
14-02-2015 20:53:57 Windows-Modulinstallation
14-02-2015 21:25:18 Windows Update
14-02-2015 21:27:23 Windows Update
14-02-2015 21:28:51 Windows Update
14-02-2015 22:19:07 Revo Uninstaller's restore point - Cliqz
14-02-2015 22:24:53 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
14-02-2015 22:27:05 Revo Uninstaller's restore point - Mozilla Firefox 35.0.1 (x86 de)
15-02-2015 01:44:06 Revo Uninstaller's restore point - Free Video Flip and Rotate version 1.0.9.128
15-02-2015 02:02:05 Removed Java 8 Update 31
15-02-2015 02:09:15 Revo Uninstaller's restore point - SPAMfighter
15-02-2015 02:19:28 Revo Uninstaller's restore point - TuneUp Utilities 2014
15-02-2015 11:42:03 Windows Update
15-02-2015 12:37:39 Revo Uninstaller's restore point - Spyware Terminator 2015
15-02-2015 12:50:05 Revo Uninstaller's restore point - Unknown Device Identifier 8.02
15-02-2015 12:52:35 Revo Uninstaller's restore point - Avira Free Antivirus
15-02-2015 13:02:59 Revo Uninstaller's restore point - Avira
15-02-2015 13:10:20 Installed AVG 2015
15-02-2015 13:11:10 Installed AVG 2015
15-02-2015 13:29:11 AVG PC TuneUp 2015 wird installiert
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2006-11-02 11:23 - 2010-09-13 10:59 - 00000084 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {09471F20-FD55-424B-B232-22A8CB9DC56A} - System32\Tasks\SSBkgdUpdate => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2006-10-25] (Nuance Communications, Inc.)
Task: {14846EF2-E82B-4CDC-BD45-9346356AC093} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {2658DD86-9544-4AE6-B39B-9721808D75D3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {26B95428-CF05-44B7-AD40-0952428CE304} - \RealPlayer (32-bit) No Task File <==== ATTENTION
Task: {274852B8-7817-48D8-9F28-EE411B7533EB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2A7EEA82-47D3-438D-8D67-23C614EA6698} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {2B615096-2F25-4E67-BDB0-43600AC27D72} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {647382CB-357D-41F2-ABF9-96E0DAE8093B} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {6F58BCD1-5997-4E6F-A747-F34783FCD821} - System32\Tasks\Google Software Updater => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-10-05] (Google)
Task: {865349A1-A41D-42AF-BF8B-611CA59F6C66} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-11-30] (RealNetworks, Inc.)
Task: {BB45DE64-9F84-4ADD-82B3-18E2CBA41F0E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {C8ED3C47-480E-449E-9F92-EB8355B58B74} - System32\Tasks\{44BB347D-5325-4066-889A-0D3485C6D0C3} => pcalua.exe -a C:\Users\Markus\Downloads\Programme\Setups\RealPlayer11GOLD_de.exe -d C:\Users\Markus\Downloads\Programme\Setups
Task: {CAC99C03-182F-4267-A42B-9241EA8CA1DE} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\realupgrade.exe [2012-11-29] (RealNetworks, Inc.)
Task: {CDA52374-F8C6-41F3-8F88-E6ABDFE6558D} - System32\Tasks\4808 => Wscript.exe C:\Users\Markus\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {D2DA80A2-B768-468A-9A41-91B1049E36F3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-26] (Google Inc.)
Task: {DF755FFE-5AF1-4FC8-A997-F0A108E15C02} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-349582430-969671104-3874210206-1000 => C:\Program Files\RealNetworks\RealDownloader\recordingmanager.exe [2012-11-29] (RealNetworks, Inc.)
Task: {ED48265D-3C70-4564-96FC-2933644DF1CE} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {FEBCEBF5-82C0-4939-B2AB-992D840CEC29} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-04] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Google Software Updater.job => C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{69D37424-7323-4CD9-9909-D30D85007A62}.job => C:\Windows\system32\msfeedssync.exe
==================== Loaded Modules (whitelisted) ==============
2012-05-05 13:23 - 2011-02-07 08:56 - 00138192 _____ () C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
2012-11-29 20:31 - 2012-11-29 20:31 - 00038608 _____ () C:\Program Files\RealNetworks\RealDownloader\rndlresolversvc.exe
2008-06-26 05:36 - 2007-01-09 10:25 - 00272024 _____ () C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2015-02-12 17:39 - 2015-02-12 17:39 - 00604984 _____ () C:\Program Files\AVG\AVG PC TuneUp\avgreplibx.dll
2015-02-12 17:39 - 2015-02-12 17:39 - 00728888 _____ () C:\Program Files\AVG\AVG PC TuneUp\tulngx.dll
2008-06-25 13:36 - 2006-05-29 12:40 - 00266240 _____ () C:\Windows\System32\ESB.EXE
2015-01-29 22:05 - 2015-01-29 22:05 - 03925104 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-349582430-969671104-3874210206-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\web\wallpaper\img24.jpg
DNS Servers: 192.168.1.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk => C:\Windows\pss\Adobe Gamma Loader.exe.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk => C:\Windows\pss\Adobe Gamma Loader.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^tele.ring Mobile Internet.lnk => C:\Windows\pss\tele.ring Mobile Internet.lnk.CommonStartup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: AdobeCS5.5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: AdobeCS5ServiceManager => "C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
MSCONFIG\startupreg: ArcSoft Connection Service => C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
MSCONFIG\startupreg: CanonMyPrinter => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
MSCONFIG\startupreg: CanonSolutionMenuEx => C:\Program Files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
MSCONFIG\startupreg: DivX Download Manager => "C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe" start
MSCONFIG\startupreg: DivXUpdate => "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: PDFPrint => C:\Program Files\pdf24\pdf24.exe
==================== Accounts: =============================
Administrator (S-1-5-21-349582430-969671104-3874210206-500 - Administrator - Disabled)
Beruf (S-1-5-21-349582430-969671104-3874210206-1002 - Administrator - Enabled) => C:\Users\Beruf
Gast (S-1-5-21-349582430-969671104-3874210206-501 - Limited - Disabled)
Markus (S-1-5-21-349582430-969671104-3874210206-1000 - Administrator - Enabled) => C:\Users\Markus
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (02/16/2015 11:58:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/16/2015 11:58:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/16/2015 11:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm adwcleaner_4.110.exe, Version 4.1.1.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 12e0
Anfangszeit: 01d04a3590200ef4
Zeitpunkt der Beendigung: 15
Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/15/2015 09:37:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/15/2015 01:02:51 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {1aa35571-3775-4356-9b66-fa4328dbc176}
Error: (02/15/2015 01:01:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".
Die abhängige Assemblierung "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (02/15/2015 00:52:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service Spyware Terminator 2015 Realtime Shield Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (02/15/2015 00:52:34 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {db51d1f7-6927-424b-b78a-3f5c84e0814b}
System errors:
=============
Error: (02/16/2015 11:54:05 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (02/16/2015 11:52:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Error: (02/16/2015 11:50:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Gatewaydienst auf Anwendungsebene%%1053
Error: (02/16/2015 11:50:12 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Gatewaydienst auf Anwendungsebene
Error: (02/16/2015 11:50:03 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: tcpipBM
Error: (02/16/2015 11:50:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Error: (02/16/2015 09:51:44 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (02/16/2015 09:51:07 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.
Error: (02/16/2015 09:50:48 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: tcpipBM
Error: (02/16/2015 09:50:48 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058
Microsoft Office Sessions:
=========================
Error: (02/16/2015 11:58:04 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/16/2015 11:58:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/16/2015 11:24:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: adwcleaner_4.110.exe4.1.1.012e001d04a3590200ef415
Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/15/2015 09:58:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/15/2015 09:37:28 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/15/2015 01:02:51 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {1aa35571-3775-4356-9b66-fa4328dbc176}
Error: (02/15/2015 01:01:22 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{AF7EBCA4-9FAF-4DC8-8D09-67854BB84D34}\recordingmanager.exe
Error: (02/15/2015 00:52:36 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description:
Details:
AddWin32ServiceFiles: Unable to back up image of service Spyware Terminator 2015 Realtime Shield Service since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
Error: (02/15/2015 00:52:34 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005
Vorgang:
Generatordaten werden gesammelt
Kontext:
Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
Generatorname: System Writer
Generatorinstanz-ID: {db51d1f7-6927-424b-b78a-3f5c84e0814b}
CodeIntegrity Errors:
===================================
Date: 2015-02-17 00:07:52.459
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:07:51.146
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:07:49.865
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:07:48.568
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:43.349
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:42.177
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:40.974
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:39.756
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidshx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:38.412
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-17 00:06:36.677
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avgidsdriverx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Genuine Intel(R) CPU T1500 @ 1.86GHz
Percentage of memory in use: 56%
Total physical RAM: 2813.4 MB
Available physical RAM: 1222.35 MB
Total Pagefile: 5869.32 MB
Available Pagefile: 4207.73 MB
Total Virtual: 2047.88 MB
Available Virtual: 1898.95 MB
==================== Drives ================================
Drive c: (BOOT) (Fixed) (Total:204.99 GB) (Free:49.62 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVER) (Fixed) (Total:27.88 GB) (Free:21.06 GB) FAT32
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 232.9 GB) (Disk ID: B641FCBA)
Partition 1: (Active) - (Size=205 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=27.9 GB) - (Type=0C)
==================== End Of Log ============================
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-17 01:08:44
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVS-00UST0 rev.01.01A01 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Markus\AppData\Local\Temp\pxdiypoc.sys
---- System - GMER 2.1 ----
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeKey [0x8FAD76E0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeMultipleKeys [0x8FAD7800]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenProcess [0x8FAD7010]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenThread [0x8FAD74D0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendProcess [0x8FAD7300]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendThread [0x8FAD73E0]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateProcess [0x8FAD7120]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateThread [0x8FAD7210]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwWriteVirtualMemory [0x8FAD75E0]
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 3BD 82AB4A08 8 Bytes [E0, 76, AD, 8F, 00, 78, AD, ...]
.text ntkrnlpa.exe!KeSetEvent + 3F1 82AB4A3C 4 Bytes [10, 70, AD, 8F]
.text ntkrnlpa.exe!KeSetEvent + 40D 82AB4A58 4 Bytes [D0, 74, AD, 8F] {SAL BYTE [EBP+EBP*4-0x71], 0x1}
.text ntkrnlpa.exe!KeSetEvent + 611 82AB4C5C 8 Bytes [00, 73, AD, 8F, E0, 73, AD, ...]
.text ntkrnlpa.exe!KeSetEvent + 621 82AB4C6C 8 Bytes [20, 71, AD, 8F, 10, 72, AD, ...]
.text ...
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\Dwm.exe[1368] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\ESB.EXE[1484] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\program files\real\realplayer\update\RealOneMessageCenter.exe[1968] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text c:\program files\real\realplayer\update\RealOneMessageCenter.exe[1968] kernel32.dll!SetUnhandledExceptionFilter 7563A9BD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Windows\system32\taskeng.exe[2680] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\system32\taskeng.exe[3344] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\Explorer.EXE[3364] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\system32\svchost.exe[3596] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\System32\mobsync.exe[3700] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text ...
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!LdrLoadDll 77479378 5 Bytes JMP 6B231F42 C:\Program Files\Mozilla Firefox\mozglue.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtCreateFile 774B4264 5 Bytes JMP 600E9AE0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtFlushBuffersFile 774B4764 5 Bytes JMP 600CC434 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtQueryFullAttributesFile 774B4C94 5 Bytes JMP 600CC150 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtReadFile 774B4EC4 5 Bytes JMP 600CC330 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtReadFileScatter 774B4ED4 5 Bytes JMP 60AEF60F C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteFile 774B54D4 5 Bytes JMP 600EA9F0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteFileGather 774B54E4 5 Bytes JMP 60AEF5BE C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!HeapSetInformation + 26 7563A9B8 7 Bytes JMP 600E63D0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!LockResource + C 75656BD3 7 Bytes JMP 60A14AA0 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] kernel32.dll!VirtualAllocEx + 54 7565B030 7 Bytes JMP 60A14AC3 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] USER32.dll!GetWindowInfo 7694428E 5 Bytes JMP 6090B991 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4340] GDI32.dll!SetStretchBltMode + 256 74FA745C 7 Bytes JMP 60A14A21 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe[4364] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\system32\ctfmon.exe[4488] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4788] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe[4824] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text C:\Windows\system32\SearchProtocolHost.exe[4892] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
.text ...
.text c:\program files\real\realplayer\Update\realsched.exe[5620] kernel32.dll!SetUnhandledExceptionFilter 7563A9BD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\ArcSoft\MediaConverter 3\Monitor.exe[5660] ntdll.dll!NtWriteVirtualMemory 774B5504 5 Bytes JMP 6D971000 C:\Program Files\AVG\AVG2015\avghookx.dll
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys
AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-349582430-969671104-3874210206-1000@RefCount 4
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex\StreamLog@CurrentStreamLog 409
Reg HKLM\SOFTWARE\Classes\CLSID\{B6A930A0-A4F5-43A5-9B4E-6189A6C2B9E8}@f!s!\30!\30!f!`!{!s!r!t!t!s!d!\30!s!d! 19583823
---- EOF - GMER 2.1 ----
|
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: