Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Langsames Laptop-Trojaner von Avira gefunden (https://www.trojaner-board.de/166177-langsames-laptop-trojaner-avira-gefunden.html)

doreagr 16.04.2015 21:42
Langsames Laptop-Trojaner von Avira gefunden
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo, ich bin unbedarfte Nutzerin meines Laptops, das jetzt ein Jahr alt ist. Durch mein GIS-Studium wurde ich mehrfach angehalten freie Software und Tools zu nutzen und dazu eben zu installieren. WO und Wann ich mir das alles eingefangen habe, kann ich nicht sagen. Zunächst ist der Rechner beim Hochfahren und Öffnen von Programmen immer langsamer geworden, aber es ging. Dann habe ich bei Adobe Reader bemerkt, das der Rahmen des Fensters nicht richtig dargestellt wird. Nun kam hinzu, dass das Fenster für einen sicheren Zahlungsverkehr immer flackerte und nicht richtig zu sehen war. Daraufhin habe ich es nicht mehr benutzt. Kaspersky habe ich beim Neukauf des Rechners mit gekauft und regelmäßig ein Update gemacht. Sämtliche Prüfungen waren ergebnislos bis auf gestern. Da hatte ich das erste Mal eine Warnung. Die aber behoben werden konnte. Heute habe ich AVIRA kostenfrei runtergeladen und nach fast 9 h folgende LOG Datei erhalten. (im Anhang)

Nun weiß ich nicht damit umzugehen.
Ich hoffe mir kann jemand helfen, so dass ich es verstehe.
Danke schon mal im voraus.
doreagr

schrauber 16.04.2015 21:45
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307





Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


doreagr 17.04.2015 07:00
Langsames Laptop-Trojaner von AVIRA gefunden
 
Code:

Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 16. April 2015  12:22


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira Antivirus Free
Seriennummer  : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : DOREENAGRICOLA

Versionsinformationen:
BUILD.DAT      : 15.0.9.504    94784 Bytes  24.03.2015 14:59:00
AVSCAN.EXE    : 15.0.9.504  1027528 Bytes  24.03.2015 12:59:28
AVSCANRC.DLL  : 15.0.9.460    64760 Bytes  24.03.2015 12:59:28
LUKE.DLL      : 15.0.9.460    60664 Bytes  24.03.2015 12:59:30
AVSCPLR.DLL    : 15.0.9.460    95536 Bytes  24.03.2015 12:59:28
REPAIR.DLL    : 15.0.9.504    374064 Bytes  24.03.2015 12:59:28
REPAIR.RDF    : 1.0.7.16      834076 Bytes  16.04.2015 10:08:55
AVREG.DLL      : 15.0.9.460    273712 Bytes  24.03.2015 12:59:28
AVLODE.DLL    : 15.0.9.504    596272 Bytes  24.03.2015 12:59:26
AVLODE.RDF    : 14.0.4.64      79226 Bytes  16.04.2015 10:08:22
XBV00018.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00019.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00020.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00021.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00022.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00023.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00024.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00025.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00026.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00027.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00028.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00029.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00030.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00031.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00032.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00033.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00034.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00035.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00036.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00037.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00038.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00039.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00040.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00041.VDF  : 8.11.165.190    2048 Bytes  07.08.2014 12:59:31
XBV00208.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:46
XBV00209.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00210.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00211.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00212.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00213.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00214.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:47
XBV00215.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00216.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00217.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00218.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00219.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00220.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00221.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00222.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00223.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00224.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:48
XBV00225.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00226.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00227.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00228.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00229.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00230.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00231.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00232.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00233.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00234.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00235.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00236.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00237.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:49
XBV00238.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00239.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00240.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00241.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00242.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00243.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00244.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00245.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00246.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00247.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00248.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00249.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00250.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00251.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00252.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00253.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00254.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00255.VDF  : 8.11.219.166    2048 Bytes  25.03.2015 10:08:50
XBV00000.VDF  : 7.11.70.0  66736640 Bytes  04.04.2013 12:59:31
XBV00001.VDF  : 7.11.74.226  2201600 Bytes  30.04.2013 12:59:31
XBV00002.VDF  : 7.11.80.60  2751488 Bytes  28.05.2013 12:59:31
XBV00003.VDF  : 7.11.85.214  2162688 Bytes  21.06.2013 12:59:31
XBV00004.VDF  : 7.11.91.176  3903488 Bytes  23.07.2013 12:59:31
XBV00005.VDF  : 7.11.98.186  6822912 Bytes  29.08.2013 12:59:31
XBV00006.VDF  : 7.11.139.38 15708672 Bytes  27.03.2014 12:59:31
XBV00007.VDF  : 7.11.152.100  4193792 Bytes  02.06.2014 12:59:31
XBV00008.VDF  : 8.11.165.192  4251136 Bytes  07.08.2014 12:59:31
XBV00009.VDF  : 8.11.172.30  2094080 Bytes  15.09.2014 12:59:31
XBV00010.VDF  : 8.11.178.32  1581056 Bytes  14.10.2014 12:59:31
XBV00011.VDF  : 8.11.184.50  2178560 Bytes  11.11.2014 12:59:31
XBV00012.VDF  : 8.11.190.32  1876992 Bytes  03.12.2014 12:59:31
XBV00013.VDF  : 8.11.201.28  2973696 Bytes  14.01.2015 12:59:31
XBV00014.VDF  : 8.11.206.252  2695680 Bytes  04.02.2015 12:59:31
XBV00015.VDF  : 8.11.213.84  3175936 Bytes  03.03.2015 12:59:31
XBV00016.VDF  : 8.11.213.176  212480 Bytes  05.03.2015 12:59:31
XBV00017.VDF  : 8.11.219.166  2033664 Bytes  25.03.2015 10:08:23
XBV00042.VDF  : 8.11.219.194    36864 Bytes  25.03.2015 10:08:23
XBV00043.VDF  : 8.11.219.218    7168 Bytes  25.03.2015 10:08:24
XBV00044.VDF  : 8.11.219.242    6144 Bytes  25.03.2015 10:08:24
XBV00045.VDF  : 8.11.219.244    7680 Bytes  25.03.2015 10:08:25
XBV00046.VDF  : 8.11.219.246    5632 Bytes  26.03.2015 10:08:27
XBV00047.VDF  : 8.11.219.250    38400 Bytes  26.03.2015 10:08:27
XBV00048.VDF  : 8.11.219.252    14336 Bytes  26.03.2015 10:08:28
XBV00049.VDF  : 8.11.219.254    18432 Bytes  26.03.2015 10:08:28
XBV00050.VDF  : 8.11.220.0      7680 Bytes  26.03.2015 10:08:28
XBV00051.VDF  : 8.11.220.2    10240 Bytes  26.03.2015 10:08:28
XBV00052.VDF  : 8.11.220.6      2048 Bytes  26.03.2015 10:08:28
XBV00053.VDF  : 8.11.220.8      2560 Bytes  26.03.2015 10:08:29
XBV00054.VDF  : 8.11.220.10    17408 Bytes  26.03.2015 10:08:29
XBV00055.VDF  : 8.11.220.12    2048 Bytes  26.03.2015 10:08:29
XBV00056.VDF  : 8.11.220.16    23040 Bytes  26.03.2015 10:08:29
XBV00057.VDF  : 8.11.220.18    8704 Bytes  26.03.2015 10:08:30
XBV00058.VDF  : 8.11.220.22    30720 Bytes  27.03.2015 10:08:30
XBV00059.VDF  : 8.11.220.24    6144 Bytes  27.03.2015 10:08:30
XBV00060.VDF  : 8.11.220.26    2048 Bytes  27.03.2015 10:08:30
XBV00061.VDF  : 8.11.220.48    9728 Bytes  27.03.2015 10:08:30
XBV00062.VDF  : 8.11.220.68    14848 Bytes  27.03.2015 10:08:30
XBV00063.VDF  : 8.11.220.88    23552 Bytes  27.03.2015 10:08:30
XBV00064.VDF  : 8.11.220.108    9216 Bytes  27.03.2015 10:08:30
XBV00065.VDF  : 8.11.220.110    15360 Bytes  27.03.2015 10:08:30
XBV00066.VDF  : 8.11.220.116    27648 Bytes  27.03.2015 10:08:30
XBV00067.VDF  : 8.11.220.118    10752 Bytes  27.03.2015 10:08:30
XBV00068.VDF  : 8.11.220.120    6144 Bytes  27.03.2015 10:08:30
XBV00069.VDF  : 8.11.220.122    62976 Bytes  28.03.2015 10:08:31
XBV00070.VDF  : 8.11.220.124    2048 Bytes  28.03.2015 10:08:31
XBV00071.VDF  : 8.11.220.126    9728 Bytes  28.03.2015 10:08:31
XBV00072.VDF  : 8.11.220.128    20992 Bytes  28.03.2015 10:08:31
XBV00073.VDF  : 8.11.220.148    54784 Bytes  29.03.2015 10:08:31
XBV00074.VDF  : 8.11.220.176    7680 Bytes  29.03.2015 10:08:31
XBV00075.VDF  : 8.11.220.196    32768 Bytes  30.03.2015 10:08:31
XBV00076.VDF  : 8.11.220.216    2048 Bytes  30.03.2015 10:08:31
XBV00077.VDF  : 8.11.220.236    9728 Bytes  30.03.2015 10:08:32
XBV00078.VDF  : 8.11.220.238    15360 Bytes  30.03.2015 10:08:32
XBV00079.VDF  : 8.11.220.240    9216 Bytes  30.03.2015 10:08:32
XBV00080.VDF  : 8.11.220.242    4608 Bytes  30.03.2015 10:08:32
XBV00081.VDF  : 8.11.220.248    58368 Bytes  30.03.2015 10:08:32
XBV00082.VDF  : 8.11.220.250    2048 Bytes  30.03.2015 10:08:32
XBV00083.VDF  : 8.11.220.252    2048 Bytes  30.03.2015 10:08:32
XBV00084.VDF  : 8.11.220.254    39424 Bytes  31.03.2015 10:08:32
XBV00085.VDF  : 8.11.221.0      2048 Bytes  31.03.2015 10:08:32
XBV00086.VDF  : 8.11.221.6    40960 Bytes  31.03.2015 10:08:33
XBV00087.VDF  : 8.11.221.8      2048 Bytes  31.03.2015 10:08:33
XBV00088.VDF  : 8.11.221.10    16896 Bytes  31.03.2015 10:08:33
XBV00089.VDF  : 8.11.221.30    10240 Bytes  31.03.2015 10:08:33
XBV00090.VDF  : 8.11.221.48    29184 Bytes  31.03.2015 10:08:33
XBV00091.VDF  : 8.11.221.50    2048 Bytes  31.03.2015 10:08:33
XBV00092.VDF  : 8.11.221.70    27648 Bytes  31.03.2015 10:08:34
XBV00093.VDF  : 8.11.221.88    3584 Bytes  31.03.2015 10:08:35
XBV00094.VDF  : 8.11.221.90    32256 Bytes  31.03.2015 10:08:35
XBV00095.VDF  : 8.11.221.94    34816 Bytes  01.04.2015 10:08:36
XBV00096.VDF  : 8.11.221.96    8704 Bytes  01.04.2015 10:08:36
XBV00097.VDF  : 8.11.221.100    8704 Bytes  01.04.2015 10:08:36
XBV00098.VDF  : 8.11.221.102    7680 Bytes  01.04.2015 10:08:36
XBV00099.VDF  : 8.11.221.106    39936 Bytes  01.04.2015 10:08:36
XBV00100.VDF  : 8.11.221.124    8704 Bytes  01.04.2015 10:08:37
XBV00101.VDF  : 8.11.221.142    12288 Bytes  01.04.2015 10:08:37
XBV00102.VDF  : 8.11.221.160    7168 Bytes  01.04.2015 10:08:37
XBV00103.VDF  : 8.11.221.178    7168 Bytes  01.04.2015 10:08:37
XBV00104.VDF  : 8.11.221.196    8192 Bytes  01.04.2015 10:08:37
XBV00105.VDF  : 8.11.221.200    33280 Bytes  02.04.2015 10:08:38
XBV00106.VDF  : 8.11.221.202    2048 Bytes  02.04.2015 10:08:38
XBV00107.VDF  : 8.11.221.204    28160 Bytes  02.04.2015 10:08:38
XBV00108.VDF  : 8.11.221.206    2048 Bytes  02.04.2015 10:08:38
XBV00109.VDF  : 8.11.221.208    33792 Bytes  02.04.2015 10:08:39
XBV00110.VDF  : 8.11.221.210    24576 Bytes  02.04.2015 10:08:39
XBV00111.VDF  : 8.11.221.214    18944 Bytes  02.04.2015 10:08:39
XBV00112.VDF  : 8.11.221.216    11264 Bytes  02.04.2015 10:08:40
XBV00113.VDF  : 8.11.221.220    29696 Bytes  03.04.2015 10:08:40
XBV00114.VDF  : 8.11.221.222    2048 Bytes  03.04.2015 10:08:40
XBV00115.VDF  : 8.11.221.224    31232 Bytes  03.04.2015 10:08:40
XBV00116.VDF  : 8.11.221.242    3584 Bytes  03.04.2015 10:08:40
XBV00117.VDF  : 8.11.222.2    11776 Bytes  03.04.2015 10:08:40
XBV00118.VDF  : 8.11.222.18    7168 Bytes  03.04.2015 10:08:40
XBV00119.VDF  : 8.11.222.34    6656 Bytes  03.04.2015 10:08:40
XBV00120.VDF  : 8.11.222.38    15360 Bytes  03.04.2015 10:08:40
XBV00121.VDF  : 8.11.222.40    5632 Bytes  03.04.2015 10:08:40
XBV00122.VDF  : 8.11.222.42    6144 Bytes  03.04.2015 10:08:40
XBV00123.VDF  : 8.11.222.44    46592 Bytes  04.04.2015 10:08:40
XBV00124.VDF  : 8.11.222.46    2048 Bytes  04.04.2015 10:08:40
XBV00125.VDF  : 8.11.222.48    2048 Bytes  04.04.2015 10:08:40
XBV00126.VDF  : 8.11.222.50    36864 Bytes  04.04.2015 10:08:40
XBV00127.VDF  : 8.11.222.52    2048 Bytes  04.04.2015 10:08:40
XBV00128.VDF  : 8.11.222.68    68096 Bytes  05.04.2015 10:08:41
XBV00129.VDF  : 8.11.222.84    2048 Bytes  05.04.2015 10:08:41
XBV00130.VDF  : 8.11.222.116    18432 Bytes  05.04.2015 10:08:41
XBV00131.VDF  : 8.11.222.132    62464 Bytes  06.04.2015 10:08:41
XBV00132.VDF  : 8.11.222.134    10752 Bytes  06.04.2015 10:08:41
XBV00133.VDF  : 8.11.222.138    2048 Bytes  06.04.2015 10:08:41
XBV00134.VDF  : 8.11.222.154    13312 Bytes  06.04.2015 10:08:41
XBV00135.VDF  : 8.11.222.156    8704 Bytes  06.04.2015 10:08:42
XBV00136.VDF  : 8.11.222.158    9216 Bytes  06.04.2015 10:08:42
XBV00137.VDF  : 8.11.222.160    2048 Bytes  06.04.2015 10:08:42
XBV00138.VDF  : 8.11.222.164    18432 Bytes  06.04.2015 10:08:42
XBV00139.VDF  : 8.11.222.166    10752 Bytes  06.04.2015 10:08:42
XBV00140.VDF  : 8.11.222.182    7168 Bytes  06.04.2015 10:08:42
XBV00141.VDF  : 8.11.222.196    8704 Bytes  07.04.2015 10:08:43
XBV00142.VDF  : 8.11.222.212    29696 Bytes  07.04.2015 10:08:43
XBV00143.VDF  : 8.11.222.226    6656 Bytes  07.04.2015 10:08:43
XBV00144.VDF  : 8.11.222.228    10752 Bytes  07.04.2015 10:08:43
XBV00145.VDF  : 8.11.222.230    4096 Bytes  07.04.2015 10:08:43
XBV00146.VDF  : 8.11.222.232    5120 Bytes  07.04.2015 10:08:43
XBV00147.VDF  : 8.11.222.234    5632 Bytes  07.04.2015 10:08:43
XBV00148.VDF  : 8.11.222.240    34816 Bytes  07.04.2015 10:08:43
XBV00149.VDF  : 8.11.222.242    2048 Bytes  07.04.2015 10:08:43
XBV00150.VDF  : 8.11.222.244    3584 Bytes  07.04.2015 10:08:43
XBV00151.VDF  : 8.11.222.246    24576 Bytes  07.04.2015 10:08:43
XBV00152.VDF  : 8.11.222.250    37888 Bytes  08.04.2015 10:08:43
XBV00153.VDF  : 8.11.223.8    12800 Bytes  08.04.2015 10:08:43
XBV00154.VDF  : 8.11.223.22    2048 Bytes  08.04.2015 10:08:43
XBV00155.VDF  : 8.11.223.36    10752 Bytes  08.04.2015 10:08:43
XBV00156.VDF  : 8.11.223.52    35328 Bytes  08.04.2015 10:08:44
XBV00157.VDF  : 8.11.223.66    7168 Bytes  08.04.2015 10:08:44
XBV00158.VDF  : 8.11.223.68    2048 Bytes  08.04.2015 10:08:44
XBV00159.VDF  : 8.11.223.72    15360 Bytes  08.04.2015 10:08:44
XBV00160.VDF  : 8.11.223.74    7168 Bytes  09.04.2015 10:08:44
XBV00161.VDF  : 8.11.223.78    38400 Bytes  09.04.2015 10:08:44
XBV00162.VDF  : 8.11.223.80    2048 Bytes  09.04.2015 10:08:44
XBV00163.VDF  : 8.11.223.82    35328 Bytes  09.04.2015 10:08:44
XBV00164.VDF  : 8.11.223.90    80896 Bytes  09.04.2015 10:08:44
XBV00165.VDF  : 8.11.223.92    2048 Bytes  09.04.2015 10:08:44
XBV00166.VDF  : 8.11.223.94    30208 Bytes  09.04.2015 10:08:44
XBV00167.VDF  : 8.11.223.108    30208 Bytes  10.04.2015 10:08:44
XBV00168.VDF  : 8.11.223.120    35840 Bytes  10.04.2015 10:08:44
XBV00169.VDF  : 8.11.223.124    3072 Bytes  10.04.2015 10:08:44
XBV00170.VDF  : 8.11.223.136    20480 Bytes  10.04.2015 10:08:44
XBV00171.VDF  : 8.11.223.148    14848 Bytes  10.04.2015 10:08:44
XBV00172.VDF  : 8.11.223.150    2048 Bytes  10.04.2015 10:08:44
XBV00173.VDF  : 8.11.223.154    23552 Bytes  10.04.2015 10:08:44
XBV00174.VDF  : 8.11.223.156    8192 Bytes  10.04.2015 10:08:44
XBV00175.VDF  : 8.11.223.158    7680 Bytes  11.04.2015 10:08:44
XBV00176.VDF  : 8.11.223.162    49152 Bytes  11.04.2015 10:08:45
XBV00177.VDF  : 8.11.223.164    2048 Bytes  11.04.2015 10:08:45
XBV00178.VDF  : 8.11.223.176    18944 Bytes  11.04.2015 10:08:45
XBV00179.VDF  : 8.11.223.192    68096 Bytes  12.04.2015 10:08:45
XBV00180.VDF  : 8.11.223.194    2048 Bytes  12.04.2015 10:08:45
XBV00181.VDF  : 8.11.223.196    2048 Bytes  12.04.2015 10:08:45
XBV00182.VDF  : 8.11.223.208    13312 Bytes  12.04.2015 10:08:45
XBV00183.VDF  : 8.11.223.210    6144 Bytes  12.04.2015 10:08:45
XBV00184.VDF  : 8.11.223.222    75776 Bytes  13.04.2015 10:08:45
XBV00185.VDF  : 8.11.223.224    2048 Bytes  13.04.2015 10:08:45
XBV00186.VDF  : 8.11.223.236    27648 Bytes  13.04.2015 10:08:45
XBV00187.VDF  : 8.11.223.246    2048 Bytes  13.04.2015 10:08:45
XBV00188.VDF  : 8.11.224.2      9728 Bytes  13.04.2015 10:08:45
XBV00189.VDF  : 8.11.224.12    33792 Bytes  13.04.2015 10:08:45
XBV00190.VDF  : 8.11.224.22    40448 Bytes  14.04.2015 10:08:45
XBV00191.VDF  : 8.11.224.28    26112 Bytes  14.04.2015 10:08:45
XBV00192.VDF  : 8.11.224.32    49152 Bytes  14.04.2015 10:08:45
XBV00193.VDF  : 8.11.224.34    12288 Bytes  14.04.2015 10:08:46
XBV00194.VDF  : 8.11.224.36    8704 Bytes  14.04.2015 10:08:46
XBV00195.VDF  : 8.11.224.46    6656 Bytes  14.04.2015 10:08:46
XBV00196.VDF  : 8.11.224.48    2048 Bytes  14.04.2015 10:08:46
XBV00197.VDF  : 8.11.224.58    12288 Bytes  15.04.2015 10:08:46
XBV00198.VDF  : 8.11.224.68    5632 Bytes  15.04.2015 10:08:46
XBV00199.VDF  : 8.11.224.72    29184 Bytes  15.04.2015 10:08:46
XBV00200.VDF  : 8.11.224.82    17920 Bytes  15.04.2015 10:08:46
XBV00201.VDF  : 8.11.224.84    29184 Bytes  15.04.2015 10:08:46
XBV00202.VDF  : 8.11.224.90    29184 Bytes  15.04.2015 10:08:46
XBV00203.VDF  : 8.11.224.92    18432 Bytes  15.04.2015 10:08:46
XBV00204.VDF  : 8.11.224.102    13824 Bytes  15.04.2015 10:08:46
XBV00205.VDF  : 8.11.224.112    18944 Bytes  15.04.2015 10:08:46
XBV00206.VDF  : 8.11.224.120    6144 Bytes  15.04.2015 10:08:46
XBV00207.VDF  : 8.11.224.130    38400 Bytes  16.04.2015 10:08:46
LOCAL000.VDF  : 8.11.224.130 127554048 Bytes  16.04.2015 10:09:36
Engineversion  : 8.3.30.16
AEVDF.DLL      : 8.3.1.6      133992 Bytes  24.03.2015 12:59:23
AESCRIPT.DLL  : 8.2.2.58      560248 Bytes  24.03.2015 12:59:23
AESCN.DLL      : 8.3.2.2      139456 Bytes  24.03.2015 12:59:23
AESBX.DLL      : 8.2.20.34    1615784 Bytes  24.03.2015 12:59:23
AERDL.DLL      : 8.2.1.20      731040 Bytes  24.03.2015 12:59:23
AEPACK.DLL    : 8.4.0.62      793456 Bytes  24.03.2015 12:59:23
AEOFFICE.DLL  : 8.3.1.16      359280 Bytes  16.04.2015 10:08:21
AEMOBILE.DLL  : 8.1.7.0      281456 Bytes  24.03.2015 12:59:23
AEHEUR.DLL    : 8.1.4.1634  8259496 Bytes  16.04.2015 10:08:20
AEHELP.DLL    : 8.3.2.0      281456 Bytes  24.03.2015 12:59:23
AEGEN.DLL      : 8.1.7.40      456608 Bytes  24.03.2015 12:59:23
AEEXP.DLL      : 8.4.2.82      260968 Bytes  16.04.2015 10:08:21
AEEMU.DLL      : 8.1.3.4      399264 Bytes  24.03.2015 12:59:23
AEDROID.DLL    : 8.4.3.116    1050536 Bytes  24.03.2015 12:59:23
AECORE.DLL    : 8.3.4.0      243624 Bytes  24.03.2015 12:59:23
AEBB.DLL      : 8.1.2.0        60448 Bytes  24.03.2015 12:59:23
AVWINLL.DLL    : 15.0.9.460    26872 Bytes  24.03.2015 12:59:29
AVPREF.DLL    : 15.0.9.460    52984 Bytes  24.03.2015 12:59:28
AVREP.DLL      : 15.0.9.460    220464 Bytes  24.03.2015 12:59:28
AVARKT.DLL    : 15.0.9.460    228088 Bytes  24.03.2015 12:59:24
AVEVTLOG.DLL  : 15.0.9.460    193328 Bytes  24.03.2015 12:59:25
SQLITE3.DLL    : 15.0.9.460    455472 Bytes  24.03.2015 12:59:31
AVSMTP.DLL    : 15.0.9.460    79096 Bytes  24.03.2015 12:59:28
NETNT.DLL      : 15.0.9.460    15152 Bytes  24.03.2015 12:59:30
CommonImageRc.dll: 15.0.9.460  4355376 Bytes  24.03.2015 12:59:30
CommonTextRc.DLL: 15.0.9.476    70960 Bytes  24.03.2015 12:59:30

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\Antivirus\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, E:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 16. April 2015  12:22

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:, E:)'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.
Eine Instanz der ARK Library läuft bereits.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'DpHostW.exe' - '147' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '110' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'STacSV64.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'DPCardEngine.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Hpservice.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'vcsFPService.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'BlueSoleilCS.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'SkypeC2CAutoUpdateSvc.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'SkypeC2CPNRSvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'OfficeClickToRun.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '178' Modul(e) wurden durchsucht
Durchsuche Prozess 'CreoSvc.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'CtService.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'lyricsgizm.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '112' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSMonitorServicePDVD12.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMSServerPDVD12.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'wrapper.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'java.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPFSService.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'HPHotkeyMonitor.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'hydrup.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'HeciServer.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'pdfsvc.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '21' Modul(e) wurden durchsucht
Durchsuche Prozess 'ss_conn_service.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'TeamViewer_Service.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'WINWORD.EXE' - '140' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '128' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmi64.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '145' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpqwmiex.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'BsHelpCS.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '9' Modul(e) wurden durchsucht
Durchsuche Prozess 'TrustedInstaller.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'OSPPSVC.EXE' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '44' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'lyricsgizm.exe' - '87' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '130' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '117' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '4250' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <Windows>
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$R9WT274.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/InstallCore.OR.1
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RCYOOJ3.exe
    [0] Archivtyp: ZIP SFX (self extracting)
    --> Setup.exe
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6831
        [WARNUNG]  Infizierte Dateien in Archiven können nicht repariert werden
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RM9JJCH.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RRBJONL.exe
  [FUND]      Enthält Muster der Software PUA/InstallCore.Gen7
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RS1NL5C.exe
  [FUND]      Enthält Muster der Software PUA/SeaSuite.Gen
C:\ProgramData\lyricsgizm\wlyricsgizmd.exe
  [FUND]      Ist das Trojanische Pferd TR/Strictor.59716.8
C:\Users\DoreenAgricola\Downloads\iLividSetup-r887-n-bf.exe
  [FUND]      Enthält Muster der Software PUA/iLivid.iona
    [0] Archivtyp: Runtime Packed
    --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_451_W81_DRV\amd64\WinUSBCoInstaller2.dll
        [1] Archivtyp: RSRC
      --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_451_W81_DRV\x86\WinUSBCoInstaller2.dll
          [2] Archivtyp: RSRC
        --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_471_W81_DRV\amd64\WinUSBCoInstaller2.dll
            [3] Archivtyp: RSRC
          --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_471_W81_DRV\x86\WinUSBCoInstaller2.dll
              [4] Archivtyp: RSRC
            --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_491_W81_DRV\amd64\WinUSBCoInstaller2.dll
                [5] Archivtyp: RSRC
              --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_491_W81_DRV\x86\WinUSBCoInstaller2.dll
                  [6] Archivtyp: RSRC
                --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_495_W81_DRV\amd64\WinUSBCoInstaller2.dll
                    [7] Archivtyp: RSRC
                  --> C:\Program Files\Validity Sensors\Shared\Drivers\VFS_495_W81_DRV\x86\WinUSBCoInstaller2.dll
                      [8] Archivtyp: RSRC
                    --> C:\Users\DoreenAgricola\Downloads\jxpiinstall.exe
                        [9] Archivtyp: Runtime Packed
                      --> C:\Users\DoreenAgricola\Downloads\PDF24 Creator - CHIP-Installer.exe
                          [10] Archivtyp: RSRC
                        --> C:\Users\DoreenAgricola\Downloads\PDF24 Creator - CHIP-Installer.exe
                            [11] Archivtyp: Runtime Packed
                          --> C:\Users\DoreenAgricola\Downloads\Samsung Kies - CHIP-Installer.exe
                              [12] Archivtyp: RSRC
                            --> C:\Users\DoreenAgricola\Downloads\Samsung Kies - CHIP-Installer.exe
                                [13] Archivtyp: Runtime Packed
                              --> C:\Windows\System32\WinUSBCoInstaller2.dll
                                  [14] Archivtyp: RSRC
                                --> C:\Windows\System32\DriverStore\FileRepository\vfs451.inf_amd64_neutral_f09adf1ebd0a9344\amd64\WinUSBCoInstaller2.dll
                                    [15] Archivtyp: RSRC
                                  --> C:\Windows\System32\DriverStore\FileRepository\vfs471.inf_amd64_neutral_3c2b813b62272cc9\amd64\WinUSBCoInstaller2.dll
                                      [16] Archivtyp: RSRC
                                    --> C:\Windows\System32\DriverStore\FileRepository\vfs491.inf_amd64_neutral_88f7e00ca6db9fb9\amd64\WinUSBCoInstaller2.dll
                                        [17] Archivtyp: RSRC
                                      --> C:\Windows\System32\DriverStore\FileRepository\vfs495.inf_amd64_neutral_d0cde3cda2a4493b\amd64\WinUSBCoInstaller2.dll
                                          [18] Archivtyp: RSRC
                                        --> C:\Windows\Temp\bch7497.exe
                                            [19] Archivtyp: Portable Executable Resource
                                          --> id_201
                                              [20] Archivtyp: ZIP
                                            --> wlyricsgizmd.exe
                                                [FUND]      Ist das Trojanische Pferd TR/Strictor.59716.8
                                                [WARNUNG]  Infizierte Dateien in Archiven können nicht repariert werden
C:\Windows\Temp\bch7497.exe
  [FUND]      Ist das Trojanische Pferd TR/Strictor.59716.8
C:\Windows\Temp\6b4a5932\SettingsManagerSetup.exe
  [FUND]      Enthält Muster der Software PUA/SeaSuite.Gen
Beginne mit der Suche in 'D:\' <HP_RECOVERY>
Beginne mit der Suche in 'E:\' <HP_TOOLS>

Beginne mit der Desinfektion:
[ERROR] RepairMalware: Not able to Repair Malware PUA/SeaSuite.Gen
[ERROR] RepairMalware: Not able to Repair Malware PUA/SeaSuite.Gen
C:\Windows\Temp\6b4a5932\SettingsManagerSetup.exe
  [FUND]      Enthält Muster der Software PUA/SeaSuite.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '504db9bb.qua' verschoben!
C:\Windows\Temp\bch7497.exe
  [FUND]      Ist das Trojanische Pferd TR/Strictor.59716.8
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '48e6961b.qua' verschoben!
C:\Users\DoreenAgricola\Downloads\iLividSetup-r887-n-bf.exe
  [FUND]      Enthält Muster der Software PUA/iLivid.iona
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ab8c301.qua' verschoben!
C:\ProgramData\lyricsgizm\wlyricsgizmd.exe
  [FUND]      Ist das Trojanische Pferd TR/Strictor.59716.8
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7cbf8ce3.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RS1NL5C.exe
  [FUND]      Enthält Muster der Software PUA/SeaSuite.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3911a1e4.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RRBJONL.exe
  [FUND]      Enthält Muster der Software PUA/InstallCore.Gen7
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '460b9388.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RM9JJCH.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0a4cbff5.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$RCYOOJ3.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/AgentCV.A.6831
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '765affb8.qua' verschoben!
C:\$RECYCLE.BIN\S-1-5-21-423146766-3122434050-3300097568-1001\$R9WT274.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/InstallCore.OR.1
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5b1ad081.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 16. April 2015  22:13
Benötigte Zeit:  9:47:06 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  40869 Verzeichnisse wurden überprüft
 3092124 Dateien wurden geprüft
    10 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      9 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 3092114 Dateien ohne Befall
  20317 Archive wurden durchsucht
      2 Warnungen
      9 Hinweise
Hier der CODE so dargestellt, wie gewünscht.
Sorry.
Doreagr

schrauber 17.04.2015 19:40
FRST fehlt noch :)

doreagr 19.04.2015 11:21
Sorry, das ich das mit dem frst nicht gesehen habe. Hier die gewünschten zwei Dateien nach dem Scan.
Gruß DoreAg

Hier der FRST.txt:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2015
Ran by
Doreen Agricola (administrator) on DOREENAGRICOLA on 19-04-2015 12:08:24
Running from C:\Users\DoreenAgricola\Downloads
Loaded Profiles: Doreen Agricola (Available profiles: Doreen Agricola & Test & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpCardEngine.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(CryptoMill Technologies Ltd.) C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
(Print Test Agent) C:\ProgramData\lyricsgizm\lyricsgizm.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Tanuki Software, Ltd.) C:\Program Files (x86)\GeoServer 2.6.2\wrapper.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Software) C:\Program Files (x86)\Common Files\Hydrup\hydrup.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre1.8.0_31\bin\java.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Print Test Agent) C:\ProgramData\lyricsgizm\lyricsgizm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [726320 2015-03-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\RunOnce: [Uninstall C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\RunOnce: [Uninstall C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MountPoints2: H - H:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MountPoints2: {91f97b4b-9db3-11e3-b44a-806e6f6e6963} - F:\wubi.exe
Lsa: [Notification Packages] DPPassFilter scecli
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll No File
ShellIconOverlayIdentifiers: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll No File
ShellIconOverlayIdentifiers-x32: [+1TBIcon] -> {B9C55E85-DED6-4911-82F3-83CF1CAB2898} => C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll (CryptoMill Technologies Ltd.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = https://safesearch.avira.com/
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = https://safesearch.avira.com/
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.sweet-page.com/?type=hp&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT
HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
URLSearchHook: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKLM -> {A33DB9FD-7A8A-496E-92D3-9CFCF9D9E1C9} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> {BFFED5CA-8BDF-47CC-AED0-23F4E6D77732} URL = hxxp://start.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> DefaultScope {F7C78C08-3CC7-416F-B827-7C1785ABBDA8} URL = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {1B0AEC5F-9979-4A64-8A2F-8014547A8D26} URL = https://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = hxxp://www.default-search.net/search?sid=476&aid=122&itype=a&ver=12521&tm=345&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {A33DB9FD-7A8A-496E-92D3-9CFCF9D9E1C9} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1403775872&from=cor&uid=TOSHIBAXMQ01ABF050_14U7CHPRTXX14U7CHPRT&q={searchTerms}
SearchScopes: HKU\S-1-5-21-423146766-3122434050-3300097568-1001 -> {F7C78C08-3CC7-416F-B827-7C1785ABBDA8} URL = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97&ref=toolbox&q={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_40\bin\ssv.dll [2015-04-10] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-04-10] (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-05-21] (Hewlett-Packard Co.)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.)
BHO-x32: HP File Sanitizer -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2013-08-07] (Hewlett-Packard)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-09] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-29] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-02-10] (Microsoft Corporation)
BHO-x32: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-29] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)
BHO-x32: No Name -> {FCADDC14-BD46-408A-9842-CDBE1C6D37EB} -> C:\Users\Doreen Agricola\AppData\LocalLow\systems ie bho\bho.dll No File
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-05-21] (Hewlett-Packard Co.)
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2012-03-28] (Citrix Systems, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default
FF DefaultSearchEngine: SearchTheWeb
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-16] ()
FF Plugin: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-04-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-04-10] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-07-26] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-07-26] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-29] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-05-07] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-15] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.2.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2015-02-27] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: digitalpersona.com/ChromeDPAgent -> C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\ChromeExt\components\npChromeDPAgent.dll [2013-08-06] (DigitalPersona, Inc.)
FF user.js: detected! => C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\user.js [2015-04-16]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CCMSDK.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\cgpcfg.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\CgpCore.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\confmgr.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxlogging.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\ctxmui.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icafile.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\icalogon.dll [2012-03-28] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npicaN.dll [2012-03-28] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\sslsdk_b.dll [2012-03-19] (Citrix Systems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\TcpPServ.dll [2012-03-28] (Citrix Systems, Inc.)
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\default-search.xml [2014-05-12]
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\google-images.xml [2015-02-17]
FF SearchPlugin: C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\searchplugins\google-maps.xml [2015-02-17]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\default-search.xml [2014-05-12]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\SearchTheWeb.xml [2014-05-06]
FF Extension: Segurança do navegador Avira - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\abs@avira.com [2015-04-16]
FF Extension: Linkey for Firefox - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\extension@linkeyproject.com [2014-05-12]
FF Extension: Foxy Security - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\sys@foxysecurity.com [2014-05-12]
FF Extension: Garmin Communicator - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2015-02-19]
FF Extension: SQLite Manager - C:\Users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\Extensions\SQLiteManager@mrinalkant.blogspot.com.xpi [2014-07-29]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14]
FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt
FF Extension: DigitalPersona Extension - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2014-02-25]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-05-20]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-09-02]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-09-02]
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Doreen Agricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\extensions\cliqz@cliqz.com

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [igdhbblpcellaljokkpfhcjlagemhgjl] - No Path Or update_url value
CHR HKLM-x32\...\Chrome\Extension: [ncffjdbbodifgldkcbhmiiljfcnbgjab] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\ChromeExt\dpchrome.crx [2013-08-06]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [815920 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [434424 2015-03-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1004280 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 BlueSoleilCS; c:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1706744 2013-11-02] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-11-02] (IVT Corporation)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 CreoService; C:\Program Files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [1366488 2013-08-23] (CryptoMill Technologies Ltd.)
R2 CtAgentService; C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [7168 2013-08-08] () [File not signed]
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-07-15] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [294664 2013-07-15] (CyberLink)
R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [500048 2013-08-06] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [558392 2013-08-07] (Hewlett-Packard Company)
R2 GeoServer 2.6.2; C:\Program Files (x86)\GeoServer 2.6.2\wrapper.exe [241664 2013-09-18] (Tanuki Software, Ltd.) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [681760 2013-08-01] (Hewlett-Packard Company)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]
R2 Hydrup; C:\Program Files (x86)\Common Files\Hydrup\hydrup.exe [266536 2015-03-30] (Software)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-07-30] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; c:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-07-26] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-07-26] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1143432 2013-07-18] (PDF Complete Inc)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [337920 2013-07-04] (IDT, Inc.) [File not signed]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5436176 2015-02-17] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [35936 2013-04-10] (Advanced Micro Devices, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-24] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-03-24] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-24] (Avira Operations GmbH & Co. KG)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [32992 2013-10-09] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [69344 2013-08-23] (IVT Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [54752 2013-08-23] (IVT Corporation)
R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [90608 2011-12-27] (CyberLink)
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [65752 2013-06-13] (Hewlett-Packard Company)
R0 iaStorF; C:\Windows\System32\drivers\iaStorF.sys [28008 2013-07-30] (Intel Corporation)
R3 IceKore; C:\Windows\System32\DRIVERS\IceKore.sys [397784 2013-08-19] (CryptoMill Technologies Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-09] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-09] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 m76usb; C:\Windows\System32\DRIVERS\m76usb.sys [537800 2013-11-05] (Ralink Technology Corp.)
R3 MEIx64; C:\Windows\system32\drivers\TeeDriverx64.sys [99288 2013-07-26] (Intel Corporation)
R0 PinFile; C:\Windows\System32\DRIVERS\PinFile.sys [49856 2013-07-16] (WinMagic Inc.)
S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [418520 2013-06-17] (Realsil Semiconductor Corporation)
R0 SDDisk2K; C:\Windows\System32\DRIVERS\SDDisk2K.sys [228544 2013-07-16] (WinMagic Inc.)
R0 SDDToki; C:\Windows\System32\DRIVERS\SDDToki.sys [131264 2013-07-16] (WinMagic Inc.)
S3 SmbDrv; C:\Windows\system32\drivers\Smb_driver_AMDASF.sys [30448 2013-08-20] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\system32\drivers\Smb_driver_Intel.sys [34544 2013-08-20] (Synaptics Incorporated)
R3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [1512952 2013-08-08] (Sunplus)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [32992 2013-10-09] (IVT Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 12:08 - 2015-04-19 12:10 - 00040656 _____ () C:\Users\DoreenAgricola\Downloads\FRST.txt
2015-04-19 12:08 - 2015-04-19 12:08 - 00000000 ____D () C:\FRST
2015-04-19 12:07 - 2015-04-19 12:07 - 02098176 _____ (Farbar) C:\Users\DoreenAgricola\Downloads\FRST64.exe
2015-04-19 11:58 - 2015-04-19 11:59 - 00001078 _____ () C:\Windows\system32dbgraw.bmp
2015-04-16 12:09 - 2015-04-16 12:09 - 00003432 _____ () C:\Windows\System32\Tasks\Avira Browser Safety Updater Task
2015-04-16 12:07 - 2015-04-16 12:07 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Avira
2015-04-16 12:05 - 2015-03-24 14:59 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-04-16 12:05 - 2015-03-24 14:59 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-04-16 12:02 - 2015-04-16 12:02 - 00001232 _____ () C:\Users\Public\Desktop\Avira.lnk
2015-04-16 12:01 - 2015-04-16 12:09 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-04-16 12:01 - 2015-04-16 12:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-16 12:01 - 2015-04-16 12:05 - 00000000 ____D () C:\ProgramData\Avira
2015-04-16 12:01 - 2015-04-16 12:01 - 04625104 _____ (Avira Operations GmbH & Co. KG) C:\Users\DoreenAgricola\Downloads\avira_de_av_5904711050__ws.exe
2015-04-16 08:20 - 2015-04-16 08:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-04-16 07:45 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-16 07:45 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-16 07:45 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-16 07:45 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-16 07:45 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-16 07:45 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-16 07:45 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-16 07:45 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-16 07:45 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-16 07:45 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-16 07:45 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-16 07:45 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-16 07:45 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-16 07:45 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-16 07:45 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-16 07:45 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-16 07:45 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-16 07:45 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-16 07:45 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-16 07:45 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-16 07:45 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-16 07:45 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-16 07:45 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-16 07:45 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-16 07:45 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-16 07:45 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-16 07:45 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-16 07:45 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-16 07:45 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-16 07:45 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-16 07:45 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-16 07:45 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-16 07:45 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-16 07:45 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-16 07:45 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-16 07:45 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-16 07:45 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-16 07:44 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-16 07:44 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-16 07:44 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-16 07:44 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-16 07:44 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-16 07:44 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-16 07:44 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-16 07:44 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-16 07:44 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-16 07:44 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-16 07:44 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-16 07:44 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-16 07:44 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-16 07:44 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-16 07:44 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-16 07:44 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-16 07:44 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-16 07:44 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-16 07:44 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-16 07:44 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-16 07:44 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-16 07:44 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-16 07:44 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-16 07:44 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-16 07:44 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-16 07:44 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-16 07:44 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-16 07:44 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-16 07:44 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-16 07:44 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-16 07:44 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-16 07:44 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-16 07:44 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-16 07:44 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-16 07:44 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-16 07:44 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-16 07:44 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-16 07:44 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-16 07:44 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-16 07:44 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-16 07:44 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-16 07:44 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-16 07:44 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-16 07:44 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-16 07:44 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-16 07:44 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-16 07:44 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-16 07:44 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-16 07:44 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-16 07:44 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-16 07:44 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-16 07:44 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-16 07:44 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-16 07:44 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-16 07:44 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-16 07:44 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-16 07:44 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-16 07:44 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-16 07:44 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-16 07:44 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-16 07:44 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-16 07:44 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-15 09:28 - 2015-04-15 09:28 - 00001493 _____ () C:\Users\DoreenAgricola\AppData\Local\recently-used.xbel
2015-04-10 10:17 - 2015-04-10 10:17 - 00000000 ____D () C:\Windows\pss
2015-04-10 09:58 - 2015-04-10 09:58 - 00003150 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-10 09:49 - 2015-04-10 09:49 - 18240176 _____ (Adobe Systems Incorporated) C:\Users\DoreenAgricola\Downloads\install_flash_player.exe
2015-04-10 09:48 - 2015-04-10 09:48 - 00000000 ____D () C:\ProgramData\Sun
2015-04-10 09:47 - 2015-04-10 09:47 - 42925480 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-8u40-windows-x64.exe
2015-04-10 09:45 - 2015-04-10 09:45 - 29469096 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-7u75-windows-i586.exe
2015-04-10 09:44 - 2015-04-10 09:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-04-10 09:44 - 2015-04-10 09:47 - 00000000 ____D () C:\Program Files\Java
2015-04-10 09:44 - 2015-04-10 09:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2015-04-10 09:44 - 2015-04-10 09:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2015-04-10 09:43 - 2015-04-10 09:43 - 31036840 _____ (Oracle Corporation) C:\Users\DoreenAgricola\Downloads\jre-7u75-windows-x64.exe
2015-04-10 09:41 - 2015-04-10 09:41 - 17658544 _____ (Adobe Systems Incorporated) C:\Users\DoreenAgricola\Downloads\install_flash_player_ax.exe
2015-04-10 09:39 - 2015-04-10 09:40 - 28509232 _____ () C:\Users\DoreenAgricola\Downloads\vlc-2.2.0-win32.exe
2015-04-07 20:01 - 2015-04-07 20:01 - 00000000 ____D () C:\Users\DoreenAgricola\Desktop\Ablage
2015-04-03 22:13 - 2015-04-03 22:13 - 00000000 ____D () C:\Users\DoreenAgricola\rezepte_Kigeb
2015-04-02 13:51 - 2015-04-02 14:05 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\ICAClient
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\Citrix
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\ProgramData\Citrix
2015-04-02 13:51 - 2015-04-02 13:51 - 00000000 ____D () C:\Program Files (x86)\Citrix
2015-03-26 12:32 - 2015-03-26 12:32 - 00664713 _____ () C:\Users\DoreenAgricola\Downloads\styler-1.7.3.zip
2015-03-25 13:16 - 2015-03-25 13:16 - 00000000 ____D () C:\Windows\SysWOW64\%Report%
2015-03-25 12:19 - 2015-03-25 12:19 - 01726876 _____ (www.minidvdsoft.com ) C:\Users\DoreenAgricola\Downloads\freedvd2iso.exe
2015-03-25 10:16 - 2015-03-25 10:16 - 00000000 ____D () C:\Users\DoreenAgricola\Bahncard
2015-03-24 15:08 - 2015-03-25 12:40 - 00000000 ____D () C:\UNIGIS_Proj
2015-03-24 11:45 - 2015-03-25 09:42 - 00000000 ____D () C:\Users\DoreenAgricola\Ausflug C+C
2015-03-23 17:14 - 2015-03-23 17:14 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GeoServer 2.6.2
2015-03-23 17:13 - 2015-03-23 17:14 - 00000000 ____D () C:\Program Files (x86)\GeoServer 2.6.2
2015-03-23 17:07 - 2015-03-23 17:08 - 61726186 _____ () C:\Users\DoreenAgricola\Downloads\geoserver-2.6.2.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-19 12:10 - 2014-05-12 12:50 - 00002032 _____ () C:\Windows\Tasks\lyricsgizm Runner.job
2015-04-19 12:09 - 2009-07-14 06:45 - 00026832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-19 12:09 - 2009-07-14 06:45 - 00026832 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-19 12:06 - 2014-05-12 12:50 - 328404820 _____ () C:\Users\Doreen
2015-04-19 12:05 - 2014-05-05 08:33 - 01073867 _____ () C:\Windows\WindowsUpdate.log
2015-04-19 12:05 - 2014-02-25 01:45 - 00718214 _____ () C:\Windows\system32\perfh007.dat
2015-04-19 12:05 - 2014-02-25 01:45 - 00155208 _____ () C:\Windows\system32\perfc007.dat
2015-04-19 12:05 - 2009-07-14 07:13 - 01658622 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-19 12:03 - 2014-05-06 07:42 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-04-19 12:02 - 2014-05-05 08:37 - 00003994 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B6CB3B30-D1AE-4A15-97B7-6788AAE48997}
2015-04-19 12:00 - 2013-09-13 21:02 - 00000000 ____D () C:\ProgramData\PDFC
2015-04-19 11:58 - 2014-05-22 11:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-19 11:58 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.log
2015-04-19 11:58 - 2013-11-02 01:08 - 00001036 _____ () C:\Windows\SysWOW64\bscs.ini
2015-04-19 11:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-19 11:58 - 2009-07-14 06:51 - 00084552 _____ () C:\Windows\setupact.log
2015-04-17 12:43 - 2014-05-22 11:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-17 12:10 - 2014-05-12 12:10 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Skype
2015-04-17 11:58 - 2014-05-20 07:39 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-17 07:37 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.001
2015-04-16 23:05 - 2011-02-11 15:51 - 01633086 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-16 23:00 - 2014-05-16 13:55 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-16 22:49 - 2014-05-16 13:55 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-16 22:14 - 2014-05-05 08:36 - 00000000 ____D () C:\Users\DoreenAgricola
2015-04-16 22:12 - 2014-05-12 12:50 - 00000000 ____D () C:\ProgramData\lyricsgizm
2015-04-16 21:55 - 2014-12-10 12:29 - 00000000 ____D () C:\fotobuch2014
2015-04-16 21:55 - 2014-07-29 14:59 - 00132187 ____H () C:\treeinfo.wc
2015-04-16 12:18 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.002
2015-04-16 12:18 - 2010-11-21 05:47 - 00382970 _____ () C:\Windows\PFRO.log
2015-04-16 12:01 - 2013-09-13 20:56 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-16 09:58 - 2014-05-20 07:39 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-16 09:58 - 2013-09-13 21:02 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-16 09:58 - 2013-09-13 21:02 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-16 08:32 - 2014-05-07 09:59 - 00002380 _____ () C:\Users\DoreenAgricola\Desktop\Outlook 2013.lnk
2015-04-16 08:02 - 2015-02-19 09:34 - 00002393 _____ () C:\Users\Test\Desktop\Sicherer Zahlungsverkehr.lnk
2015-04-16 08:02 - 2015-02-19 09:34 - 00001434 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:02 - 2015-02-19 09:33 - 00002145 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2015-02-18 13:37 - 00001036 _____ () C:\Users\Gast\Desktop\Notepad++.lnk
2015-04-16 08:02 - 2015-02-03 09:03 - 00002393 _____ () C:\Users\Gast\Desktop\Sicherer Zahlungsverkehr.lnk
2015-04-16 08:02 - 2015-02-03 09:03 - 00001434 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:02 - 2015-02-03 09:02 - 00002145 _____ () C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-10-27 14:39 - 00002297 _____ () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-04-16 08:02 - 2014-05-20 10:13 - 00001392 _____ () C:\Users\Public\Desktop\HP Solution Center.lnk
2015-04-16 08:02 - 2014-05-07 10:03 - 00002145 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-05-07 10:03 - 00002145 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2015-04-16 08:02 - 2014-05-05 08:37 - 00001434 _____ () C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-04-16 08:01 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.003
2015-04-16 07:39 - 2015-02-20 10:19 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\WiseUpdate
2015-04-16 07:32 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.004
2015-04-15 16:51 - 2015-03-09 12:02 - 00000000 ____D () C:\PMBC
2015-04-15 16:50 - 2014-02-25 01:39 - 00000225 _____ () C:\Windows\CryptoMill_CreoService.005
2015-04-15 12:11 - 2014-02-25 01:41 - 00003619 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI
2015-04-15 12:11 - 2014-02-25 01:41 - 00000043 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI
2015-04-15 09:28 - 2014-09-02 14:46 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\gtk-2.0
2015-04-15 09:28 - 2014-09-02 14:34 - 00000000 ____D () C:\Users\DoreenAgricola\.gimp-2.8
2015-04-15 09:13 - 2014-11-11 11:08 - 00000000 ____D () C:\Users\DoreenAgricola\Desktop\Hamburg
2015-04-10 09:52 - 2014-09-12 15:53 - 00000000 ____D () C:\Windows\Minidump
2015-04-10 09:46 - 2014-05-26 10:44 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-10 09:45 - 2014-12-01 12:02 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-10 09:40 - 2014-05-21 08:21 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\vlc
2015-04-09 11:48 - 2014-02-25 01:24 - 00000000 ____D () C:\ProgramData\Skype
2015-04-09 11:33 - 2015-03-06 11:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-09 11:33 - 2014-05-12 09:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-07 14:56 - 2015-01-27 21:50 - 00000000 ____D () C:\Temp_1
2015-04-07 14:51 - 2014-05-07 09:23 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2015-04-03 22:19 - 2014-07-07 09:33 - 00000000 ____D () C:\Users\DoreenAgricola\___Doreen_PRIVAT
2015-04-03 22:18 - 2014-11-26 21:54 - 00000000 ____D () C:\Users\DoreenAgricola\mamas 60
2015-04-03 22:13 - 2014-10-01 08:33 - 00000000 ____D () C:\UNIGIS
2015-04-03 22:11 - 2014-05-14 08:17 - 00000000 ____D () C:\Users\DoreenAgricola\GREGOR
2015-04-01 13:03 - 2015-02-04 10:11 - 00005200 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for DoreenAgricola-Doreen Agricola DoreenAgricola
2015-03-25 14:41 - 2014-05-05 08:37 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\PDFC
2015-03-25 13:22 - 2014-08-27 10:30 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Local\Adobe
2015-03-24 17:07 - 2014-05-13 10:23 - 00001391 _____ () C:\messages.xml
2015-03-20 12:10 - 2014-05-12 12:28 - 00000000 ____D () C:\Users\DoreenAgricola\AppData\Roaming\Samsung

==================== Files in the root of some directories =======

2015-04-15 09:28 - 2015-04-15 09:28 - 0001493 _____ () C:\Users\DoreenAgricola\AppData\Local\recently-used.xbel
2014-05-13 17:52 - 2014-05-20 10:36 - 0004702 _____ () C:\ProgramData\hpzinstall.log
2014-09-16 10:03 - 2014-09-16 10:03 - 0000199 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some content of TEMP:
====================
C:\Users\DoreenAgricola\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-07 06:37

==================== End Of Log ============================
--- --- ---

doreagr 19.04.2015 11:22
Und hier noch der Addition.txt:
FRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-04-2015
Ran by Doreen Agricola at 2015-04-19 12:12:39
Running from C:\Users\DoreenAgricola\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{C4CB2534-82F4-F4AF-5767-9EE64EF9EB64}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
Anki (HKLM-x32\...\Anki) (Version:  - )
ArcGIS 10.2 Data Interoperability for Desktop (HKLM-x32\...\ArcGIS 10.2 Data Interoperability for Desktop) (Version: 10.2.3348 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2 Data Interoperability for Desktop (x32 Version: 10.2.3348 - Environmental Systems Research Institute, Inc.) Hidden
ArcGIS 10.2 for Desktop (HKLM-x32\...\ArcGIS 10.2 for Desktop) (Version: 10.2.3348 - Environmental Systems Research Institute, Inc.)
ArcGIS 10.2 for Desktop (x32 Version: 10.2.3348 - Environmental Systems Research Institute, Inc.) Hidden
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Avira Browser Safety (HKLM-x32\...\{9E10EA90-5E97-43B7-A246-FC7B4F5E9493}) (Version: 1.4.5.509 - Avira Operations GmbH & Co KG)
Blender (HKLM\...\Blender) (Version: 2.72b - Blender Foundation)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
Citrix Online Plug-in - Web (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 12.3.0.8 - Citrix Systems, Inc.)
Copy (x32 Version: 130.0.366.000 - Hewlett-Packard) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.3.2921 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2.3115 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 4.2.1.4224 - CyberLink Corp.)
DbVisualizer (HKLM\...\8973-4025-0853-7287) (Version: 9.1.10 - DbVis Software AB)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.372.000 - Hewlett-Packard) Hidden
DJ_AIO_06_F2400_SW_Min (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
ER Mapper Image Compressor 7.2 (HKLM-x32\...\ER Mapper Image Compressor 7.2) (Version: 7.2 - Earth Resource Mapping)
ER Viewer 7.1 (HKLM-x32\...\{671D7AB6-8118-4C41-B602-3001A5A949AA}) (Version:  - )
F2400 (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Foxy Security (HKLM-x32\...\Foxy Security) (Version:  - )
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
GeoServer 2.6.2 (HKLM-x32\...\GeoServer 2.6.2) (Version:  - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
gvSIG desktop (HKLM-x32\...\5C7663A6-181A-61C1-6C25-D2B427D68E1B) (Version: 2.0.0 - gvSIG Association)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{07F6DC37-0857-4B68-A675-4E35989E85E3}) (Version: 6.0.15.1 - Hewlett-Packard Company)
HP Client Security Manager (HKLM\...\HPProtectTools) (Version: 8.2.0.1663 - Hewlett-Packard Company)
HP Connection Manager (HKLM-x32\...\{7ED7BF91-D145-480A-B206-6891576F6935}) (Version: 4.6.12.1 - Hewlett-Packard Company)
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Deskjet F2400 All-In-One Driver Software 13.0 Rel .6 (HKLM\...\{CDBF8C2D-04B0-4F9B-9AE1-7422F7F0EC94}) (Version: 13.0 - HP)
HP Device Access Manager (HKLM\...\{9F7FF800-8C11-4741-8D20-92E43CA02FD6}) (Version: 8.2.0.10 - Hewlett-Packard Company)
HP Documentation (HKLM-x32\...\{7940DAB9-AC72-4422-8908-DCF58C2C1D21}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Drive Encryption (HKLM\...\HPDriveEncryption) (Version: 8.6.1.160 - Hewlett-Packard Company)
HP ESU for Microsoft Windows 7 (HKLM-x32\...\{240B2BF7-E7E6-425C-A2A4-A3149189BF7F}) (Version: 2.3.1 - Hewlett-Packard Company)
HP File Sanitizer (HKLM-x32\...\{547607B0-3294-4ECA-8F5E-921404676CBB}) (Version: 8.4.11.1 - Hewlett-Packard Company)
HP HD Webcam Driver (HKLM-x32\...\Sunplus SPUVCb) (Version: 3.4.8.30 - SunplusIT)
HP Hotkey Support (HKLM-x32\...\{C807BEFB-0F17-41AC-B307-D7B5E1553040}) (Version: 5.0.20.1 - Hewlett-Packard Company)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP PageLift (HKLM-x32\...\{708ABF62-5D7A-4550-823A-1F9EFA63645A}) (Version: 1.0.11.1 - Hewlett-Packard Company)
HP Print Projects 1.0 (HKLM\...\HP Print Projects) (Version: 1.0 - HP)
HP Setup (HKLM-x32\...\{438363A8-F486-4C37-834C-4955773CB3D3}) (Version: 9.1.15453.4066 - Hewlett-Packard Company)
HP Smart Web Printing 4.5 (HKLM\...\HP Smart Web Printing) (Version: 4.5 - HP)
HP SoftPaq Download Manager (HKLM-x32\...\{5C2D96B7-0468-4450-8BD9-63AB796D72CF}) (Version: 3.4.11.0 - Hewlett-Packard Company)
HP Software Setup (HKLM-x32\...\{7EF08127-4C30-4C05-8CEB-544F8A71C080}) (Version: 8.7.1.1 - Hewlett-Packard Company)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 13.00.0000 - Hewlett-Packard)
HP System Default Settings (HKLM-x32\...\{3A61A282-4F08-4D43-920C-DC30ECE528E8}) (Version: 2.6.1 - Hewlett-Packard Company)
HP Theft Recovery (HKLM-x32\...\InstallShield_{BAC712C6-4061-4C9F-AB58-A5C53E76704A}) (Version: 8.2.0.9 - Hewlett-Packard Company)
HP Trust Circles (HKLM-x32\...\HP Trust Circles) (Version: 8.2.15.16418 - CryptoMill Technologies)
HP Update (HKLM-x32\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
hpPrintProjects (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
hpWLPGInstaller (x32 Version: 130.0.303.000 - Hewlett-Packard) Hidden
HyperCam 2 (HKLM-x32\...\HyperCam 2) (Version:  - )
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6486.0 - IDT)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.12.1688 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.18.10.3272 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.7.3.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 3.0.0.66956 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Intergraph GeoMedia Viewer 2014 (HKLM-x32\...\{91429374-40EC-48DA-999C-4678CAB5CE1E}) (Version: 14.00.0002.00088 - Intergraph Corporation) <==== ATTENTION
Java 7 Update 75 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417075FF}) (Version: 7.0.750 - Oracle)
Java 7 Update 75 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217075FF}) (Version: 7.0.750 - Oracle)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 40 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418040F0}) (Version: 8.0.400 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mediatek MT7630E 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.36.0 - Mediatek)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\MyFreeCodec) (Version:  - )
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.4 - Notepad++ Team)
OEM Application Profile (HKLM-x32\...\{CCBD6679-C7CF-2030-2A1F-3640781DF4F4}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Corporate Edition (HKLM-x32\...\PDF Complete) (Version: 4.1.50 - PDF Complete, Inc)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)
posterXXL Designer 5.2 (HKLM-x32\...\posterXXL Designer)_is1) (Version:  - )
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QGIS Chugiak 2.4.0 Chugiak (HKLM-x32\...\QGIS Chugiak) (Version:  - QGIS Development Team)
Ralink Bluetooth Stack (HKLM\...\{BCDD86BE-1426-19BA-D1D1-C94D92FD6281}) (Version: 11.0.748.0 - Mediatek)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 1.1.9200.18 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.73.618.2013 - Realtek)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Settings Manager (HKLM-x32\...\Settings Manager) (Version: 5.0.0.12349 - Aztec Media Inc) <==== ATTENTION
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.3 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.3.101 - Skype Technologies S.A.)
SmartWebPrinting (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.3 - Synaptics Incorporated)
Tableau Public 8.2 (8200.14.1015.1955) (HKLM\...\{D1DA53A9-040E-4D82-B888-EF5617A9C25B}) (Version: 8.2.2152 - Tableau Software)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.39052 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.376.000 - Hewlett-Packard) Hidden
Validity Fingerprint Sensor Driver (HKLM\...\{F5850B80-27F9-406E-91D3-1329F813BA63}) (Version: 4.5.130.0 - Validity Sensors, Inc.)
Video Songs Gizmos (HKU\S-1-5-21-423146766-3122434050-3300097568-1001\...\lyricsgizm) (Version: 3.0.0.0 - lyricsgizm) <==== ATTENTION
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.0 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
WinTopo (HKLM-x32\...\WinTopo) (Version:  - )
Wise Program Uninstaller 1.63 (HKLM-x32\...\Wise Program Uninstaller_is1) (Version: 1.63 - WiseCleaner.com, Inc.)
Wise Registry Cleaner 8.42 (HKLM-x32\...\Wise Registry Cleaner_is1) (Version: 8.42 - WiseCleaner.com, Inc.)
XTools Pro 10.2 (HKLM-x32\...\{41A0A466-04BA-4142-BBA2-A0A08F865610}) (Version: 10.2.1235 - Data East Soft, LLC)
yEd Graph Editor 3.7 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.7 - yWorks GmbH)
YTD Video Downloader 4.8.9 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.8.9 - GreenTree Applications SRL) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{D45F043D-F17F-4e8a-8435-70971D9FA46D}\InprocServer32 -> C:\Program Files\Blender Foundation\Blender\BlendThumb64.dll ()
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll N (the data entry has 6 more characters).
CustomCLSID: HKU\S-1-5-21-423146766-3122434050-3300097568-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll No  (the data entry has 4 more characters).

==================== Restore Points  =========================

24-03-2015 11:40:02 Windows Update
30-03-2015 08:40:27 Windows Update
02-04-2015 14:03:48 Windows Modules Installer
03-04-2015 21:45:51 Windows Update
09-04-2015 07:22:38 Windows Update
10-04-2015 09:43:28 Installed Java 7 Update 75 (64-bit)
10-04-2015 09:45:38 Installed Java 7 Update 75
10-04-2015 10:36:33 Windows Defender Checkpoint
16-04-2015 07:44:21 Windows Update
16-04-2015 08:16:42 Removed Bonjour
16-04-2015 22:44:29 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0F2E3699-286F-44D0-8052-BADD371F2AEF} - System32\Tasks\{CFCFC0F1-4AA8-46B8-9ACF-A2C95ABEA347} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {2030E90F-7308-4BF7-B264-4A05C078BDB3} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {247803FB-AC8A-45B5-A54F-C2B14174937E} - System32\Tasks\{0A472056-4AAA-448E-98C1-F9D5F526BCEF} => pcalua.exe -a F:\Setup\snsplash.exe -d F:\
Task: {33F61431-4C68-497C-9751-BCF365D37DC9} - System32\Tasks\Clip => C:\___Module\Modul6\UebungenM6\Uebung8\scheduledTasks.py [2014-10-10] ()
Task: {36723A3D-C688-4466-83B6-FE60BC3A5C83} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-16] (Adobe Systems Incorporated)
Task: {3A1857E4-CC82-4E1E-8AB4-5BFA73D37CE8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {3B6C0BF7-BDB5-4662-A28A-B630F6918E79} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\Doreen Agricola\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\MinibarChrome.exe
Task: {463EFD36-123B-4D48-A5C6-55A8B3C3B34E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22] (Google Inc.)
Task: {46FCC82F-EECF-494E-9EDB-CD0AC7A6F6C8} - System32\Tasks\{0DA2C344-C7A3-443D-B3A1-0655E1D5FF01} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {98B470E0-FB4D-445F-90F5-2FCA2B0A0B31} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {9CFA66FC-B52A-41FA-82B9-E36B4E3227E1} - System32\Tasks\{7BB3B0E1-FB84-4E4C-B5B0-E465F0C0386A} => pcalua.exe -a C:\Users\DoreenAgricola\Desktop\setup.exe -d C:\Users\DoreenAgricola\Desktop
Task: {ACE243A2-0E2D-4908-B537-2EA0B046BD05} - System32\Tasks\{FF4D077D-604A-41CE-863F-20F86D23DC77} => pcalua.exe -a "C:\Users\Doreen Agricola\Downloads\msorun.exe" -d "C:\Users\Doreen Agricola\Downloads"
Task: {BACC6C11-0E3A-400B-96F0-D3D26FD13997} - System32\Tasks\{B0E7FAB3-7140-4A58-B3ED-16AB57F10219} => pcalua.exe -a "C:\Users\Doreen Agricola\Downloads\wlsetup-web.exe" -d "C:\Users\Doreen Agricola\Downloads"
Task: {BDEBA074-ACA0-41BD-A20B-98A47023CCC2} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {C51BB2FB-82FD-4A25-BFBF-10CAF2B4073B} - System32\Tasks\{E84A3618-1408-452D-8610-FEED3040DB60} => C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [2015-02-10] (Microsoft Corporation)
Task: {D4C0C374-457C-495D-A89E-477E12A99CCB} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {D9529417-7358-4E66-97BE-A0DDDCFD3A21} - System32\Tasks\lyricsgizm Runner => C:\ProgramData\lyricsgizm\lyricsgizm.exe [2014-06-30] (Print Test Agent) <==== ATTENTION
Task: {D9CE6AD5-97FA-40AD-8B83-71EDC89338C0} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22] (Google Inc.)
Task: {E19831DE-4441-4DBB-AD09-63BFFB79DAD1} - System32\Tasks\Microsoft Office 15 Sync Maintenance for DoreenAgricola-Doreen Agricola DoreenAgricola => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-02-10] (Microsoft Corporation)
Task: {E1CBFC58-44CB-4C39-A4A5-AA3D153606B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E2284166-3B08-41E1-93CA-C225C16A1BDB} - System32\Tasks\Avira Browser Safety Updater Task => C:\Program Files (x86)\Avira\Browser Safety\AviraBrowserSafetyUpdater.exe [2015-03-11] (Avira Operations GmbH & Co. KG)
Task: {E65A49A0-98D7-41A4-B3A7-9592F1BE2CA2} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\lyricsgizm Runner.job => C:\ProgramData\lyricsgizm\lyricsgizm.exe;/task=4 C:\ProgramData\lyricsgizm\lyricsgizm.exe /task=4 /InstallOn=0 /closebr=0 /active=24 /update=24 /interval=2880 /pubId=1001 /affId=10010035 /appId=111 /uId={11B3653E-46F5-420B-8870-5F13D2E3E023} /version=3.0.0.0 /Override=false /IEhome=0 /IEsearch=0 /FFhome=0 /FFsearch=0 /CHhome=0 /CHsearch=0 /FFaddon=  /CHaddon=  /AutoSP=  /regAppName=lyricsgizm /curSID=S-1-5-21-423146766-3122434050-3300097568-1001 /logf=C:\Users\Doreen Agricola\AppData\Local\Temp\lyricsgizm_installer_{11B3653E-46F5-420B-8870-5F13D2E3E023}_1399891842.txt

==================== Loaded Modules (whitelisted) ==============

2013-05-22 23:21 - 2013-05-22 23:21 - 00299832 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll
2014-05-13 17:50 - 2012-09-18 15:27 - 00192512 _____ () C:\Windows\System32\zlhp1020.dll
2014-05-13 17:50 - 2012-09-18 15:27 - 00065024 _____ () C:\Windows\system32\spool\PRTPROCS\x64\pphp1020.dll
2015-03-09 12:25 - 2015-01-20 11:45 - 00020240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\TeamViewer_PrintProcessor.dll
2013-11-02 01:48 - 2013-11-02 01:48 - 00029432 _____ () C:\Windows\system32\BsTrace.dll
2013-08-08 00:01 - 2013-08-08 00:01 - 02654936 _____ () C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\ShredContextMenu.dll
2013-11-02 01:48 - 2013-11-02 01:48 - 00371448 _____ () C:\Windows\system32\BsExtendFunc.dll
2014-05-12 11:49 - 2014-05-12 11:49 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2014-05-12 07:46 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-08-08 01:02 - 2013-08-08 01:02 - 00007168 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe
2013-11-02 01:48 - 2013-11-02 01:48 - 00016632 _____ () C:\Windows\system32\BsHelpCSps.dll
2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-04-20 01:42 - 2014-10-09 11:36 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 01:42 - 2014-04-20 01:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2014-02-25 01:20 - 2013-07-26 07:24 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-423146766-3122434050-3300097568-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\DoreenAgricola\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk => C:\Windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupreg: (default) =>
MSCONFIG\startupreg: AccelerometerSysTrayApplet => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe
MSCONFIG\startupreg: BtTray => "c:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"
MSCONFIG\startupreg: CLMLServer_For_P2G8 => "c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe"
MSCONFIG\startupreg: CLVirtualDrive => "c:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe" /R
MSCONFIG\startupreg: ConnectionCenter => "C:\Program Files (x86)\Citrix\ICA Client\concentr.exe" /startup
MSCONFIG\startupreg: CryptoMill Refresh => C:\Program Files\Hewlett-Packard\HP Trust Circles\ceflauncher -m refresh
MSCONFIG\startupreg: HotKeysCmds => "C:\Windows\system32\hkcmd.exe"
MSCONFIG\startupreg: HP File Sanitizer => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\Coreshredder.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: HPConnectionManager => c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe
MSCONFIG\startupreg: IAStorIcon => "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: IgfxTray => "C:\Windows\system32\igfxtray.exe"
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: Persistence => "C:\Windows\system32\igfxpers.exe"
MSCONFIG\startupreg: QLBController => C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe /start
MSCONFIG\startupreg: StartCCC => "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: SynTPEnh => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
MSCONFIG\startupreg: YouCam Mirage => "c:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe"
MSCONFIG\startupreg: YouCam Tray => "c:\Program Files (x86)\CyberLink\YouCam\YouCamTray.exe" /s

==================== Accounts: =============================

Administrator (S-1-5-21-423146766-3122434050-3300097568-500 - Administrator - Disabled)
Doreen Agricola (S-1-5-21-423146766-3122434050-3300097568-1001 - Administrator - Enabled) => C:\Users\DoreenAgricola
Gast (S-1-5-21-423146766-3122434050-3300097568-501 - Limited - Enabled) => C:\Users\Gast
Test (S-1-5-21-423146766-3122434050-3300097568-1002 - Administrator - Enabled) => C:\Users\Test

==================== Faulty Device Manager Devices =============

Name: Microsoft-Teredo-Tunneling-Adapter
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (04/17/2015 07:40:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: lyricsgizm.exe, Version: 1.1.0.14, Zeitstempel: 0x53b195a4
Name des fehlerhaften Moduls: lyricsgizm.exe, Version: 1.1.0.14, Zeitstempel: 0x53b195a4
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000085cf
ID des fehlerhaften Prozesses: 0xc4c
Startzeit der fehlerhaften Anwendung: 0xlyricsgizm.exe0
Pfad der fehlerhaften Anwendung: lyricsgizm.exe1
Pfad des fehlerhaften Moduls: lyricsgizm.exe2
Berichtskennung: lyricsgizm.exe3

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1427051

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1427051

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/10/2015 10:36:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Abfragen nach der Schnittstelle "IVssWriterCallback" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070005, Zugriff verweigert
.
Die Ursache hierfür ist oft eine falsche Sicherheitseinstellung im Schreib- oder Anfrageprozess.


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {43d32e80-3bd0-4212-a950-b807cf23e2be}

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x12b0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x12cc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 37.0.1.5570, Zeitstempel: 0x551e23ee
Name des fehlerhaften Moduls: mozalloc.dll, Version: 37.0.1.5570, Zeitstempel: 0x551e1536
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1294
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3


System errors:
=============
Error: (04/17/2015 00:53:42 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.

Error: (04/17/2015 10:59:32 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/16/2015 11:08:39 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.

Error: (04/16/2015 10:43:54 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (04/16/2015 10:43:42 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (04/16/2015 06:10:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 4 Mal passiert.

Error: (04/16/2015 04:49:25 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.

Error: (04/16/2015 02:18:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.

Error: (04/16/2015 01:41:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "CyberLink PowerDVD 12 Media Server Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (04/16/2015 00:17:11 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "GeoServer 2.6.2" wurde mit folgendem dienstspezifischem Fehler beendet: %%1.


Microsoft Office Sessions:
=========================
Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\DoreenAgricola\Downloads\SoftonicDownloader_fuer_freemind.exe

Error: (04/17/2015 09:20:03 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\DoreenAgricola\Downloads\SoftonicDownloader_fuer_samsung-kies.exe

Error: (04/17/2015 07:40:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: lyricsgizm.exe1.1.0.1453b195a4lyricsgizm.exe1.1.0.1453b195a4c0000005000085cfc4c01d078d0f2047781C:\ProgramData\lyricsgizm\lyricsgizm.exeC:\ProgramData\lyricsgizm\lyricsgizm.exe3118722a-e4c4-11e4-9d87-a01d48aefcc7

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1427051

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1427051

Error: (04/15/2015 00:11:14 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (04/10/2015 10:36:33 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Zugriff verweigert


Vorgang:
  Generatordaten werden gesammelt

Kontext:
  Generatorklassen-ID: {e8132975-6f93-4464-a53e-1050253ae220}
  Generatorname: System Writer
  Generatorinstanz-ID: {43d32e80-3bd0-4212-a950-b807cf23e2be}

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa112b001d073678c1f2624C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec67c0e1-df5a-11e4-9acc-a01d48aefcc7

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa112cc01d073678c2d6e66C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec6772c1-df5a-11e4-9acc-a01d48aefcc7

Error: (04/10/2015 10:23:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe37.0.1.5570551e23eemozalloc.dll37.0.1.5570551e15368000000300001aa1129401d073678bed293fC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dllec6799d1-df5a-11e4-9acc-a01d48aefcc7


CodeIntegrity Errors:
===================================
  Date: 2014-09-02 14:11:44.469
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:11:44.469
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:32.776
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:32.776
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:29.896
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:29.896
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:29.796
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:29.796
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:19.832
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-02 14:10:19.831
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 50%
Total physical RAM: 3977.11 MB
Available physical RAM: 1970.57 MB
Total Pagefile: 7952.41 MB
Available Pagefile: 5085.2 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:450.51 GB) (Free:334.13 GB) NTFS
Drive d: (HP_RECOVERY) (Fixed) (Total:12.24 GB) (Free:1.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (HP_TOOLS) (Fixed) (Total:1.99 GB) (Free:1.99 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 618D8341)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=450.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=12.2 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=2 GB) - (Type=0B)

==================== End Of Log ============================
--- --- ---

schrauber 19.04.2015 22:04
Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    Intergraph GeoMedia Viewer 2014 (HKLM-x32\...\{91429374-40EC-48DA-999C-4678CAB5CE1E}) (Version: 14.00.0002.00088 - Intergraph Corporation) <==== ATTENTION

    Settings Manager

    Video Songs Gizmos

    YTD Video Downloader 4.8.9


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 






Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

doreagr 22.04.2015 17:32
Hallo, hier die ersten Probleme.

Also Intergraph und YTD gingen problemlos zu deinstallieren. Bei Settings Manager und Video songs Gizmos gab es Probleme. Wahrscheinlich, weil es hier keine automatischen Deinstallationsprogramme der Firmen gab.
Was soll ich tun, wenn ich,bei den Übriggebliebenen Registryeinträgen Fenster, auf alles markieren gehe, dann werden alle Verzeichnisse von Mein Computer , HKEY_LOCAL_Machine, SOFTWARE..... markiert bis hin zu Settings Manager und dessen Unterpfade! Ist das richtig, dass in jedem Kästchen ein Haken drinne ist von der Wurzel an oder soll ich nur das Settings Manager und die darunter liegenden Anstriche markieren und Löschen. Ähnlich bei Video Songs Gizmos.
Ich habe auch Screenshots von den beiden Anzeigen, weiß aber nicht wie ich die hier hochladen soll, damit Du das auch siehst.
Na dann, Danke bis hierher ich bin gespannt wie es weiter geht.
Doreen

schrauber 23.04.2015 11:27
Ist korrekt so, steht aber alles in der bebilderten Anleitung :)

doreagr 26.04.2015 05:57
Hallo Schrauber, das hat jetzt ewig gedauert, aber ich habe einen Log File von Combofix.
Combofix Logfile:
Code:
ComboFix 15-04-19.01 - Doreen Agricola 24.04.2015  15:17:11.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.3977.1806 [GMT 2:00]
ausgeführt von:: c:\users\DoreenAgricola\Desktop\ComboFix.exe
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\lyricsgizm
c:\programdata\lyricsgizm\lyricsgizm.exe
c:\programdata\lyricsgizm\lyricsgizmutil.dll
c:\users\DoreenAgricola\AppData\Local\assembly\tmp
c:\users\DoreenAgricola\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C5458AEF-52A5-4455-AA31-DAFD9DA33B25}.xps
c:\users\DoreenAgricola\AppData\Local\Microsoft\Windows\Temporary Internet Files\{C62C3DB3-7FCD-4697-85AA-2DF114275DBB}.xps
c:\users\DoreenAgricola\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\SysWow64\DEBUG.log
c:\windows\SysWow64\logs
.
.
(((((((((((((((((((((((  Dateien erstellt von 2015-03-25 bis 2015-04-25  ))))))))))))))))))))))))))))))
.
.
2015-04-24 21:07 . 2015-04-24 21:07        --------        d-----w-        c:\users\Test\AppData\Local\temp
2015-04-24 21:07 . 2015-04-24 21:07        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2015-04-24 21:07 . 2015-04-24 21:07        --------        d-----w-        c:\users\Default\AppData\Local\temp
2015-04-22 15:53 . 2015-04-22 15:53        --------        d-----w-        c:\program files (x86)\VS Revo Group
2015-04-19 10:08 . 2015-04-19 10:13        --------        d-----w-        C:\FRST
2015-04-16 10:07 . 2015-04-16 10:07        --------        d-----w-        c:\users\DoreenAgricola\AppData\Roaming\Avira
2015-04-16 10:05 . 2015-03-24 12:59        44088        ----a-w-        c:\windows\system32\drivers\avnetflt.sys
2015-04-16 10:05 . 2015-03-24 12:59        28600        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2015-04-16 10:05 . 2015-03-24 12:59        132120        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2015-04-16 10:05 . 2015-03-24 12:59        128536        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2015-04-16 10:01 . 2015-04-16 10:09        --------        d-----w-        c:\program files (x86)\Avira
2015-04-16 10:01 . 2015-04-16 10:05        --------        d-----w-        c:\programdata\Avira
2015-04-16 05:44 . 2015-02-25 03:18        754688        ----a-w-        c:\windows\system32\drivers\http.sys
2015-04-10 07:48 . 2015-04-10 07:48        --------        d-----w-        c:\program files (x86)\Common Files\Java
2015-04-10 07:44 . 2015-04-10 07:47        111016        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2015-04-10 07:44 . 2015-04-10 07:44        189352        ----a-w-        c:\windows\system32\javaw.exe
2015-04-10 07:44 . 2015-04-10 07:44        189352        ----a-w-        c:\windows\system32\java.exe
2015-04-10 07:44 . 2015-04-10 07:47        --------        d-----w-        c:\program files\Java
2015-04-03 20:13 . 2015-04-03 20:13        --------        d-----w-        c:\users\DoreenAgricola\rezepte_Kigeb
2015-04-02 11:51 . 2015-04-02 11:51        --------        d-----w-        c:\programdata\Citrix
2015-04-02 11:51 . 2015-04-02 12:05        --------        d-----w-        c:\users\DoreenAgricola\AppData\Roaming\ICAClient
2015-04-02 11:51 . 2015-04-02 11:51        --------        d-----w-        c:\users\DoreenAgricola\AppData\Local\Citrix
2015-04-02 11:51 . 2015-04-02 11:51        --------        d-----w-        c:\program files (x86)\Citrix
2015-03-30 06:39 . 2015-03-30 06:39        --------        d-----w-        c:\program files (x86)\Common Files\Hydrup
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-16 20:49 . 2014-05-16 11:55        128913832        ----a-w-        c:\windows\system32\MRT.exe
2015-04-16 07:58 . 2013-09-13 19:02        778416        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2015-04-16 07:58 . 2013-09-13 19:02        142512        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-17 04:56 . 2015-04-16 05:45        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2015-02-26 03:25 . 2015-03-11 09:44        3204096        ----a-w-        c:\windows\system32\win32k.sys
2015-02-24 03:20 . 2015-02-24 03:20        829264        ----a-w-        c:\windows\system32\msvcr100.dll
2015-02-24 03:20 . 2015-02-24 03:20        608080        ----a-w-        c:\windows\system32\msvcp100.dll
2015-02-24 03:17 . 2010-11-21 03:27        295552        ------w-        c:\windows\system32\MpSigStub.exe
2015-02-24 02:11 . 2015-02-24 02:11        773968        ----a-w-        c:\windows\SysWow64\msvcr100.dll
2015-02-24 02:11 . 2015-02-24 02:11        421200        ----a-w-        c:\windows\SysWow64\msvcp100.dll
2015-02-20 04:41 . 2015-03-11 09:48        41984        ----a-w-        c:\windows\system32\lpk.dll
2015-02-20 04:40 . 2015-03-11 09:48        100864        ----a-w-        c:\windows\system32\fontsub.dll
2015-02-20 04:40 . 2015-03-11 09:48        14336        ----a-w-        c:\windows\system32\dciman32.dll
2015-02-20 04:40 . 2015-03-11 09:48        46080        ----a-w-        c:\windows\system32\atmlib.dll
2015-02-20 04:13 . 2015-03-11 09:48        70656        ----a-w-        c:\windows\SysWow64\fontsub.dll
2015-02-20 04:13 . 2015-03-11 09:48        10240        ----a-w-        c:\windows\SysWow64\dciman32.dll
2015-02-20 04:13 . 2015-03-11 09:48        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll
2015-02-20 04:12 . 2015-03-11 09:48        25600        ----a-w-        c:\windows\SysWow64\lpk.dll
2015-02-20 03:29 . 2015-03-11 09:48        372224        ----a-w-        c:\windows\system32\atmfd.dll
2015-02-20 03:09 . 2015-03-11 09:48        299008        ----a-w-        c:\windows\SysWow64\atmfd.dll
2015-02-13 05:22 . 2015-03-11 09:45        14177280        ----a-w-        c:\windows\system32\shell32.dll
2015-02-10 10:36 . 2014-05-07 08:00        627912        ----a-w-        c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2015-02-04 10:23 . 2015-02-04 10:23        875688        ----a-w-        c:\windows\SysWow64\msvcr120_clr0400.dll
2015-02-04 10:13 . 2015-02-04 10:13        869536        ----a-w-        c:\windows\system32\msvcr120_clr0400.dll
2015-02-04 03:16 . 2015-03-11 09:40        465920        ----a-w-        c:\windows\system32\WMPhoto.dll
2015-02-04 02:54 . 2015-03-11 09:40        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll
2015-02-03 03:34 . 2015-03-11 09:47        693176        ----a-w-        c:\windows\system32\winload.efi
2015-02-03 03:34 . 2015-03-11 09:47        94656        ----a-w-        c:\windows\system32\drivers\mountmgr.sys
2015-02-03 03:33 . 2015-03-11 09:47        616360        ----a-w-        c:\windows\system32\winresume.efi
2015-02-03 03:31 . 2015-03-11 09:47        14632960        ----a-w-        c:\windows\system32\wmp.dll
2015-02-03 03:31 . 2015-03-11 09:47        782848        ----a-w-        c:\windows\system32\wmdrmsdk.dll
2015-02-03 03:31 . 2015-03-11 09:47        229376        ----a-w-        c:\windows\system32\wintrust.dll
2015-02-03 03:31 . 2015-03-11 09:44        1424896        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2015-02-03 03:31 . 2015-03-11 09:45        215552        ----a-w-        c:\windows\system32\ubpm.dll
2015-02-03 03:31 . 2015-03-11 09:47        5120        ----a-w-        c:\windows\system32\msdxm.ocx
2015-02-03 03:31 . 2015-03-11 09:47        5120        ----a-w-        c:\windows\system32\dxmasf.dll
2015-02-03 03:31 . 2015-03-11 09:47        63488        ----a-w-        c:\windows\system32\setbcdlocale.dll
2015-02-03 03:31 . 2015-03-11 09:47        371712        ----a-w-        c:\windows\system32\qdvd.dll
2015-02-03 03:31 . 2015-03-11 09:47        1574400        ----a-w-        c:\windows\system32\quartz.dll
2015-02-03 03:31 . 2015-03-11 09:47        500224        ----a-w-        c:\windows\system32\AUDIOKSE.dll
2015-02-03 03:31 . 2015-03-11 09:47        188416        ----a-w-        c:\windows\system32\pcasvc.dll
2015-02-03 03:31 . 2015-03-11 09:47        37376        ----a-w-        c:\windows\system32\pcadm.dll
2015-02-03 03:31 . 2015-03-11 09:47        9728        ----a-w-        c:\windows\system32\spwmp.dll
2015-02-03 03:31 . 2015-03-11 09:47        641024        ----a-w-        c:\windows\system32\msscp.dll
2015-02-03 03:31 . 2015-03-11 09:47        325632        ----a-w-        c:\windows\system32\msnetobj.dll
2015-02-03 03:31 . 2015-03-11 09:47        11264        ----a-w-        c:\windows\system32\msmmsp.dll
2015-02-03 03:31 . 2015-03-11 09:47        4121600        ----a-w-        c:\windows\system32\mf.dll
2015-02-03 03:31 . 2015-03-11 09:47        432128        ----a-w-        c:\windows\system32\mfplat.dll
2015-02-03 03:31 . 2015-03-11 09:47        206848        ----a-w-        c:\windows\system32\mfps.dll
2015-02-03 03:30 . 2015-03-11 09:47        631808        ----a-w-        c:\windows\system32\evr.dll
2015-02-03 03:30 . 2015-03-11 09:47        284672        ----a-w-        c:\windows\system32\EncDump.dll
2015-02-03 03:30 . 2015-03-11 09:47        1202176        ----a-w-        c:\windows\system32\drmv2clt.dll
2015-02-03 03:30 . 2015-03-11 09:47        497664        ----a-w-        c:\windows\system32\drmmgrtn.dll
2015-02-03 03:30 . 2015-03-11 09:47        1480192        ----a-w-        c:\windows\system32\crypt32.dll
2015-02-03 03:30 . 2015-03-11 09:47        140288        ----a-w-        c:\windows\system32\cryptnet.dll
2015-02-03 03:30 . 2015-03-11 09:47        1069056        ----a-w-        c:\windows\system32\cryptui.dll
2015-02-03 03:30 . 2015-03-11 09:47        187904        ----a-w-        c:\windows\system32\cryptsvc.dll
2015-02-03 03:30 . 2015-03-11 09:47        82432        ----a-w-        c:\windows\system32\cryptsp.dll
2015-02-03 03:30 . 2015-03-11 09:47        680960        ----a-w-        c:\windows\system32\audiosrv.dll
2015-02-03 03:30 . 2015-03-11 09:47        842240        ----a-w-        c:\windows\system32\blackbox.dll
2015-02-03 03:30 . 2015-03-11 09:47        296448        ----a-w-        c:\windows\system32\AudioSes.dll
2015-02-03 03:30 . 2015-03-11 09:47        440832        ----a-w-        c:\windows\system32\AudioEng.dll
2015-02-03 03:30 . 2015-03-11 09:47        58880        ----a-w-        c:\windows\system32\appidapi.dll
2015-02-03 03:30 . 2015-03-11 09:47        32256        ----a-w-        c:\windows\system32\appidsvc.dll
2015-02-03 03:30 . 2015-03-11 09:47        55808        ----a-w-        c:\windows\system32\rrinstaller.exe
2015-02-03 03:30 . 2015-03-11 09:47        9728        ----a-w-        c:\windows\system32\pcalua.exe
2015-02-03 03:30 . 2015-03-11 09:47        11264        ----a-w-        c:\windows\system32\pcawrk.exe
2015-02-03 03:30 . 2015-03-11 09:47        24576        ----a-w-        c:\windows\system32\mfpmp.exe
2015-02-03 03:30 . 2015-03-11 09:47        126464        ----a-w-        c:\windows\system32\audiodg.exe
2015-02-03 03:30 . 2015-03-11 09:47        146944        ----a-w-        c:\windows\system32\appidpolicyconverter.exe
2015-02-03 03:30 . 2015-03-11 09:47        17920        ----a-w-        c:\windows\system32\appidcertstorecheck.exe
2015-02-03 03:30 . 2015-03-11 09:47        12625920        ----a-w-        c:\windows\system32\wmploc.DLL
2015-02-03 03:29 . 2015-03-11 09:47        8704        ----a-w-        c:\windows\system32\pcaevts.dll
2015-02-03 03:28 . 2015-03-11 09:47        2048        ----a-w-        c:\windows\system32\mferror.dll
2015-02-03 03:19 . 2015-03-11 09:47        663552        ----a-w-        c:\windows\system32\drivers\PEAuth.sys
2015-02-03 03:12 . 2015-03-11 09:47        617984        ----a-w-        c:\windows\SysWow64\wmdrmsdk.dll
2015-02-03 03:12 . 2015-03-11 09:47        179200        ----a-w-        c:\windows\SysWow64\wintrust.dll
2015-02-03 03:12 . 2015-03-11 09:44        1230848        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll
2015-02-03 03:12 . 2015-03-11 09:45        171520        ----a-w-        c:\windows\SysWow64\ubpm.dll
2015-02-03 03:12 . 2015-03-11 09:47        4096        ----a-w-        c:\windows\SysWow64\msdxm.ocx
2015-02-03 03:12 . 2015-03-11 09:47        4096        ----a-w-        c:\windows\SysWow64\dxmasf.dll
2015-02-03 03:12 . 2015-03-11 09:47        519680        ----a-w-        c:\windows\SysWow64\qdvd.dll
2015-02-03 03:12 . 2015-03-11 09:47        1329664        ----a-w-        c:\windows\SysWow64\quartz.dll
2015-02-03 03:12 . 2015-03-11 09:47        442880        ----a-w-        c:\windows\SysWow64\AUDIOKSE.dll
2015-02-03 03:12 . 2015-03-11 09:47        8192        ----a-w-        c:\windows\SysWow64\spwmp.dll
2015-02-03 03:12 . 2015-03-11 09:47        504320        ----a-w-        c:\windows\SysWow64\msscp.dll
2015-02-03 03:12 . 2015-03-11 09:47        265216        ----a-w-        c:\windows\SysWow64\msnetobj.dll
2015-02-03 03:12 . 2015-03-11 09:47        3209728        ----a-w-        c:\windows\SysWow64\mf.dll
2015-02-03 03:12 . 2015-03-11 09:47        354816        ----a-w-        c:\windows\SysWow64\mfplat.dll
2015-02-03 03:12 . 2015-03-11 09:47        103424        ----a-w-        c:\windows\SysWow64\mfps.dll
2015-02-03 03:12 . 2015-03-11 09:47        489984        ----a-w-        c:\windows\SysWow64\evr.dll
2015-02-03 03:12 . 2015-03-11 09:47        988160        ----a-w-        c:\windows\SysWow64\drmv2clt.dll
2015-02-03 03:12 . 2015-03-11 09:47        406016        ----a-w-        c:\windows\SysWow64\drmmgrtn.dll
2015-02-03 03:12 . 2015-03-11 09:47        1174528        ----a-w-        c:\windows\SysWow64\crypt32.dll
2015-02-03 03:12 . 2015-03-11 09:47        1005056        ----a-w-        c:\windows\SysWow64\cryptui.dll
2015-02-03 03:12 . 2015-03-11 09:47        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll
2015-02-03 03:12 . 2015-03-11 09:47        143872        ----a-w-        c:\windows\SysWow64\cryptsvc.dll
2015-02-03 03:12 . 2015-03-11 09:47        81408        ----a-w-        c:\windows\SysWow64\cryptsp.dll
2015-02-03 03:12 . 2015-03-11 09:47        744960        ----a-w-        c:\windows\SysWow64\blackbox.dll
2015-02-03 03:12 . 2015-03-11 09:47        50688        ----a-w-        c:\windows\SysWow64\appidapi.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\+1TBIcon]
@="{B9C55E85-DED6-4911-82F3-83CF1CAB2898}"
[HKEY_CLASSES_ROOT\CLSID\{B9C55E85-DED6-4911-82F3-83CF1CAB2898}]
2013-08-23 02:24        133592        ----a-w-        c:\program files (x86)\Hewlett-Packard\HP Trust Circles\tbicon.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2015-03-16 129272]
"avgnt"="c:\program files (x86)\Avira\Antivirus\avgnt.exe" [2015-03-24 726320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages        REG_MULTI_SZ          DPPassFilter scecli
.
R2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\Antivirus\avmailc7.exe;c:\program files (x86)\Avira\Antivirus\avmailc7.exe [x]
R2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\Antivirus\avwebg7.exe;c:\program files (x86)\Avira\Antivirus\avwebg7.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 FLCDLOCK;HP Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 ICCS;Intel(R) Integrated Clock Controller Service - Intel(R) ICCS;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe;c:\program files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe;c:\program files\McAfee Security Scan\3.8.150\McCHSvc.exe [x]
R3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
R3 SmbDrv;SmbDrv;c:\windows\system32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 SmbDrvI;SmbDrvI;c:\windows\system32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 amdkmpfd;AMD PCI Root Bus Lower Filter;c:\windows\system32\DRIVERS\amdkmpfd.sys;c:\windows\SYSNATIVE\DRIVERS\amdkmpfd.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\drivers\iaStorF.sys;c:\windows\SYSNATIVE\drivers\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 PinFile;PinFile;c:\windows\system32\DRIVERS\PinFile.sys;c:\windows\SYSNATIVE\DRIVERS\PinFile.sys [x]
S0 SDDisk2K;SDDisk2K;c:\windows\system32\DRIVERS\SDDisk2K.sys;c:\windows\SYSNATIVE\DRIVERS\SDDisk2K.sys [x]
S0 SDDToki;SDDToki;c:\windows\system32\DRIVERS\SDDToki.sys;c:\windows\SYSNATIVE\DRIVERS\SDDToki.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 CLVirtualDrive;CLVirtualDrive;c:\windows\system32\DRIVERS\CLVirtualDrive.sys;c:\windows\SYSNATIVE\DRIVERS\CLVirtualDrive.sys [x]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys;c:\windows\SYSNATIVE\DRIVERS\ctxusbm.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\Antivirus\sched.exe;c:\program files (x86)\Avira\Antivirus\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 AVP15.0.0;Kaspersky Anti-Virus Service 15.0.0;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 ClickToRunSvc;Microsoft Office-Klick-und-Los-Dienst;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 CreoService;HP Trust Circles Service;c:\program files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe;c:\program files (x86)\Hewlett-Packard\HP Trust Circles\CreoSvc.exe [x]
S2 CtAgentService;Absolute Software Agent Service;c:\program files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe;c:\program files (x86)\Hewlett-Packard\HP Theft Recovery\CtService.exe [x]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [x]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [x]
S2 GeoServer 2.6.2;GeoServer 2.6.2;c:\program files (x86)\GeoServer 2.6.2\wrapper.exe;c:\program files (x86)\GeoServer 2.6.2\wrapper.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 HPFSService;HP File Sanitizer;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 Hydrup;Hydrup;c:\program files (x86)\Common Files\Hydrup\hydrup.exe;c:\program files (x86)\Common Files\Hydrup\hydrup.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
S2 ss_conn_service;SAMSUNG Mobile Connectivity Service;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe;c:\program files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S3 BtAudioBusSrv;Ralink Bluetooth Audio Bus Service;c:\windows\system32\Drivers\BtAudioBus.sys;c:\windows\SYSNATIVE\Drivers\BtAudioBus.sys [x]
S3 BthL2caScoIfSrv;IVT Bluetooth Profile Interface Driver Service;c:\windows\system32\Drivers\BtL2caScoIf.sys;c:\windows\SYSNATIVE\Drivers\BtL2caScoIf.sys [x]
S3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;c:\windows\system32\Drivers\IvtUrbBtFlt.sys;c:\windows\SYSNATIVE\Drivers\IvtUrbBtFlt.sys [x]
S3 IceKore;IceKore;c:\windows\system32\DRIVERS\IceKore.sys;c:\windows\SYSNATIVE\DRIVERS\IceKore.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\drivers\iusb3hub.sys;c:\windows\SYSNATIVE\drivers\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys;c:\windows\SYSNATIVE\drivers\iusb3xhc.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 m76usb;M76USB Bluetooth Device Driver;c:\windows\system32\DRIVERS\m76usb.sys;c:\windows\SYSNATIVE\DRIVERS\m76usb.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys;c:\windows\SYSNATIVE\DRIVERS\teamviewervpn.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-13 07:58]
.
2015-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22 09:59]
.
2015-04-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-05-22 09:59]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-02-10 11:52        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-02-10 11:52        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-02-10 11:52        2334928        ----a-w-        c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\grooveex.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\+1TBIcon]
@="{B9C55E85-DED6-4911-82F3-83CF1CAB2898}"
[HKEY_CLASSES_ROOT\CLSID\{B9C55E85-DED6-4911-82F3-83CF1CAB2898}]
2013-08-23 02:24        147928        ----a-w-        c:\program files\Hewlett-Packard\HP Trust Circles\tbicon.dll
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.iminent.com/?appId=CD56CDB8-0175-4E9B-AC8E-E21BECA18E97
uLocal Page = c:\windows\system32\blank.htm
mDefault_Search_URL = https://safesearch.avira.com/
mDefault_Page_URL = https://safesearch.avira.com/
mStart Page = https://safesearch.avira.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = https://safesearch.avira.com/
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
IE: Zu Anti-Banner hinzufügen - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\ie_banner_deny.htm
IE: {{d8f67242-b229-4065-95fa-391b077ed6ca} - {d8f67242-b229-4065-95fa-391b077ed6ca} - mscoree.dll
TCP: DhcpNameServer = 192.168.2.1
Handler: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - c:\windows\System32\mscoree.dll
FF - ProfilePath - c:\users\DoreenAgricola\AppData\Roaming\Mozilla\Firefox\Profiles\dper2974.default\
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.anti_banner_native_proxy - 2
FF - user.js: plugin.state.url_advisor - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.npcontentblocker - 2
FF - user.js: plugin.state.nponlinebanking - 2
FF - user.js: plugin.state.npvkplugin - 2
FF - user.js: plugin.state.anti_banner_native_proxy - 2
FF - user.js: plugin.state.url_advisor - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\SkyDriveShell.dll
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM_Wow6432Node-ActiveSetup-{438363A8-F486-4C37-834C-4955773CB3D3} - msiexec
Toolbar-10 - (no file)
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll
AddRemove-Foxy Security - c:\users\Doreen Agricola\AppData\Roaming\Security Systems\uninstaller.exe
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
AddRemove-OneDriveSetup.exe - c:\users\Doreen Agricola\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\OneDriveSetup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_17_0_0_169_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.17"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_17_0_0_169.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\Antivirus\avguard.exe
c:\program files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
c:\program files (x86)\Java\jre1.8.0_31\bin\java.exe
c:\program files (x86)\TeamViewer\TeamViewer_Service.exe
c:\program files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-04-25  21:35:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2015-04-25 19:34
.
Vor Suchlauf: 25 Verzeichnis(se), 366,424,489,984 Bytes frei
Nach Suchlauf: 32 Verzeichnis(se), 369,442,226,176 Bytes frei
.
- - End Of File - - 365375F46FEA920F2B8FC365E3D33A00
--- --- ---
A36C5E4F47E84449FF07ED3517B43A31
[/CODE]

Ok, dann schaue ich mal wie es weiter geht.
Den Rechner habe ich nach Combofix noch nicht wieder neu gestartet.
Gruß Doreen

schrauber 26.04.2015 18:11
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:37 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131