Celine.P | 01.05.2015 19:08 | Viren (APPL/RedCap (Cloud), SPR/Agent.dkb, TR/Drop.Rotbrow.K.1, ADWARE/InstallCore.Gen7 und zweimal ADWARE/BHO.Bprotector.1.4). Hallo Leute
Wäre froh, ihr werft mal einen Blick auf den Scan.
Der ist vom PC meiner Schwester.
In der Avira-Quarantäne werden diverse verdächtige Dateien und Viren angezeigt
(APPL/RedCap (Cloud), SPR/Agent.dkb, TR/Drop.Rotbrow.K.1, ADWARE/InstallCore.Gen7 und zweimal ADWARE/BHO.Bprotector.1.4). Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-04-2015 01
Ran by *** (administrator) on ***B01 on 01-05-2015 18:55:42
Running from D:\Users\***\Downloads
Loaded Profiles: *** (Available profiles: CITGmbH & ***)
Platform: Windows 8 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Windows\SysWOW64\SMITSC.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Oki Data Corporation) C:\Program Files (x86)\Okidata\ActKey\Network Configuration.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Spotify Ltd) D:\Users\***\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Pokki) D:\Users\***\AppData\Local\Pokki\Engine\HostAppServiceUpdater.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Search Protect) C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NANotify.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_169.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-11-01] ()
HKLM\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-05] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] => C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Network Configuration] => C:\Program Files (x86)\Okidata\ActKey\Network Configuration.exe [723936 2011-10-20] (Oki Data Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2012-12-18] (Intel Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [TPUReg] => C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-08] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126200 2014-11-20] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [Spotify Web Helper] => D:\Users\***\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2018360 2015-04-13] (Spotify Ltd)
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [DriverFinder] => C:\Program Files (x86)\DriverFinder\DriverFinder.exe
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [iLivid] => "D:\Users\***\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [Facebook Update] => D:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-05-12] (Facebook Inc.)
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31276160 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\RunOnce: [Application Restart #1] => D:\Users\***\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-clie (the data entry has 556 more characters).
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\MountPoints2: {b51f23ce-d15f-11e4-bef0-2cd05aa56ddf} - "G:\AutoRun.exe"
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\VC64Loader.dll [233280 2014-11-10] (Search Protect)
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\VC32Loader.dll" File Not Found
Startup: D:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2014-07-20]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/de-at/?pc=UP97&ocid=UP97DHP
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=D8F42CD05AA56DDF&affID=120524&tsp=5037
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://search.conduit.com/?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SPDEA768F2-3904-4E00-8001-8CA76B7B7476&SSPV=
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=400&systemid=406&v=a12712-343&apn_uid=4205324531824015&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=400&systemid=406&v=a12712-343&apn_uid=4205324531824015&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=D8F42CD05AA56DDF&affID=120524&tsp=5037
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {3B207A8D-ABB5-4E55-9BB4-BEDF11256BFE} URL = hxxp://search.conduit.com/Results.aspx?ctid=CT3319434&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPDEA768F2-3904-4E00-8001-8CA76B7B7476&q={searchTerms}&SSPV=
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=400&systemid=406&v=a12712-343&apn_uid=4205324531824015&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {C3FC26B9-AB8F-4707-AB86-290D14AA3FAC} URL =
SearchScopes: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004 -> {F677A779-EB36-4FE6-95A9-8FF8F5AD9C5B} URL = hxxp://www.search.ask.com/web?tpid=ORJ-ST-SPE&o=APN11461&pf=V7&p2=^BE7^OSJ000^YY^AT&gct=&itbv=12.18.0.81&apn_uid=C1E79017-C7D4-40F3-A49D-395001FBFB61&apn_ptnrs=BE7&apn_dtid=^OSJ000^YY^AT&apn_dbr=ie_10.0.9200.17148&doi=2014-11-17&trgb=IE&q={searchTerms}&psv=&pt=tb
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation)
BHO: No Name -> {4F524A2D-5637-4300-76A7-7A786E7484D7} -> No File
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-02-10] (Microsoft Corporation)
BHO: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
BHO-x32: No Name -> {2977d8cc-8902-4340-be88-2c676bf96b8d} -> No File
BHO-x32: Positive Finds -> {30c85a3d-1d96-4589-b63f-91fb7ef45a41} -> C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll [2015-02-14] ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-03-01] (Oracle Corporation)
BHO-x32: af0.Adblock.BHO -> {90EFF544-3981-4d46-85C9-C0361D0931D6} -> C:\windows\SysWOW64\mscoree.dll [2012-06-02] (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
BHO-x32: delta Helper Object -> {C1AF5FA5-852C-4C90-812E-A7F75E011D87} -> C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll [2013-08-15] (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-03-01] (Oracle Corporation)
BHO-x32: No Name -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> No File
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll [2013-08-15] (Delta-search.com)
Toolbar: HKLM-x32 - No Name - {2977d8cc-8902-4340-be88-2c676bf96b8d} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation)
FireFox:
========
FF ProfilePath: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-07] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-03-01] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-03-01] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2013-10-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-09-12] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2013-09-06] (Nero AG)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: TorchVLC -> D:\Users\***\AppData\Local\Torch\Plugins\Video\VLC\npvlc.dll No File
FF Plugin HKU\S-1-5-21-1409324084-2972170921-3974530381-1004: @Skype Limited.com/Facebook Video Calling Plugin -> D:\Users\***\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF user.js: detected! => D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\user.js [2015-02-14]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\Ask.xml [2014-05-20]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\avira-safesearch.xml [2015-02-26]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\bingp.xml [2014-12-10]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\google-images.xml [2014-11-20]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\google-maps.xml [2014-11-20]
FF SearchPlugin: D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\searchplugins\trovi-search.xml [2014-05-19]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml [2014-05-20]
FF Extension: Avira Browser Safety - D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\Extensions\abs@avira.com [2015-04-27]
FF Extension: Avira SafeSearch - D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\Extensions\safesearch@avira.com [2015-04-27]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-02-14]
FF Extension: Adblock Plus - D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-04-07]
FF Extension: Positive Finds - D:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ngreqwma.default\Extensions\{f47391f8-d25a-4213-814d-d386acf92dcf}.xpi [2015-02-14]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-04-25]
Chrome:
=======
CHR HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - https://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-04-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-04-08] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-08] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-04-08] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [166192 2014-11-20] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2714800 2015-02-10] (Microsoft Corporation)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 SMITS; C:\Windows\SysWOW64\SMITSC.exe [12800 2012-11-24] () [File not signed]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116240 2013-01-04] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-13] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-13] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2013-11-19] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-03-13] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 Netaapl; C:\Windows\system32\DRIVERS\netaapl64.sys [23040 2013-07-25] (Apple Inc.) [File not signed]
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1119232 2012-06-30] (Realtek Semiconductor Corporation )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [File not signed]
S3 IntcAzAudAddService; \SystemRoot\system32\drivers\RTKVHD64.sys [X]
S3 RSUSBSTOR; \SystemRoot\System32\Drivers\RtsUStor.sys [X]
S1 ukveaofq; \??\C:\windows\system32\drivers\ukveaofq.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-01 18:55 - 2015-05-01 18:56 - 00023433 _____ () D:\Users\***\Downloads\FRST.txt
2015-05-01 18:55 - 2015-05-01 18:55 - 00000000 ____D () C:\FRST
2015-05-01 18:54 - 2015-05-01 18:54 - 02101248 _____ (Farbar) D:\Users\***\Downloads\FRST64.exe
2015-05-01 18:36 - 2015-05-01 18:36 - 00000000 _____ () D:\Users\***\AppData\Roaming\.NANotifyHere
2015-05-01 18:30 - 2015-05-01 18:30 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-05-01 18:28 - 2015-05-01 18:28 - 00000000 ____D () D:\Users\***\Downloads\CopyTransDriversInstallerDEv2.027
2015-05-01 18:26 - 2015-05-01 18:27 - 05442840 _____ () D:\Users\***\Downloads\CopyTransDriversInstallerDEv2.027.zip
2015-05-01 18:21 - 2015-05-01 18:21 - 05641904 _____ (WindSolutions) D:\Users\***\Downloads\Install_CopyTransControlCenter(1).exe
2015-04-25 22:02 - 2015-04-25 22:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-19 00:37 - 2015-04-20 20:57 - 00150528 ___SH () D:\Users\***\Desktop\Thumbs.db
2015-04-18 20:04 - 2015-03-23 07:19 - 00726528 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2015-04-18 20:04 - 2015-03-23 07:17 - 00957440 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2015-04-18 20:04 - 2015-03-23 07:17 - 00769024 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2015-04-18 20:04 - 2015-03-23 07:17 - 00419328 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2015-04-18 20:04 - 2015-03-23 07:17 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2015-04-18 20:04 - 2015-03-23 07:17 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2015-04-18 20:04 - 2015-03-23 00:04 - 01111552 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2015-04-18 20:04 - 2015-03-17 09:00 - 06971712 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-04-18 20:04 - 2015-03-17 08:52 - 01822696 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2015-04-18 20:04 - 2015-03-17 06:45 - 01409496 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2015-04-18 20:04 - 2015-02-24 09:58 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\Drivers\http.sys
2015-04-18 20:03 - 2015-03-10 07:27 - 19292672 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2015-04-18 20:03 - 2015-03-10 07:27 - 15409152 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2015-04-18 20:03 - 2015-03-10 05:49 - 14373376 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2015-04-18 20:03 - 2015-03-04 09:29 - 00361280 _____ (Microsoft Corporation) C:\windows\system32\Drivers\clfs.sys
2015-04-18 20:03 - 2015-03-04 08:39 - 00074752 _____ (Microsoft Corporation) C:\windows\system32\clfsw32.dll
2015-04-18 20:03 - 2015-03-04 06:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\clfsw32.dll
2015-04-18 20:02 - 2015-03-14 10:07 - 01120256 _____ (Microsoft Corporation) C:\windows\system32\msctf.dll
2015-04-18 20:02 - 2015-03-14 08:33 - 00891904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msctf.dll
2015-04-18 20:02 - 2015-03-10 07:28 - 02237952 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2015-04-18 20:02 - 2015-03-10 07:28 - 01409024 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2015-04-18 20:02 - 2015-03-10 07:28 - 00600576 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2015-04-18 20:02 - 2015-03-10 07:27 - 03959296 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2015-04-18 20:02 - 2015-03-10 07:27 - 00949760 _____ (Microsoft Corporation) C:\windows\system32\inetcomm.dll
2015-04-18 20:02 - 2015-03-10 07:27 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2015-04-18 20:02 - 2015-03-10 07:27 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 02864640 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 01763328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 01181696 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 00737280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcomm.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 00523776 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2015-04-18 20:02 - 2015-03-10 05:49 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2015-04-18 20:02 - 2015-03-10 05:48 - 13767680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2015-04-07 12:44 - 2015-04-07 12:44 - 01054912 _____ (Adobe) D:\Users\***\Downloads\install_flashplayer17x32au_ltr5x64d_awc_aih.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-05-01 18:46 - 2013-10-04 15:55 - 00003598 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1409324084-2972170921-3974530381-1004
2015-05-01 18:36 - 2014-04-19 13:58 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-05-01 18:36 - 2014-04-19 13:58 - 00000000 ____D () D:\Users\***\AppData\Roaming\Skype
2015-05-01 18:35 - 2014-02-19 01:33 - 00000000 ____D () D:\Users\***\AppData\Local\Pokki
2015-05-01 18:34 - 2013-10-16 14:01 - 00000374 _____ () C:\windows\Tasks\spmonitor.job
2015-05-01 18:34 - 2012-07-26 09:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-05-01 18:33 - 2013-11-17 16:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-01 18:33 - 2013-01-30 04:47 - 00250598 _____ () C:\windows\PFRO.log
2015-05-01 18:33 - 2012-07-26 07:26 - 00262144 ___SH () C:\windows\system32\config\BBI
2015-05-01 18:32 - 2013-10-03 21:31 - 01435806 _____ () C:\windows\WindowsUpdate.log
2015-05-01 18:32 - 2012-07-26 09:59 - 00000000 ____D () C:\windows\CbsTemp
2015-05-01 18:27 - 2013-10-04 15:49 - 00000000 ____D () D:\Users\***\AppData\Local\Packages
2015-05-01 18:25 - 2014-05-12 21:20 - 00000982 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004UA.job
2015-05-01 18:20 - 2013-10-09 14:20 - 00000000 ____D () D:\Users\***\AppData\Roaming\DVDVideoSoft
2015-05-01 18:00 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\system32\sru
2015-05-01 17:06 - 2013-11-17 16:22 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2015-05-01 00:42 - 2014-11-21 23:57 - 00000000 ___HD () C:\$Windows.~BT
2015-04-30 21:25 - 2014-05-12 21:20 - 00000960 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004Core.job
2015-04-29 17:43 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\AppCompat
2015-04-28 18:37 - 2013-10-04 17:02 - 00000000 ____D () D:\Users\***\AppData\Roaming\Windows Live Writer
2015-04-28 18:29 - 2015-02-15 00:13 - 00003856 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1423952009
2015-04-28 18:29 - 2015-02-14 23:57 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-04-26 22:02 - 2015-01-25 00:01 - 00000000 ____D () D:\Users\***\AppData\Roaming\TS3Client
2015-04-22 21:21 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\rescache
2015-04-21 21:43 - 2014-12-14 00:11 - 00000000 ____D () C:\windows\system32\appraiser
2015-04-21 21:43 - 2014-07-11 16:21 - 00000000 ___SD () C:\windows\system32\CompatTel
2015-04-20 20:57 - 2012-08-01 18:38 - 00753134 _____ () C:\windows\system32\perfh007.dat
2015-04-20 20:57 - 2012-08-01 18:38 - 00155826 _____ () C:\windows\system32\perfc007.dat
2015-04-20 20:57 - 2012-07-26 09:28 - 01745416 _____ () C:\windows\system32\PerfStringBackup.INI
2015-04-20 20:09 - 2013-10-04 16:21 - 00000000 ____D () C:\windows\system32\MRT
2015-04-20 20:04 - 2013-10-04 16:21 - 128913832 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-04-14 19:06 - 2013-11-17 16:22 - 00003772 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2015-04-14 03:24 - 2013-10-09 14:17 - 00000000 ____D () D:\Users\***\AppData\Local\Spotify
2015-04-14 00:07 - 2014-11-14 10:13 - 00791520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2015-04-14 00:07 - 2014-11-14 10:13 - 00177632 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-13 23:33 - 2013-10-09 14:12 - 00000000 ____D () D:\Users\***\AppData\Roaming\Spotify
2015-04-08 18:52 - 2013-10-04 15:55 - 00000000 ____D () D:\Users\***\AppData\Roaming\Avira
2015-04-08 18:12 - 2014-02-19 01:33 - 00002302 _____ () D:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-04-08 15:59 - 2013-01-29 19:59 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-04-07 02:16 - 2012-07-26 10:12 - 00000000 ____D () C:\windows\WinStore
==================== Files in the root of some directories =======
2015-05-01 18:36 - 2015-05-01 18:36 - 0000000 _____ () D:\Users\***
\AppData\Roaming\.NANotifyHere
2013-12-19 15:00 - 2013-12-19 15:00 - 0000027 _____ () D:\Users\***\AppData\Roaming\WB.CFG
Some content of TEMP:
====================
D:\Users\***\AppData\Local\Temp\APNSetup.exe
D:\Users\***\AppData\Local\Temp\AutoRun.exe
D:\Users\***\AppData\Local\Temp\AutoRunGUI.dll
D:\Users\***\AppData\Local\Temp\avgnt.exe
D:\Users\***\AppData\Local\Temp\EAInstall.dll
D:\Users\***\AppData\Local\Temp\eauninstall.exe
D:\Users\***\AppData\Local\Temp\FreeYouTubeToMP3Converter.exe
D:\Users\***\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
D:\Users\***\AppData\Local\Temp\jre-8u31-windows-au.exe
D:\Users\***\AppData\Local\Temp\oct5713.tmp.exe
D:\Users\***\AppData\Local\Temp\oct78D0.tmp.exe
D:\Users\***\AppData\Local\Temp\oct8954.tmp.exe
D:\Users\***\AppData\Local\Temp\octB1A1.tmp.exe
D:\Users\***\AppData\Local\Temp\octB830.tmp.exe
D:\Users\***\AppData\Local\Temp\octC220.tmp.exe
D:\Users\***\AppData\Local\Temp\octCD5F.tmp.exe
D:\Users\***\AppData\Local\Temp\octD631.tmp.exe
D:\Users\***\AppData\Local\Temp\octF344.tmp.exe
D:\Users\***\AppData\Local\Temp\Setup.exe
D:\Users\***\AppData\Local\Temp\SkypeSetup.exe
D:\Users\***\AppData\Local\Temp\SPSetup.exe
D:\Users\***\AppData\Local\Temp\The Sims Castaway Stories_uninst.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-26 20:35
==================== End Of Log ============================ Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-04-2015 01
Ran by *** at 2015-05-01 18:56:47
Running from D:\Users\***\Downloads
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-1409324084-2972170921-3974530381-500 - Administrator - Disabled)
*** (S-1-5-21-1409324084-2972170921-3974530381-1004 - Administrator - Enabled) => D:\Users\***
CITGmbH (S-1-5-21-1409324084-2972170921-3974530381-1001 - Administrator - Enabled) => C:\Users\CITGmbH
Gast (S-1-5-21-1409324084-2972170921-3974530381-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1409324084-2972170921-3974530381-1003 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
ActKey (x32 Version: 1.3.0.1 - Ihr Firmenname) Hidden
AdblockIE (HKLM-x32\...\{5508128A-2C7B-46B5-81F9-58E8E8115F0B}) (Version: 1.2 - af0.net)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.8.0.1430 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.1.629 - Adobe Systems, Inc.)
Age of Empires III - The Asian Dynasties (HKLM-x32\...\InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The Asian Dynasties (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III - The WarChiefs (HKLM-x32\...\InstallShield_{1C08A24C-B168-407E-A826-68FAF5F20710}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III - The WarChiefs (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
Age of Empires III (HKLM-x32\...\InstallShield_{70F8B183-99EB-4304-BA35-080E2DFFD2A3}) (Version: 1.00.0000 - Microsoft Game Studios)
Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden
AMD Catalyst Install Manager (HKLM\...\{95EF3DDB-27C8-CDA9-9E72-5EC3F02C1B02}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Atheros)
Avira (HKLM-x32\...\{e7c7c227-b742-4878-9425-f09bbf9951db}) (Version: 1.1.27.25527 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.27.25527 - Avira Operations & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
Buzzdock (HKLM-x32\...\{cfd32d46-7d3f-483f-bace-7172aec5592d}) (Version: - Alactro LLC) <==== ATTENTION
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Fiesta Online DE 1.04.136 (HKLM-x32\...\Fiesta Online DE) (Version: 1.04.136 - Gamigo games)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 41663) (Version: 3.8.0.41663.61 - Intel)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.5.2.1001 - Intel Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4701.1002 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\SkyDriveSetup.exe) (Version: 16.4.6012.0828 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Nero Multimedia Suite 12 Suite S (HKLM-x32\...\{0F0F8B5B-BAFA-43FC-9CCE-75FB503301BB}) (Version: 12.0.00500 - Nero AG)
Nero Prerequisite Installer 2.0 (HKLM-x32\...\{0DBC021C-95D9-435A-A4B0-E6515AFD1A71}) (Version: 12.0.01000 - Nero AG)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4701.1002 - Microsoft Corporation) Hidden
OKI ActKey (HKLM-x32\...\InstallShield_{681B82EF-A457-4849-AABC-5B6099380FA5}) (Version: 1.3.0.1 - Ihr Firmenname)
OKI Color Correct Utility (HKLM-x32\...\{5D729200-F340-4A74-A1E9-32387CDC63EF}) (Version: 2.17.1 - Okidata)
OKI Color Swatch-Dienstprogramm (HKLM-x32\...\{A344F95E-E51A-450C-8F84-C940BF61903E}) (Version: 2.1.11 - Okidata)
OKI MC5(3)x2/ES5(3)4x2 Scanner (HKLM-x32\...\InstallShield_{14915907-DB64-49DC-BB9D-1935D38CD250}) (Version: 1.0.0.2 - Oki Data Corporation)
Opera Stable 29.0.1795.47 (HKLM-x32\...\Opera 29.0.1795.47) (Version: 29.0.1795.47 - Opera Software ASA)
Pokki (HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Pokki) (Version: 0.269.7.573 - Pokki)
Positive Finds (HKLM-x32\...\Positive Finds) (Version: 2.0.5523.987 - Positive Finds) <==== ATTENTION!
Premium Sound HD (HKLM\...\{000A208E-1050-4181-AC37-E13DA9254B73}) (Version: 1.12.6000 - DTS, Inc.)
Prerequisite installer (x32 Version: 12.0.0003 - Nero AG) Hidden
ScannerDriver (Version: 1.0.0.2 - Oki Data Corporation) Hidden
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.5.1333.g822e0de8 - Spotify AB)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Tomb Raider: Legend 1.0 (HKLM-x32\...\Tomb Raider: Legend) (Version: - )
Torch (HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\...\Torch) (Version: 29.0.0.6292 - Torch) <==== ATTENTION
TOSHIBA Blu-ray Disc Player (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 1.0.5.77 - Toshiba Corporation)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.00.6626.6410 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{78931270-BC9E-441A-A52B-73ECD4ACFAB5}) (Version: 2.00.973 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (HKLM\...\{B8C8422F-01F1-4791-B084-047AAFF9BFCC}) (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.3.3 - Toshiba Europe GmbH)
VideoPlayer v2.0.6 (HKLM-x32\...\VideoPlayer) (Version: v2.0.6 - TUGUU SL) <==== ATTENTION
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> D:\Users\***\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> D:\Users\***\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> D:\Users\***\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1409324084-2972170921-3974530381-1004_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> D:\Users\***\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
11-04-2015 18:58:59 Windows Update
18-04-2015 19:45:42 Windows Update
20-04-2015 17:44:40 Windows Modules Installer
23-04-2015 20:31:55 Windows Update
25-04-2015 19:18:25 Windows Modules Installer
27-04-2015 19:53:59 Windows Modules Installer
30-04-2015 16:25:36 Windows Modules Installer
01-05-2015 18:29:12 Removed Apple Mobile Device Support
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0400D230-1547-4112-B7BD-99946006FC69} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {4626C78C-C748-4E5F-BBEE-AF8A7A1CD8BB} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {62A4DDD7-7315-44BC-A3E1-7DFB5C15173A} - System32\Tasks\DealPly => D:\Users\***<==== ATTENTION
Task: {64B9E074-0B81-47A5-93CB-EDABC32434CC} - System32\Tasks\Opera scheduled Autoupdate 1423952009 => C:\Program Files (x86)\Opera\launcher.exe [2015-04-17] (Opera Software)
Task: {93E19505-AE18-4A38-8C98-4AC76042DB92} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-02-10] (Microsoft Corporation)
Task: {9870099B-3084-4CB9-B6D3-0C1D390DF800} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {A0230719-F1BE-4BB0-9551-31BA06F2904A} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-01-04] (Toshiba Europe GmbH)
Task: {A4E25206-DC79-47E2-ABEA-B12ADBE93F77} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {A8AAEC6F-4D78-4E34-A184-5A56322E25EB} - System32\Tasks\{A02E6E8E-B7BC-43AA-B108-16D24C59686E} => pcalua.exe -a F:\Autorun.exe -d F:\
Task: {B7C8ABB9-4051-4CD8-830D-C54A086EB8E1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004Core => D:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-12] (Facebook Inc.)
Task: {C6DB821B-60B8-404E-8636-B018FCA56953} - System32\Tasks\spmonitor => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe <==== ATTENTION
Task: {E150B8BE-5922-456C-9D00-0CC71CB4F9D7} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-12-17] (Oracle Corporation)
Task: {FB4252C0-952F-4320-B231-F0C7D78E7549} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\windows\system32\MRT.exe [2015-04-20] (Microsoft Corporation)
Task: {FBD44CE2-6757-401B-9C3F-A1BC1AEB84E0} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {FFACBF2A-2FE8-4BEB-82BA-F6D16F12F7A1} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004UA => D:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-05-12] (Facebook Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004Core.job => D:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1409324084-2972170921-3974530381-1004UA.job => D:\Users\***\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\spmonitor.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe <==== ATTENTION
==================== Loaded Modules (whitelisted) ==============
2011-10-13 22:38 - 2011-10-13 22:38 - 00156672 _____ () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
2014-03-12 16:16 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2012-11-24 02:06 - 2012-11-24 02:06 - 00012800 _____ () C:\Windows\SysWOW64\SMITSC.exe
2012-11-01 00:15 - 2012-11-01 00:15 - 02565544 _____ () C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
2012-07-19 03:38 - 2012-07-19 03:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 03:38 - 2012-07-19 03:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 04:13 - 2012-08-14 04:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-08-08 19:22 - 2012-08-08 19:22 - 00369664 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-11-22 20:16 - 2014-11-22 20:16 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2013-04-10 09:43 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, the associated entry will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1409324084-2972170921-3974530381-1004\Control Panel\Desktop\\Wallpaper -> D:\Users\***\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
DNS Servers: 192.168.1.254 - 213.33.99.70
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "Adobe ARM"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "iTunesHelper"
==================== FirewallRules (whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{77B6848B-26AF-457B-BD7C-24FF418313EC}] => (Allow) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe
FirewallRules: [{0761410D-9026-4420-921B-A63355D8FE85}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{B8AA07B2-2CBC-467B-A497-39A431F4C47F}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{38A09E30-9992-48E3-9D3C-0B4823C81CF1}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{73318B95-F320-4C04-8AA8-77A924187945}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{B086EEF7-45F7-4936-81EA-268CBF9BE628}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{97A92FA6-61D4-4B40-A563-39A7A8F58FCE}] => (Allow) C:\Program Files (x86)\Nero\Nero Blu-ray Player\Blu-rayPlayer.exe
FirewallRules: [{11943D6A-43DC-4C04-B67A-DB0D708B0252}] => (Allow) C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{C745A7F2-1642-4FF0-A60F-27A72C1CA77C}] => (Allow) C:\Program Files (x86)\Nero\KM\NMDllHost.exe
FirewallRules: [{E7728B49-B74D-4171-AFD0-E97DE009CAA5}] => (Allow) C:\Users\CITGmbH\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{A4F99500-57C9-4757-B828-5A6F3E051C0A}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{8515E100-D268-428C-83F5-A20090DC43C6}] => (Allow) LPort=2869
FirewallRules: [{800FCB21-DEA8-4028-838C-B14530EAE63D}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{A9DC6B38-6F8A-4142-AA4C-95ADECE5E762}D:\users\***\appdata\roaming\spotify\spotify.exe] => (Allow) D:\users\***\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{A0ABCBCE-535D-4A31-9E88-27344B9E9838}D:\users\***\appdata\roaming\spotify\spotify.exe] => (Allow) D:\users\***\appdata\roaming\spotify\spotify.exe
FirewallRules: [{376339F7-1A75-4EF2-A84F-8835FB4D38E1}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{894F9FA3-F618-4866-A933-65EDD90696F3}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3.exe
FirewallRules: [{D6574A99-F6D5-4E62-B9B7-11A387039A4B}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{1260B078-0AD4-433B-8C63-950EBC6755E8}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3x.exe
FirewallRules: [{CC875FB3-F6F2-4AC5-BD30-D0DA334653B6}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{66245BBD-006F-4C99-9B21-A1C0563D800E}] => (Allow) C:\Program Files (x86)\Microsoft Games\Age of Empires III\age3y.exe
FirewallRules: [{88094DC9-1C62-4F20-8C06-465CA2DABDD3}] => (Allow) C:\Program Files (x86)\Okidata\ActKey\Network Configuration.exe
FirewallRules: [{0E1C12C8-1B5F-4D39-9365-02A2879E6D5B}] => (Allow) C:\Program Files (x86)\Okidata\ActKey\Network Configuration.exe
FirewallRules: [TCP Query User{135F68B3-CB94-4D80-BAE1-634834238D3B}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [UDP Query User{432E8A9F-8114-4311-96BC-ACA40D95C5AC}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe
FirewallRules: [{034AF0AE-3B8A-459B-99D2-D99E47DDFFA2}] => (Allow) C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtuser.exe
FirewallRules: [{CEB37E2B-6570-4EC1-9E38-5ED94CBBF896}] => (Allow) C:\Program Files (x86)\Movies Toolbar\Datamngr\SRTOOL~1\IE\dtuser.exe
FirewallRules: [{E3012B15-DE8B-407A-A29C-180C4AE17D0A}] => (Allow) D:\Users\***\AppData\Local\Torch\Application\torch.exe
FirewallRules: [{032D6A35-F7AA-401E-A45B-8712A0D4F3C7}] => (Allow) D:\Users\***\AppData\Local\Torch\Plugins\Hola\hola_plugin.exe
FirewallRules: [{06D9AE33-8497-49C6-B147-40E454EA12B1}] => (Allow) D:\Users\***\AppData\Local\Torch\Plugins\Hola\hola_plugin_x64.exe
FirewallRules: [{7675646E-14B6-4F34-A9F5-7695314D2277}] => (Allow) D:\Users\***\AppData\Local\Facebook\Video\Skype\FacebookVideoCalling.exe
FirewallRules: [{9FBE1207-BF54-4FD8-8F31-2A8699D8A518}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{FDE40A08-CF46-4ADD-B6AA-8A68516DA82E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{99286509-594E-4556-8ED8-EC406025F180}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{F368DAA2-1B41-4946-BFE9-019676D54EB1}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{B934C4D4-D222-4B45-A48C-B518FD8B9EF1}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{A3DF8F0C-AA62-4C84-AD0E-53C9BCD81D42}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (05/01/2015 06:35:26 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (05/01/2015 06:35:14 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (05/01/2015 06:35:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.27.25537, Zeitstempel: 0x546de872
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16864, Zeitstempel: 0x531d2be6
Ausnahmecode: 0xe0434352
Fehleroffset: 0x00010f22
ID des fehlerhaften Prozesses: 0xd7c
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3
Vollständiger Name des fehlerhaften Pakets: Avira.OE.Systray.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Avira.OE.Systray.exe5
Error: (05/01/2015 06:35:01 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
bei System.Configuration.ConfigurationManager.get_AppSettings()
bei Avira.OE.WinCore.OeProductInfo.get_Culture()
bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
bei Avira.OE.Systray.Program.Main(System.String[])
Error: (05/01/2015 06:34:58 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/30/2015 04:31:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Bei der Aktivierung der App „Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/30/2015 04:31:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Bei der Aktivierung der App „Microsoft.BingWeather_8wekyb3d8bbwe!App“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Bei der Aktivierung der App „Microsoft.BingNews_8wekyb3d8bbwe!AppexNews“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Bei der Aktivierung der App „Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Bei der Aktivierung der App „Microsoft.BingSports_8wekyb3d8bbwe!AppexSports“ ist folgender Fehler aufgetreten: -2144927142. Weitere Informationen finden Sie im Protokoll „Microsoft-Windows-TWinUI/Betriebsbereit“.
System errors:
=============
Error: (05/01/2015 06:35:26 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
Error: (05/01/2015 06:35:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/01/2015 06:35:01 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Service Host" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (05/01/2015 06:34:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (05/01/2015 06:34:16 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.
Error: (05/01/2015 06:33:46 PM) (Source: BTHUSB) (EventID: 5) (User: )
Description: Der Bluetooth-Treiber hat ein HCI-Ereignis mit einer bestimmten Größe erwartet, das aber nicht empfangen wurde.
Error: (05/01/2015 06:32:45 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070003 fehlgeschlagen: Sicherheitsupdate für Windows 8 für x64-basierte Systeme (KB2973201)
Error: (05/01/2015 06:32:31 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070003 fehlgeschlagen: Update für Windows 8 für x64-Systeme (KB3025417)
Error: (05/01/2015 06:31:28 PM) (Source: DCOM) (EventID: 10010) (User: ***NB01)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (05/01/2015 06:31:28 PM) (Source: DCOM) (EventID: 10010) (User: ***NB01)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Microsoft Office Sessions:
=========================
Error: (05/01/2015 06:35:26 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (05/01/2015 06:35:14 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (05/01/2015 06:35:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.27.25537546de872KERNELBASE.dll6.2.9200.16864531d2be6e043435200010f22d7c01d0842cbafbc204C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exeC:\windows\SYSTEM32\KERNELBASE.dll02f29de6-f020-11e4-bef7-2cd05aa56ddf
Error: (05/01/2015 06:35:01 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.Systray.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.Configuration.ConfigurationErrorsException
Stapel:
bei System.Configuration.BaseConfigurationRecord.GetSectionRecursive(System.String, Boolean, Boolean, Boolean, Boolean, System.Object ByRef, System.Object ByRef)
bei System.Configuration.BaseConfigurationRecord.GetSection(System.String)
bei System.Configuration.ClientConfigurationSystem.System.Configuration.Internal.IInternalConfigSystem.GetSection(System.String)
bei System.Configuration.ConfigurationManager.get_AppSettings()
bei Avira.OE.WinCore.OeProductInfo.get_Culture()
bei Avira.OE.WinCore.Utility.CultureSetter.SetDefaultCultureDefinedInAppsettings()
bei Avira.OE.Systray.Program.Main(System.String[])
Error: (05/01/2015 06:34:58 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Anwendung: Avira.OE.ServiceHost.exe
Frameworkversion: v4.0.30319
Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet.
Ausnahmeinformationen: System.TypeInitializationException
Stapel:
bei NLog.Common.InternalLogger.Debug(System.String, System.Object[])
bei NLog.LogFactory.get_Configuration()
bei NLog.LogFactory.GetLogger(LoggerCacheKey)
bei NLog.LogFactory.GetLogger(System.String)
bei NLog.LogManager.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetLogger(System.String)
bei Avira.OE.WinCore.Utility.LoggerFacade.GetCurrentClassLogger()
bei Avira.OE.WinCore.Lazy`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].get_Value()
bei Avira.OE.ServiceHost.ServiceHost.SetDefaultCulture()
bei Avira.OE.ServiceHost.ServiceHost.Initialize(System.Object)
bei System.Threading.QueueUserWorkItemCallback.WaitCallback_Context(System.Object)
bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
bei System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
bei System.Threading.ThreadPoolWorkQueue.Dispatch()
bei System.Threading._ThreadPoolWaitCallback.PerformWaitCallback()
Error: (04/30/2015 04:31:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Microsoft.BingTravel_8wekyb3d8bbwe!AppexTravel-2144927142
Error: (04/30/2015 04:31:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Microsoft.BingWeather_8wekyb3d8bbwe!App-2144927142
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Microsoft.BingNews_8wekyb3d8bbwe!AppexNews-2144927142
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Microsoft.BingFinance_8wekyb3d8bbwe!AppexFinance-2144927142
Error: (04/30/2015 04:31:23 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: ***NB01)
Description: Microsoft.BingSports_8wekyb3d8bbwe!AppexSports-2144927142
CodeIntegrity Errors:
===================================
Date: 2015-04-04 15:01:36.243
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:35.993
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:35.728
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:35.384
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:35.165
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:35.009
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:34.681
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:34.525
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:34.037
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
Date: 2015-04-04 15:01:33.983
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Windows\System32\msiltcfg.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz
Percentage of memory in use: 29%
Total physical RAM: 8143.22 MB
Available physical RAM: 5778.89 MB
Total Pagefile: 9359.22 MB
Available Pagefile: 6879.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:461.45 GB) (Free:399.89 GB) NTFS
Drive d: (Daten) (Fixed) (Total:458.78 GB) (Free:417.4 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End Of Log ============================ |