lennox1982 | 26.01.2014 00:31 | Leider habe ich keine Addition.txt mehr gefunden. Wo sollte die sein? Hat nur eine FRST.txt aufgemacht. Windows hat auch übel gemotzt, als ich das FRST starten wollte.
FRST Logfile:
FRST Logfile:
FRST Logfile:
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-01-2014 01
Ran by Carolina (administrator) on CAROLINA on 25-01-2014 18:25:26
Running from C:\Users\Carolina\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
() C:\Windows\System32\DlProtectSvc.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Windows\System32\KBDKURDd.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Conduit) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe
(Conduit) C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe
(Conduit) C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4396.1016_x64__8wekyb3d8bbwe\LiveComm.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Promethean Technologies Group Ltd) C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
() C:\Program Files\Activ Software\ActivDriver\ActivMgr.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Dell) C:\Users\Carolina\AppData\Local\Apps\2.0\A1L29QQN.6OY\ZB0HK447.5K9\dell..tion_0f612f649c4a10af_0005.0004_3ddfe37344028d2c\DellSystemDetect.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Dropbox, Inc.) C:\Users\Carolina\AppData\Roaming\Dropbox\bin\Dropbox.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\ProgramData\dlprotect.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcupdate.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [DellWPF] - [x]
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6842000 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1230992 2012-09-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2918200 2012-09-21] (Synaptics Incorporated)
HKLM\...\Run: [QuickSet] - c:\Program Files\Dell\QuickSet\QuickSet.exe [5757328 2012-10-19] (Dell Inc.)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4123 2012-05-30] ()
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [11577216 2012-08-27] (Motorola Solutions, Inc.)
HKLM\...\Run: [ActivControl] - C:\Program Files\Activ Software\ActivDriver\ActivControl2x64.exe [1238312 2010-06-10] (Promethean Technologies Group Ltd)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-07-09] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] - c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642728 2012-10-25] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-04] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [143888 2012-06-01] (CyberLink Corp.)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-09-24] (McAfee, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [537512 2013-09-24] (McAfee, Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [Download Protect] - C:\ProgramData\dlprotect.exe [12800 2014-01-25] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [DellSystemDetect] - C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell\Dell System Detect.appref-ms
HKCU\...\Run: [KSS] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
MountPoints2: {0ed07f4e-68e2-11e2-be65-806e6f6e6963} - "D:\SETUP.EXE"
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [1344800 2014-01-01] (Conduit)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32Loader.dll [1037600 2014-01-01] (Conduit)
Startup: C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Carolina\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dell13.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {E9019C22-93E4-4C0D-B77C-3DEFD9E83856} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS
SearchScopes: HKLM-x32 - {E9019C22-93E4-4C0D-B77C-3DEFD9E83856} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS
SearchScopes: HKCU - DefaultScope {E9019C22-93E4-4C0D-B77C-3DEFD9E83856} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {E9019C22-93E4-4C0D-B77C-3DEFD9E83856} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus
BHO: Plus-HD-3.8 - {11111111-1111-1111-1111-110311901130} - C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-bho64.dll (Plus HD)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
BHO-x32: Plus-HD-3.8 - {11111111-1111-1111-1111-110311901130} - C:\Program Files (x86)\Plus-HD-3.8\Plus-HD-3.8-bho.dll (Plus HD)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files (x86)\WOT\WOT.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM-x32 - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files (x86)\WOT\WOT.dll ()
Toolbar: HKCU - WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Handler-x32: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files (x86)\WOT\WOT.dll ()
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files\mcafee\msc\McSnIePl64.dll (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\Program Files (x86)\McAfee\msc\McSnIePl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default
FF Homepage: hxxp://www.google.com
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Plus-HD-3.8 - C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default\Extensions\c17236e8-fd66-44bc-aeef-1e00981cbb64@0a4ee0fe-5356-4fd3-b37c-5cd5671a315c.com [2014-01-25]
FF Extension: vis - C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default\Extensions\EFGLQA@78ETGYN-0W7FN789T87.COM [2014-01-25]
FF Extension: WOT - C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: Adblock Plus - C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-05-23]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-01-28]
==================== Services (Whitelisted) =================
U2 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2301216 2014-01-01] (Conduit)
U2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [125440 2014-01-25] ()
U2 fsutil64; C:\Windows\system32\KBDKURDd.exe [118784 2014-01-25] ()
U2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [138192 2011-02-07] ()
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation)
U2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202328 2012-12-07] (Kaspersky Lab ZAO)
U2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [178048 2013-11-28] (McAfee, Inc.)
U3 McAWFwk; C:\Program Files\mcafee\msc\McAWFwk.exe [332080 2012-01-26] (McAfee, Inc.)
U2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [602944 2013-08-02] (McAfee, Inc.)
U4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
U2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1025232 2013-12-11] (McAfee, Inc.)
U2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-12-05] (McAfee, Inc.)
U2 mfevtp; C:\Windows\system32\mfevtps.exe [184800 2013-12-05] (McAfee, Inc.)
U2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [328928 2013-07-30] (McAfee, Inc.)
U2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-25] ()
U2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-09-01] (Realtek Semiconductor)
U3 SandraAgentSrv; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\RpcAgentSrv.exe [72344 2008-11-25] (SiSoftware)
U2 SftService; C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe [1914728 2012-11-26] (SoftThinks SAS)
U3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
U3 ActivHidSerMini; C:\Windows\System32\drivers\activhidsermini.sys [86104 2010-05-26] (Promethean Technologies Ltd)
U0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [35496 2012-07-09] (Advanced Micro Devices, Inc.)
U3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
U3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [121728 2012-08-27] (Motorola Solutions, Inc.)
U3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [857472 2012-08-29] (Motorola Solutions, Inc.)
U3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-12-05] (McAfee, Inc.)
U1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
U3 DellRbtn; C:\Windows\System32\drivers\DellRbtn.sys [10752 2012-08-05] (OSR Open Systems Resources, Inc.)
U3 ElmoSESAME; C:\Windows\System32\drivers\ElmoSESAME.sys [28264 2012-01-20] (ELMO COMPANY, LIMITED)
U3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.)
U2 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179792 2013-12-05] (McAfee, Inc.)
U2 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311120 2013-12-05] (McAfee, Inc.)
U0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69344 2013-12-05] (McAfee, Inc.)
U3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519576 2013-12-05] (McAfee, Inc.)
U2 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [782616 2013-12-05] (McAfee, Inc.)
U3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [411944 2013-11-26] (McAfee, Inc.)
U3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96112 2013-11-26] (McAfee, Inc.)
U2 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343696 2013-12-05] (McAfee, Inc.)
U3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-10-08] (Intel Corporation)
U3 prmvmouse; C:\Windows\System32\drivers\activmouse.sys [8152 2010-05-26] (Promethean Technologies Ltd)
U3 SANDRA; C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2014.RTM\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
U3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-09-21] (Synaptics Incorporated)
U3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-09-21] (Synaptics Incorporated)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-25 18:25 - 2014-01-25 18:25 - 00020412 _____ C:\Users\Carolina\Downloads\FRST.txt
2014-01-25 18:24 - 2014-01-25 18:24 - 02077696 _____ (Farbar) C:\Users\Carolina\Downloads\FRST64.exe
2014-01-25 18:02 - 2014-01-25 18:02 - 00001302 _____ C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan.lnk
2014-01-25 18:01 - 2014-01-25 18:01 - 00001079 _____ C:\Users\Carolina\Desktop\Kaspersky Security Scan.lnk
2014-01-25 18:00 - 2014-01-25 18:00 - 00179984 _____ (Kaspersky Lab) C:\Users\Carolina\Downloads\kss12.0.1.117mlg_en-de_ru-de_fr-de_de-de.exe
2014-01-25 18:00 - 2014-01-25 18:00 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-25 18:00 - 2014-01-25 18:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-25 17:09 - 2014-01-25 17:09 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-25 17:08 - 2014-01-25 17:08 - 02347384 _____ (ESET) C:\Users\Carolina\Downloads\esetsmartinstaller_deu.exe
2014-01-25 16:10 - 2014-01-25 16:12 - 336808552 _____ C:\Users\Carolina\Desktop\Einstiegsvideo LP Caro.mp4
2014-01-25 15:17 - 2014-01-25 16:12 - 00023372 _____ C:\Users\Carolina\Desktop\Mein Film.wlmp
2014-01-25 14:47 - 2014-01-25 14:57 - 00000000 ____D C:\Users\Carolina\AppData\Local\Windows Live
2014-01-25 14:38 - 2014-01-25 14:47 - 00000000 ____D C:\Users\Carolina\Desktop\102_FUJI
2014-01-25 13:22 - 2014-01-25 13:22 - 01392671 ____N (Microsoft Corporation) C:\Windows\msvbvm60.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00331776 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2014-01-25 13:22 - 2014-01-25 13:22 - 00151622 ____N (Microsoft Corporation) C:\Windows\modcas.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00125712 ____N (Microsoft Corporation) C:\Windows\vb6de.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00101888 ____N (Microsoft Corporation) C:\Windows\odestkit.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00074240 _____ (Microsoft Corporation) C:\Windows\ODEUNST.EXE
2014-01-25 13:22 - 2014-01-25 13:22 - 00003814 _____ C:\Windows\SETUP.LST.tmp
2014-01-25 13:22 - 2014-01-25 13:22 - 00000463 _____ C:\Windows\ODEUNST.000
2014-01-25 13:22 - 2014-01-25 13:22 - 00000000 ____N C:\Windows\SysWOW64\ospfilelist.txt
2014-01-25 13:20 - 2014-01-25 13:20 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Windows Net Data
2014-01-25 13:19 - 2014-01-25 17:49 - 00002150 _____ C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job
2014-01-25 13:19 - 2014-01-25 17:49 - 00002022 _____ C:\Windows\Tasks\Plus-HD-3.8-chromeinstaller.job
2014-01-25 13:19 - 2014-01-25 17:49 - 00001352 _____ C:\Windows\Tasks\Plus-HD-3.8-updater.job
2014-01-25 13:19 - 2014-01-25 17:49 - 00001304 _____ C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job
2014-01-25 13:19 - 2014-01-25 17:49 - 00001176 _____ C:\Windows\Tasks\Plus-HD-3.8-enabler.job
2014-01-25 13:19 - 2014-01-25 13:19 - 00118784 _____ C:\Windows\system32\KBDKURDd.exe
2014-01-25 13:19 - 2014-01-25 13:19 - 00012800 _____ C:\ProgramData\dlprotect.exe
2014-01-25 13:19 - 2014-01-25 13:19 - 00004356 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-updater
2014-01-25 13:19 - 2014-01-25 13:19 - 00004308 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-codedownloader
2014-01-25 13:19 - 2014-01-25 13:19 - 00004180 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-enabler
2014-01-25 13:19 - 2014-01-25 13:19 - 00000000 ____D C:\Program Files (x86)\Plus-HD-3.8
2014-01-25 13:18 - 2014-01-25 13:18 - 00125440 _____ C:\Windows\system32\DlProtectSvc.exe
2014-01-25 13:17 - 2014-01-25 13:20 - 00000000 ____D C:\Users\Carolina\AppData\Local\DownloadGuide
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 ____D C:\Users\Carolina\AppData\Local\SearchProtect
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 _____ C:\END
2014-01-25 13:16 - 2014-01-25 13:16 - 00622920 _____ C:\Users\Carolina\Downloads\ao-Downloader.exe
2014-01-23 22:24 - 2014-01-23 22:25 - 00291056 _____ C:\Windows\Minidump\012314-22578-01.dmp
2014-01-23 22:24 - 2014-01-23 22:24 - 901549587 _____ C:\Windows\MEMORY.DMP
2014-01-23 21:58 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys
2014-01-23 17:32 - 2014-01-23 18:08 - 00000128 _____ C:\Users\Carolina\AppData\Roaming\Sandra.ldb
2014-01-23 17:32 - 2014-01-23 18:03 - 14024704 _____ C:\Users\Carolina\AppData\Roaming\Sandra.mdb
2014-01-23 17:30 - 2014-01-23 22:24 - 00001708 _____ C:\Windows\PFRO.log
2014-01-23 17:28 - 2014-01-23 17:28 - 00000000 ____D C:\Program Files\SiSoftware
2014-01-23 17:27 - 2014-01-23 17:27 - 67530368 _____ (SiSoftware ) C:\Users\Carolina\Downloads\san2010b.exe
2014-01-23 17:22 - 2014-01-25 18:09 - 00351160 _____ C:\Windows\WindowsUpdate.log
2014-01-23 17:16 - 2014-01-23 17:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Carolina\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 17:07 - 2014-01-23 17:07 - 00000000 ____D C:\Program Files\CCleaner
2014-01-23 17:02 - 2014-01-25 17:50 - 00000000 ____D C:\Users\Carolina\AppData\Local\Deployment
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\Users\Carolina\AppData\Local\Apps\2.0
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\ProgramData\Oracle
2014-01-23 17:01 - 2014-01-23 17:01 - 00431696 _____ () C:\Users\Carolina\Downloads\DellSystemDetect.exe
2014-01-23 16:57 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-01-23 16:57 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-01-23 16:57 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-01-23 16:57 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-01-23 16:56 - 2014-01-23 17:15 - 00000000 ____D C:\ProgramData\iolo
2014-01-23 16:56 - 2014-01-23 16:57 - 00005933 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-23 16:56 - 2014-01-23 16:56 - 00074703 _____ C:\Windows\SysWOW64\mfc45.dat
2014-01-23 16:56 - 2014-01-23 16:56 - 00000000 ____D C:\Program Files (x86)\iolo
2014-01-23 16:55 - 2014-01-23 16:55 - 06513608 _____ C:\Users\Carolina\Downloads\SCUDownloader.exe
2014-01-22 17:03 - 2014-01-22 17:03 - 06611641 _____ C:\Users\Carolina\Desktop\22.01.2014-AKG-Vorstellung AKG.pptx
2014-01-21 22:55 - 2014-01-21 22:55 - 00000000 ____D C:\Users\Carolina\Downloads\Lehrprobe II
2014-01-21 22:52 - 2014-01-21 22:52 - 05007246 _____ C:\Users\Carolina\Downloads\Lehrprobe II.zip
2014-01-19 11:04 - 2014-01-19 11:04 - 08808714 _____ C:\Users\Carolina\Desktop\Info GS normal.pptx
2014-01-19 11:04 - 2014-01-19 11:04 - 06419851 _____ C:\Users\Carolina\Desktop\Info 11 und 12 Klasse.pptx
2014-01-15 17:49 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-15 17:49 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 17:49 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-15 17:49 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-15 17:49 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-01-15 17:49 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2014-01-15 17:49 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2014-01-15 17:49 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2014-01-15 17:49 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-01-15 17:49 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-01-15 17:49 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-01-15 17:49 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-01-15 17:49 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-01-15 17:49 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-01-15 17:49 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-01-11 21:17 - 2014-01-23 19:37 - 00000000 ____D C:\Users\Carolina\Desktop\Lehrprobe II
2013-12-29 13:35 - 2012-07-26 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-12-26 17:32 - 2014-01-02 14:26 - 00000000 ____D C:\FRST
==================== One Month Modified Files and Folders =======
2014-01-25 18:27 - 2014-01-25 18:25 - 00020412 _____ C:\Users\Carolina\Downloads\FRST.txt
2014-01-25 18:24 - 2014-01-25 18:24 - 02077696 _____ (Farbar) C:\Users\Carolina\Downloads\FRST64.exe
2014-01-25 18:20 - 2014-01-23 17:22 - 00351160 _____ C:\Windows\WindowsUpdate.log
2014-01-25 18:02 - 2014-01-25 18:02 - 00001302 _____ C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan.lnk
2014-01-25 18:02 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\system32\sru
2014-01-25 18:01 - 2014-01-25 18:01 - 00001079 _____ C:\Users\Carolina\Desktop\Kaspersky Security Scan.lnk
2014-01-25 18:00 - 2014-01-25 18:00 - 00179984 _____ (Kaspersky Lab) C:\Users\Carolina\Downloads\kss12.0.1.117mlg_en-de_ru-de_fr-de_de-de.exe
2014-01-25 18:00 - 2014-01-25 18:00 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2014-01-25 18:00 - 2014-01-25 18:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2014-01-25 17:58 - 2013-04-05 09:16 - 01512448 ___SH C:\Users\Carolina\Desktop\Thumbs.db
2014-01-25 17:57 - 2013-01-28 02:04 - 00000000 ____D C:\Program Files (x86)\Dell Backup and Recovery
2014-01-25 17:55 - 2012-07-26 11:27 - 00754172 _____ C:\Windows\system32\perfh007.dat
2014-01-25 17:55 - 2012-07-26 11:27 - 00156362 _____ C:\Windows\system32\perfc007.dat
2014-01-25 17:55 - 2012-07-26 08:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-25 17:51 - 2013-04-03 17:21 - 00000000 ___RD C:\Users\Carolina\Dropbox
2014-01-25 17:51 - 2013-04-03 17:17 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Dropbox
2014-01-25 17:50 - 2014-01-23 17:02 - 00000000 ____D C:\Users\Carolina\AppData\Local\Deployment
2014-01-25 17:49 - 2014-01-25 13:19 - 00002150 _____ C:\Windows\Tasks\Plus-HD-3.8-firefoxinstaller.job
2014-01-25 17:49 - 2014-01-25 13:19 - 00002022 _____ C:\Windows\Tasks\Plus-HD-3.8-chromeinstaller.job
2014-01-25 17:49 - 2014-01-25 13:19 - 00001352 _____ C:\Windows\Tasks\Plus-HD-3.8-updater.job
2014-01-25 17:49 - 2014-01-25 13:19 - 00001304 _____ C:\Windows\Tasks\Plus-HD-3.8-codedownloader.job
2014-01-25 17:49 - 2014-01-25 13:19 - 00001176 _____ C:\Windows\Tasks\Plus-HD-3.8-enabler.job
2014-01-25 17:49 - 2013-12-25 16:34 - 00371960 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-25 17:49 - 2012-07-26 08:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-25 17:19 - 2013-05-23 17:40 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-25 17:09 - 2014-01-25 17:09 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-25 17:08 - 2014-01-25 17:08 - 02347384 _____ (ESET) C:\Users\Carolina\Downloads\esetsmartinstaller_deu.exe
2014-01-25 16:12 - 2014-01-25 16:10 - 336808552 _____ C:\Users\Carolina\Desktop\Einstiegsvideo LP Caro.mp4
2014-01-25 16:12 - 2014-01-25 15:17 - 00023372 _____ C:\Users\Carolina\Desktop\Mein Film.wlmp
2014-01-25 14:57 - 2014-01-25 14:47 - 00000000 ____D C:\Users\Carolina\AppData\Local\Windows Live
2014-01-25 14:47 - 2014-01-25 14:38 - 00000000 ____D C:\Users\Carolina\Desktop\102_FUJI
2014-01-25 13:23 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\Help
2014-01-25 13:22 - 2014-01-25 13:22 - 01392671 ____N (Microsoft Corporation) C:\Windows\msvbvm60.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00331776 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2014-01-25 13:22 - 2014-01-25 13:22 - 00151622 ____N (Microsoft Corporation) C:\Windows\modcas.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00125712 ____N (Microsoft Corporation) C:\Windows\vb6de.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00101888 ____N (Microsoft Corporation) C:\Windows\odestkit.dll
2014-01-25 13:22 - 2014-01-25 13:22 - 00074240 _____ (Microsoft Corporation) C:\Windows\ODEUNST.EXE
2014-01-25 13:22 - 2014-01-25 13:22 - 00003814 _____ C:\Windows\SETUP.LST.tmp
2014-01-25 13:22 - 2014-01-25 13:22 - 00000463 _____ C:\Windows\ODEUNST.000
2014-01-25 13:22 - 2014-01-25 13:22 - 00000000 ____N C:\Windows\SysWOW64\ospfilelist.txt
2014-01-25 13:22 - 2013-03-27 02:43 - 00000000 ___RD C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-25 13:22 - 2000-05-22 16:58 - 00198656 ____N (Microsoft Corporation) C:\Windows\SysWOW64\comdlg32.ocx
2014-01-25 13:20 - 2014-01-25 13:20 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Windows Net Data
2014-01-25 13:20 - 2014-01-25 13:17 - 00000000 ____D C:\Users\Carolina\AppData\Local\DownloadGuide
2014-01-25 13:19 - 2014-01-25 13:19 - 00118784 _____ C:\Windows\system32\KBDKURDd.exe
2014-01-25 13:19 - 2014-01-25 13:19 - 00012800 _____ C:\ProgramData\dlprotect.exe
2014-01-25 13:19 - 2014-01-25 13:19 - 00004356 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-updater
2014-01-25 13:19 - 2014-01-25 13:19 - 00004308 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-codedownloader
2014-01-25 13:19 - 2014-01-25 13:19 - 00004180 _____ C:\Windows\System32\Tasks\Plus-HD-3.8-enabler
2014-01-25 13:19 - 2014-01-25 13:19 - 00000000 ____D C:\Program Files (x86)\Plus-HD-3.8
2014-01-25 13:18 - 2014-01-25 13:18 - 00125440 _____ C:\Windows\system32\DlProtectSvc.exe
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 ____D C:\Users\Carolina\AppData\Local\SearchProtect
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 ____D C:\Program Files (x86)\SearchProtect
2014-01-25 13:17 - 2014-01-25 13:17 - 00000000 _____ C:\END
2014-01-25 13:16 - 2014-01-25 13:16 - 00622920 _____ C:\Users\Carolina\Downloads\ao-Downloader.exe
2014-01-25 13:09 - 2013-01-28 02:01 - 00000000 ____D C:\Program Files (x86)\McAfee
2014-01-24 06:16 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\BBI
2014-01-23 22:25 - 2014-01-23 22:24 - 00291056 _____ C:\Windows\Minidump\012314-22578-01.dmp
2014-01-23 22:24 - 2014-01-23 22:24 - 901549587 _____ C:\Windows\MEMORY.DMP
2014-01-23 22:24 - 2014-01-23 17:30 - 00001708 _____ C:\Windows\PFRO.log
2014-01-23 22:24 - 2013-03-30 03:30 - 00000000 ____D C:\Windows\Minidump
2014-01-23 21:58 - 2013-01-28 02:01 - 00000000 ____D C:\Program Files\Common Files\mcafee
2014-01-23 21:58 - 2012-07-26 09:12 - 00000000 ___HD C:\Windows\ELAMBKUP
2014-01-23 20:10 - 2013-03-27 02:41 - 00000000 ____D C:\Users\Carolina
2014-01-23 19:37 - 2014-01-11 21:17 - 00000000 ____D C:\Users\Carolina\Desktop\Lehrprobe II
2014-01-23 18:33 - 2013-03-27 02:54 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2644776866-654203345-669975328-1001
2014-01-23 18:08 - 2014-01-23 17:32 - 00000128 _____ C:\Users\Carolina\AppData\Roaming\Sandra.ldb
2014-01-23 18:03 - 2014-01-23 17:32 - 14024704 _____ C:\Users\Carolina\AppData\Roaming\Sandra.mdb
2014-01-23 17:28 - 2014-01-23 17:28 - 00000000 ____D C:\Program Files\SiSoftware
2014-01-23 17:27 - 2014-01-23 17:27 - 67530368 _____ (SiSoftware ) C:\Users\Carolina\Downloads\san2010b.exe
2014-01-23 17:17 - 2013-05-23 17:28 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 17:16 - 2014-01-23 17:16 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Carolina\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 17:15 - 2014-01-23 16:56 - 00000000 ____D C:\ProgramData\iolo
2014-01-23 17:11 - 2013-06-22 11:46 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2014-01-23 17:11 - 2013-01-28 09:29 - 00000000 ____D C:\Windows\Panther
2014-01-23 17:07 - 2014-01-23 17:07 - 00000000 ____D C:\Program Files\CCleaner
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\Users\Carolina\AppData\Local\Apps\2.0
2014-01-23 17:02 - 2014-01-23 17:02 - 00000000 ____D C:\ProgramData\Oracle
2014-01-23 17:01 - 2014-01-23 17:01 - 00431696 _____ () C:\Users\Carolina\Downloads\DellSystemDetect.exe
2014-01-23 16:57 - 2014-01-23 16:56 - 00005933 _____ C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-23 16:57 - 2013-07-07 08:10 - 00000000 ____D C:\Program Files (x86)\Java
2014-01-23 16:56 - 2014-01-23 16:56 - 00074703 _____ C:\Windows\SysWOW64\mfc45.dat
2014-01-23 16:56 - 2014-01-23 16:56 - 00000000 ____D C:\Program Files (x86)\iolo
2014-01-23 16:55 - 2014-01-23 16:55 - 06513608 _____ C:\Users\Carolina\Downloads\SCUDownloader.exe
2014-01-23 09:15 - 2013-11-10 17:13 - 00000000 ____D C:\Users\Carolina\Desktop\Lehrprobe I
2014-01-22 17:03 - 2014-01-22 17:03 - 06611641 _____ C:\Users\Carolina\Desktop\22.01.2014-AKG-Vorstellung AKG.pptx
2014-01-22 16:42 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\AUInstallAgent
2014-01-21 22:55 - 2014-01-21 22:55 - 00000000 ____D C:\Users\Carolina\Downloads\Lehrprobe II
2014-01-21 22:52 - 2014-01-21 22:52 - 05007246 _____ C:\Users\Carolina\Downloads\Lehrprobe II.zip
2014-01-21 07:31 - 2012-07-26 06:26 - 00262144 ___SH C:\Windows\system32\config\ELAM
2014-01-19 11:04 - 2014-01-19 11:04 - 08808714 _____ C:\Users\Carolina\Desktop\Info GS normal.pptx
2014-01-19 11:04 - 2014-01-19 11:04 - 06419851 _____ C:\Users\Carolina\Desktop\Info 11 und 12 Klasse.pptx
2014-01-19 10:16 - 2013-04-07 19:34 - 00000000 ____D C:\Users\Carolina\Desktop\Wochenberichte
2014-01-18 15:21 - 2013-10-03 20:48 - 00000000 ____D C:\Users\Carolina\Desktop\Unterricht 2 Halbjahr
2014-01-16 15:59 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\rescache
2014-01-16 07:44 - 2013-08-15 19:12 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 07:41 - 2013-03-29 12:27 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 07:40 - 2012-07-26 09:12 - 00000000 ____D C:\Windows\WinStore
2014-01-15 07:51 - 2013-04-06 12:36 - 00000000 ____D C:\ProgramData\CanonIJPLM
2014-01-10 21:34 - 2013-12-15 12:38 - 00000000 ____D C:\Users\Carolina\Desktop\Friseur
2014-01-10 06:38 - 2013-04-03 17:19 - 00000000 ____D C:\Users\Carolina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-09 09:02 - 2013-11-15 06:58 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-09 09:02 - 2013-11-15 06:58 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-08 16:51 - 2013-06-22 16:19 - 00000000 ____D C:\Users\Carolina\Desktop\Protokolle
2014-01-07 18:01 - 2013-03-27 11:46 - 00006178 _____ C:\Users\Carolina\ACTIVstudioError.log
2014-01-06 13:41 - 2013-10-14 16:32 - 00000000 ____D C:\Users\Carolina\Desktop\Protokoll 15, 16 17, 18
2014-01-06 12:23 - 2013-11-19 22:23 - 00000000 ____D C:\Users\Carolina\Desktop\Hausarbeit
2014-01-06 12:22 - 2013-05-31 17:26 - 00000000 ____D C:\Users\Carolina\Desktop\Wichtiges Referendariat
2014-01-06 12:21 - 2013-09-20 07:29 - 00000000 ____D C:\Users\Carolina\Desktop\Fotos
2014-01-06 12:20 - 2013-12-01 11:47 - 00000000 ____D C:\Users\Carolina\Desktop\akg
2014-01-02 14:26 - 2013-12-26 17:32 - 00000000 ____D C:\FRST
2013-12-29 20:50 - 2013-03-27 03:15 - 00000000 ____D C:\ProgramData\Microsoft Help
Files to move or delete:
====================
C:\ProgramData\dlprotect.exe
Some content of TEMP:
====================
C:\Users\Carolina\AppData\Local\Temp\nsaE32E.exe
C:\Users\Carolina\AppData\Local\Temp\nsd436.exe
C:\Users\Carolina\AppData\Local\Temp\nshAB.exe
C:\Users\Carolina\AppData\Local\Temp\nslE5DE.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-23 17:22
==================== End Of Log ============================ --- --- ---
--- --- ---
--- --- ---
--- --- ---
--- --- ---
Als Ergänzung:
Mir ist der Laptop wieder abgestürzt und dann hat er die Fehlermeldung "Kernel Data Inpage Error" angezeigt! Was heißt das? Hat dann repariert und wieder gestartet. Das Problem ist wirklich, dass ich glaube, dass der Laptop zu schnell überfordert ist!
Viele Grüße
Ich habe jetzt mal, wie ich es schon öfters bei dir gesehen habe drei Scans mit Malwarebytes, Adwarecleaner und Junkware Removal Tool gemacht! Vielleicht hilft dir das gleich weiter! DAs Problem ist, dass ich nächste Woche Lehrprobe habe und den Laptop zum Arbeiten dringendst brauche. Ich hoffe ich habe nicht zu sehr vorgegriffen.
Hier die Posts: Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2014.01.25.10
Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
Carolina :: CAROLINA [Administrator]
25.01.2014 22:50:05
mbam-log-2014-01-25 (22-50-05).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 497223
Laufzeit: 1 Stunde(n), 3 Minute(n), 50 Sekunde(n)
Infizierte Speicherprozesse: 3
C:\Users\Carolina\AppData\Local\Temp\SpeedAnalysisSetup.exe (PUP.Optional.InstallBrain) -> 6684 -> Löschen bei Neustart.
C:\Users\Carolina\AppData\Local\Temp\ibtmp6373716\SpeedtestAnalysisSetup (PUP.Optional.BesttoolBars) -> 6752 -> Löschen bei Neustart.
C:\Users\Carolina\AppData\Local\Temp\SpeedTestAnalysis\install_helper.exe (PUP.Optional.Bprotector) -> 6584 -> Löschen bei Neustart.
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 1
HKCU\Software\AppDataLow\Software\Crossrider (PUP.Optional.CrossRider.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 14
C:\Users\Carolina\AppData\Local\Temp\SpeedAnalysisSetup.exe (PUP.Optional.InstallBrain) -> Löschen bei Neustart.
C:\Users\Carolina\AppData\Local\Temp\ibtmp6373716\SpeedtestAnalysisSetup (PUP.Optional.BesttoolBars) -> Löschen bei Neustart.
C:\Users\Carolina\AppData\Local\Temp\SpeedTestAnalysis\install_helper.exe (PUP.Optional.Bprotector) -> Löschen bei Neustart.
C:\Users\Carolina\AppData\Local\DownloadGuide\SPIdentifier.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\DownloadGuide\Offers\sp-downloader.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0QY0CEGU\spstub[1].exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9LON48FG\SPIdentifierImpl[1].exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9LON48FG\SPSetup[1].exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\nsaE32E.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\nsd436.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\nshAB.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\nslE5DE.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\nszCE85.exe (PUP.Optional.SearchProtect.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Carolina\AppData\Local\Temp\~nsu.tmp\Au_.exe (PUP.Optional.Conduit.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende) Code:
# AdwCleaner v3.017 - Bericht erstellt am 26/01/2014 um 00:11:10
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 8 (64 bits)
# Benutzername : Carolina - CAROLINA
# Gestartet von : C:\Users\Carolina\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Carolina\AppData\Local\DownloadGuide
Ordner Gelöscht : C:\Users\Carolina\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserProtect
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{310D38FE-EB4C-467C-8781-B7C2AEB7847D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Softonic
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16537
-\\ Mozilla Firefox v26.0 (de)
[ Datei : C:\Users\Carolina\AppData\Roaming\Mozilla\Firefox\Profiles\rfnhoztn.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.crossrider.bic", "143c9587910a18602cef8fffaf895ad8");
*************************
AdwCleaner[R0].txt - [1967 octets] - [26/01/2014 00:07:45]
AdwCleaner[S0].txt - [1719 octets] - [26/01/2014 00:11:10]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1779 octets] ########## Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 8 x64
Ran by Carolina on 26.01.2014 at 0:16:59,55
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-2644776866-654203345-669975328-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311901130}
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Carolina\AppData\Roaming\mozilla\firefox\profiles\rfnhoztn.default\minidumps [20 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.01.2014 at 0:25:52,47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vielen Dank für deine Hilfe!!! |