Trojaner-Board - Zäh; seltsame Prozesse;

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Zäh; seltsame Prozesse; (https://www.trojaner-board.de/170273-zaeh-seltsame-prozesse.html)

Zäh; seltsame Prozesse;

Hallo liebe Helfer!

Ich habe wieder einmal einen Patienten, der sich sehr merkwürdig verhält.

Es geht um ein HP ProBook 4730s. 4 GB Arbeitsspeicher, i5-2450M (2,5 GHz) und Windows 7 SP1.
Bekommen habe ich das Notebook, wegen „Pop-up Problemen“. Gut, dachte ich mir, AdwCleaner dürfte das schon hinbekommen. Ich starte den PC und es dauert gefühlt eine Stunde bis ich AdwCleaner gestartet bekomme. Im Hintergrund laufen diverse Prozesse (unter anderem TrustedInstaller) die sich großzügig am Arbeitsspeicher bedienen.

Hier die Ergebnisse von AdwCleaner:

Code:

# AdwCleaner v5.003 - Bericht erstellt 25/08/2015 um 17:54:53

# Aktualisiert 20/08/2015 von Xplode

# Datenbank : 2015-08-23.3 [Server]

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)

# Benutzername : Karner - KARNER-HP

# Gestarted von : C:\Users\Karner\Desktop\adwcleaner_5.003.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[-] Dienst Gelöscht : LPTSystemUpdater

[-] Dienst Gelöscht : {55dce8ba-9dec-4013-937e-adbf9317d990}Gw64

[-] Dienst Gelöscht : {55dce8ba-9dec-4013-937e-adbf9317d990}w64
 

***** [ Ordner ] *****
 

[-] Ordner Gelöscht : C:\Program Files (x86)\Astromenda

[-] Ordner Gelöscht : C:\Program Files (x86)\LPT

[-] Ordner Gelöscht : C:\ProgramData\Babylon

[-] Ordner Gelöscht : C:\ProgramData\DealPlyLive

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\DealPlyLive

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\LPT

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\PackageAware

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\Smartbar

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejnmnhkgiphcaeefbaooconkceehicfi

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\iblenkmcolcdonmlfknbpbgjebabcoae

[-] Ordner Gelöscht : C:\Users\Karner\AppData\LocalLow\BabylonToolbar

[-] Ordner Gelöscht : C:\Users\Karner\AppData\LocalLow\Smartbar

[-] Ordner Gelöscht : C:\Users\Karner\AppData\LocalLow\Softonic

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\Astromenda

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\Babylon

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\DealPly

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\dvdvideosoftiehelpers

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\OpenCandy

[-] Ordner Gelöscht : C:\Users\Karner\AppData\Roaming\RHEng
 

***** [ Dateien ] *****
 

[-] Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\user.js

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ejnmnhkgiphcaeefbaooconkceehicfi_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_iblenkmcolcdonmlfknbpbgjebabcoae_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\bprotector web data

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.boostsaves.com_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_static.boostsaves.com_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_deutsch.babylon.com_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_primeshare.tv_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_primeshare.tv_0.localstorage-journal

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.movshare.net_0.localstorage

[-] Datei Gelöscht : C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.movshare.net_0.localstorage-journal

[-] Datei Gelöscht : C:\Users\Karner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Start Menu\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\Favorites\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\Favorites\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\Favorites\Links\Startfenster.lnk

[-] Datei Gelöscht : C:\Users\Karner\Favorites\Links\Startfenster.lnk
 

***** [ Verknüpfungen ] *****
 

[-] Verknüpfung Desinfiziert : C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
 

***** [ Geplante Tasks ] *****
 

[-] Task Gelöscht : Astromenda

[-] Task Gelöscht : Dealply
 

***** [ Registrierungsdatenbank ] *****
 

[-] Schlüssel Gelöscht : HKCU\Software\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

[-] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page]

[-] Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bho

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe

[-] Schlüssel Gelöscht : HKCU\Software\53538f88b168ed49

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\53538f88b168ed49

[-] Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{b64d9b05-48e1-4ceb-bf58-e0643994e900}]

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9CB2CD61-FFA0-406C-9D2D-8FDE6F4A4D8A}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

[-] Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}

[-] Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}

[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}

[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

[-] Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2E00D31D-D171-423D-836D-1A4D7EA7F1A9}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EC29EDF6-AD3C-4E1C-A087-D6CB81400C43}

[-] Schlüssel Gelöscht : HKCU\Software\Astromenda

[-] Schlüssel Gelöscht : HKCU\Software\DataMngr

[-] Schlüssel Gelöscht : HKCU\Software\DealPlyLive

[-] Schlüssel Gelöscht : HKCU\Software\InstallCore

[-] Schlüssel Gelöscht : HKCU\Software\smartbarbackup

[-] Schlüssel Gelöscht : HKCU\Software\smartbarlog

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\InstallCore

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue

[!] Schlüssel Nicht Gelöscht : HKLM\SOFTWARE\Uniblue\DriverScanner

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BC0BF363-63AB-4FF7-8EF1-AE0D7F711B24}

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Astromenda

[-] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{877D0E59-6CBD-43C6-966F-1F4BA343AEEC}

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\Astromenda

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\DataMngr

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\DealPlyLive

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\InstallCore

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\smartbarbackup

[!] Schlüssel Nicht Gelöscht : [x64] HKCU\Software\smartbarlog

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3152E1F19977892449DC968802CE8964

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467

[-] Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

[!] Schlüssel Nicht Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dealplylive.exe

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page]

[!] Daten Nicht Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [bProtector Start Page]

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar]

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

[-] Daten Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Daten Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main [Start Page]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main [Search Page]

[!] Daten Nicht Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main [bProtector Start Page]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main [Search Bar]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Search [Default_Search_URL]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Search [SearchAssistant]

[-] Daten Wiederhergestellt : HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\SearchUrl [Default]
 

***** [ Internetbrowser ] *****
 

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : softonic

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : babylon.com

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : suchmaschine

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : search.yahoo.com

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Web Data] [Search Provider] Gelöscht : astromenda.com

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Default_Search_Provider_Data] Gelöscht : 

[-] [C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Gelöscht : hxxp://www.google.at/","hxxp://astromenda.com/?f=7&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=
 

*************************
 

:: Proxy Einstellungen zurückgesetzt

:: Winsock Einstellungen zurückgesetzt
 

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [16441 Bytes] ##########

Da das Problem aber immer noch nicht ganz behoben ist, starte ich desinfec’t 2015, aktualisiere alle Signaturen und lasse Avira und Bitdefender darüber laufen. Die beiden hab auch einiges gefunden, was ich im Anschluss einfach unbenannt habe. Die Logdateien sind aber jeweils 37 und 114 MB groß, ich weiß nicht, ob sich die etwas bringen. Nur die Ergebnisse habe ich aber auch als HTML oder CSV Datei.

Ergebnisse von desinfec't (Avira und Bitdefender):

Code:

"Infizierte Datei";"ggf. Datei in Archiv";"Fund durch Avira";"Fund durch Bitdefender";"";"";

"";"";"";"";"";"";

"/media/AC8EAA9A8EAA5D18/Windows/System32/drivers/{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys";"";"Adware/BrowseFox.aoo";"Adware.NetFilter.E";"";"";

"/media/AC8EAA9A8EAA5D18/Windows/System32/drivers/{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys";"";"Adware/BrowseFox.aoo";"Adware.NetFilter.E";"";"";

"/media/AC8EAA9A8EAA5D18/Windows/Installer/192b3a.msi";"(Embedded EXE)";"";"Application.Generic.1203650";"";"";

"/media/AC8EAA9A8EAA5D18/Windows/assembly/GAC_MSIL/Interop.shdocvw/1.1.0.0__84542ff99aed6a4d/Interop.SHDocVw.dll";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/a03a468270c26061.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/0cd263d4f589b7e8.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/11d043a38f0a5528.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/1da46745a83ec848.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/33bb9c1ca4b185fe.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/4bc6283ba5b30637.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/556fa627b8588dd4.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/7e1a05c137d1d72b.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/8510ac78864000da.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/99d0efca697fc875.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/bd54e549b46541f0.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/cb01d97f2c4fc254.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/cc5c24cc5948c238.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/d0b4e087e4ec14ea.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/d3351d26e8bb528a.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/dd5720c3cd3dd785.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/f05c3796331755cc.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/ProgramData/Kaspersky Lab/AVP15.0.0/QB/f68ea2da4c5d723e.klq";"(Quarantine-6)";"";"Gen:Variant.Adware.Linkury.1";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Roaming/OpenCandy/66639C8978244FF2BE858945E601D823/Installer.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.AdvancedExeLauncherPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.CustomControl.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.DMP.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.SafeMode.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.WordPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Common/ServicesPlugins/spup.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/BrowserHelper.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/ChromeHost.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Interop.SHDocVw.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Interop.WMPLib.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Lrcnta.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/lrrot.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/MACTrackBarLib.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/NDde.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Newtonsoft.Json.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/PIFlagsManager.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/PILogger.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/PILogManager.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Proxy.Lib.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/ProxySettings.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SafeFinder.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sgml.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sgmu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/lrcnt.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/ProductsRemovalTool.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sidb.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.BusinessEntities.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sppsm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srns.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/siem.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sipb.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sismlp.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Communication.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Communication.NamedPipe.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.GUI.Controls.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.GUI.Docking.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.GUI.MainClient.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.Core.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Infrastructure.Utilities.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Monetization.Proxy.ProxyService.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Personalization.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Resources.HistoryAndStatsWrapper.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Resources.LanguageSettings.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Resources.SocialNetsSharer.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/Smartbar.Resources.Translations.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SmartbarInternetExplorerBHO.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SmartbarInternetExplorerBHO2.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SmartbarInternetExplorerExtension.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SmartbarInternetExplorerExtension2.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/SmartbarVersionsHelper.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/smsp.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/smta.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/smti.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/smtu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/spbe.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/spbl.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/spsm.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/spusm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srau.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srbhu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srbs.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srbu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sreu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srgu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srom.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srpdm.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srprl.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srpu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srsbs.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srsbsau.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srsl.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/sruhs.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srus.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/srut.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/tr/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/ru/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/pt/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/nl/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/it/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_25.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_26.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_27.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_28.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_29.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/helperbar@helperbar.com/components/SmartbarFireFoxRemotePlugin_30.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/he/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/fr/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/es/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/de/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/ar/Smartbar.Resources.LanguageSettings.resources.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/amfclgbdpgndipgoegfpkkgobahigbcl/GoogleChromeRemotePlugin.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/smia.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/linmsl.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/LPTInstaller.msi.vir";"(Embedded CAB)";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/LPTInstaller.msi.vir";"(Embedded EXE)";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/lrrot.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Newtonsoft.Json.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Proxy.Lib.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/ProxySettings.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Communication.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Communication.NamedPipe.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Infrastructure.Utilities.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Monetization.Proxy.ProxyRemover.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Monetization.Proxy.ProxyService.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Personalization.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Smartbar.Resources.HistoryAndStatsWrapper.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/sppsm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/spusm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srbs.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srbu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/sreu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srpdm.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srprl.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srpt.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srptc.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srptm.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srptsl.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/srut.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Resources/crdli.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Resources/ntdis_32.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/LPT/Resources/ntdis_64.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/smia.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/linmsl.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/LPTInstaller.msi.vir";"(Embedded CAB)";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/LPTInstaller.msi.vir";"(Embedded EXE)";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/lrrot.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Newtonsoft.Json.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Proxy.Lib.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/ProxySettings.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Communication.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Communication.NamedPipe.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Infrastructure.Utilities.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Monetization.Proxy.ProxyRemover.exe.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Monetization.Proxy.ProxyService.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Personalization.Common.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Smartbar.Resources.HistoryAndStatsWrapper.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/sppsm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/spusm.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srbs.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srbu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/sreu.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srpdm.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srprl.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srpt.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srptc.dll.vir";"";"PUA/Linkury.Gen2";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srptm.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srpts.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srptsl.exe.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/srut.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Resources/crdli.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Resources/ntdis_32.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Program Files (x86)/LPT/Resources/ntdis_64.dll.vir";"";"";"Adware.Linkury.B";"";"";

"/media/AC8EAA9A8EAA5D18/Users/Karner/Downloads/Malavida_Download_Manager.exe";"";"PUA/InstallCore.PL.2";"";"";"";

"/media/AC8EAA9A8EAA5D18/Users/Karner/Downloads/FreeYouTubeToiPhoneConverter-2.12.9.725.exe";"";"Adware/OpenCandy.AJ.5";"";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Local/Smartbar/Application/amfclgbdpgndipgoegfpkkgobahigbcl/manifest.json.vir";"";"PUA/Linkury.JH";"";"";"";

"/media/AC8EAA9A8EAA5D18/AdwCleaner/Quarantine/C/Users/Karner/AppData/Roaming/OpenCandy/CFE76A6419E840E3A24C91EA7F9ABCEB/dp.exe.vir";"";"ADWARE/DealPly.Gen4";"";"";"";

Das Problem scheint nun gelöst zu sein, aber um ganz sicher zu gehen, wende ich mich an die Profis!

FRST.txt:

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-08-2015 02

durchgeführt von Karner (Administrator) auf KARNER-HP (26-08-2015 08:02:41)

Gestartet von C:\Users\Karner\Desktop\2

Geladene Profile: Karner (Verfügbare Profile: Karner)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser Pfad: "C:\Program Files (x86)\Safari\Safari.exe" -url "%1")

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe

(AMD) C:\Windows\System32\atieclxx.exe

(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(DigitalPersona, Inc.) C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\coreshredder.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe

(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe

(DigitalPersona, Inc.) C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpAgent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2014-04-20] (Synaptics Incorporated)

HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [169528 2011-11-10] (Hewlett-Packard Company)

HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]

Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
 

HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4

SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=

SearchScopes: HKLM -> {E0035957-5AF9-4380-B95C-7C6477579430} URL = hxxp://www.sm.de/?q={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRa8ldwnKG51HJOT1XRoA82gVkpDLIiC3wcwpHk-RMWGwswQ4MFW6Jut65chF8WYN7ocCYw8iTU3JGWeNYRcTsmFPcgG3DmdDEhKkKfMZfGguAcAAHy3ynuaE_F2iipKAYNVBTsoBCZIYv9f3NtmmYkmxQq4_FRmdAVocHOKZsstzJqnzvayYyVLi8xg,&q={searchTerms}

SearchScopes: HKLM-x32 -> {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRa8ldwnKG51HJOT1XRoA82gVkpDLIiC3wcwpHk-RMWGwswQ4MFW6Jut65chF8WYN7ocCYw8iTU3JGWeNYRcTsmFPcgG3DmdDEhKkKfMZfGguAcAAHy3ynuaE_F2iipKAYNVBTsoBCZIYv9f3NtmmYkmxQq4_FRmdAVocHOKZsstzJqnzvayYyVLi8xg,&q={searchTerms}

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF

SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF

SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox

SearchScopes: HKU\.DEFAULT -> DefaultScope 006ee092-9658-4fd6-bd8e-a21a348e59f5 URL = 

SearchScopes: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> {3F1B0C5E-D132-4651-BFED-DA2695F0E266} URL = hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=8eaa5d1800000000000020107afde130&r=222

SearchScopes: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> {DA45C459-3548-423C-AB4A-AEF54014E124} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=116989&tt=4812_2&babsrc=SP_ss&mntrId=8eaa5d1800000000000020107afde130

SearchScopes: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> {E0035957-5AF9-4380-B95C-7C6477579430} URL = hxxp://www.sm.de/?q={searchTerms}

BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-11] (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2011-02-07] (Hewlett-Packard)

BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-11] (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-26] (Google Inc.)

BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-26] (Google Inc.)

Toolbar: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4

Tcpip\..\Interfaces\{87CD7A81-0187-4367-B67F-0924A815EB31}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{975F0702-582A-4EC3-A6B0-C083AF7A6472}: [DhcpNameServer] 213.162.69.170 213.162.69.2

Tcpip\..\Interfaces\{C470C547-A543-409D-9EE4-091788902395}: [DhcpNameServer] 8.8.8.8 8.8.4.4

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin HKU\S-1-5-21-1967446285-4052042257-1953947229-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin HKU\S-1-5-21-1967446285-4052042257-1953947229-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt

FF Extension: DigitalPersona Extension - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2012-11-20]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com

FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com

FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com

FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-09-08]
 

Chrome: 

=======

CHR Profile: C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Kaspersky Protection) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-08]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]

CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx <nicht gefunden>

CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

StartMenuInternet: Google Chrome.5MJ2UW5X7H6ZEQVY7F6XQRHC3M - C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S4 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)

R2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [486224 2011-11-10] (DigitalPersona, Inc.)

S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [476728 2011-09-05] (Hewlett-Packard Company)

S4 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2012-02-04] (Macrovision Europe Ltd.) [Datei ist nicht signiert]

S4 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2012-02-04] (Macrovision Europe Ltd.) [Datei ist nicht signiert]

R2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [Datei ist nicht signiert]

S4 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2013-02-01] () [Datei ist nicht signiert]

S4 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)

S4 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2013-06-11] (IDT, Inc.) [Datei ist nicht signiert]

S4 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)

R3 BTMNET; C:\Windows\System32\DRIVERS\btmnet.sys [30208 2010-07-16] (Motorola, Inc.)

S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64312 2011-05-10] (Hewlett-Packard Company)

U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)

U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2010-07-27] (Huawei Technologies Co., Ltd.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-11] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-11] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)

R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [101288 2013-02-01] (McAfee, Inc.)

R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158888 2013-02-01] (McAfee, Inc.)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-09-10] (Apple Inc.) [Datei ist nicht signiert]

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [2621128 2015-07-16] (Sonix Tech. Co., Ltd.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-08-26 08:02 - 2015-08-26 08:02 - 00000000 ____D C:\FRST

2015-08-26 08:01 - 2015-08-26 08:02 - 00000000 ____D C:\Users\Karner\Desktop\2

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\fin

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\4

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\3

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\1

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 _____ C:\Users\Karner\defogger_reenable

2015-08-26 07:46 - 2015-08-26 07:46 - 00000000 ___HD C:\$Windows.~BT

2015-08-26 07:40 - 2015-08-26 07:40 - 00308632 _____ C:\windows\system32\FNTCACHE.DAT

2015-08-26 07:34 - 2015-08-26 08:00 - 00000909 _____ C:\windows\setupact.log

2015-08-26 07:34 - 2015-08-26 07:34 - 00068720 _____ C:\Users\Karner\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-26 07:34 - 2015-08-26 07:34 - 00000000 _____ C:\windows\setuperr.log

2015-08-25 18:38 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbFlt.sys

2015-08-25 18:38 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2015-08-25 18:38 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2015-08-25 18:38 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\MsRdpWebAccess.dll

2015-08-25 18:38 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\wksprtPS.dll

2015-08-25 18:38 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll

2015-08-25 18:38 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\TsUsbGDCoInstaller.dll

2015-08-25 18:38 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll

2015-08-25 18:38 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\MsRdpWebAccess.dll

2015-08-25 18:38 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wksprtPS.dll

2015-08-25 18:38 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe

2015-08-25 18:38 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\wksprt.exe

2015-08-25 18:38 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll

2015-08-25 18:38 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe

2015-08-25 18:38 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll

2015-08-25 18:38 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe

2015-08-25 18:38 - 2013-10-01 22:57 - 06578176 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2015-08-25 18:38 - 2013-10-01 22:55 - 05698048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2015-08-25 18:27 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll

2015-08-25 18:27 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys

2015-08-25 18:27 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbGD.sys

2015-08-25 18:27 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll

2015-08-25 18:27 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdpendp_winip.dll

2015-08-25 18:27 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\rdpendp_winip.dll

2015-08-25 18:27 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll

2015-08-25 18:24 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2015-08-25 18:24 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2015-08-25 18:24 - 2015-07-09 19:58 - 01632256 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll

2015-08-25 18:24 - 2015-07-09 19:58 - 00082944 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll

2015-08-25 18:24 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmcore.dll

2015-08-25 18:24 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll

2015-08-25 18:22 - 2015-07-23 02:06 - 05568960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-08-25 18:22 - 2015-07-23 02:06 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-08-25 18:22 - 2015-07-23 02:06 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-08-25 18:22 - 2015-07-23 02:03 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01390592 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-08-25 18:22 - 2015-07-23 02:02 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2015-08-25 18:22 - 2015-07-23 02:02 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2015-08-25 18:22 - 2015-07-23 02:01 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2015-08-25 18:22 - 2015-07-23 02:01 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-08-25 18:22 - 2015-07-23 02:01 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-08-25 18:22 - 2015-07-23 01:58 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-08-25 18:22 - 2015-07-23 01:57 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:51 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-08-25 18:22 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-08-25 18:22 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-08-25 18:22 - 2015-07-22 19:54 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-08-25 18:22 - 2015-07-22 19:52 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2015-08-25 18:22 - 2015-07-22 19:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2015-08-25 18:22 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-08-25 18:22 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:48 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll

2015-08-25 18:22 - 2015-07-22 18:45 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-08-25 18:22 - 2015-07-22 18:44 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-08-25 18:22 - 2015-07-22 18:44 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-08-25 18:22 - 2015-07-22 18:34 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2015-08-25 18:22 - 2015-07-22 18:34 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2015-08-25 18:22 - 2015-07-22 18:31 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-08-25 18:17 - 2015-06-25 12:06 - 00115136 _____ (Microsoft Corporation) C:\windows\system32\consent.exe

2015-08-25 18:17 - 2015-06-25 12:01 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2015-08-25 18:17 - 2015-06-25 12:01 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll

2015-08-25 18:17 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2015-08-25 17:44 - 2015-08-25 17:59 - 00000000 ____D C:\Users\Karner\Desktop\ccsetup509

2015-08-19 17:17 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-08-19 17:17 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-08-19 17:17 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-08-19 17:17 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-08-18 20:27 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-08-18 20:27 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-18 15:33 - 2015-08-18 15:33 - 00007998 _____ C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS

2015-08-18 15:33 - 2015-08-18 15:33 - 00000289 _____ C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS.part

2015-08-18 15:33 - 2015-08-18 15:33 - 00000000 ____D C:\Users\Karner\AppData\Local\5408D6D7_stp

2015-08-18 12:05 - 2015-08-18 12:05 - 00000000 ____D C:\Users\Karner\AppData\Local\GWX

2015-08-18 11:07 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll

2015-08-18 11:06 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe

2015-08-18 11:06 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll

2015-08-18 11:06 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-08-18 11:06 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys

2015-08-18 11:06 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll

2015-08-18 11:06 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll

2015-08-18 11:03 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-08-18 11:03 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-08-18 11:03 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-08-18 11:03 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-08-18 11:03 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-08-18 11:03 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-08-18 11:03 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-08-18 11:03 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-08-18 11:03 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-08-18 11:03 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-08-18 11:03 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-08-18 11:03 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-08-18 11:03 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-08-18 11:03 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-08-18 11:03 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-08-18 11:03 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-08-18 11:03 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-08-18 11:03 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-08-18 11:03 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-08-18 11:03 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-08-18 11:03 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-08-18 11:03 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-08-18 11:03 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-08-18 11:03 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-08-18 11:03 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-08-18 11:03 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-08-18 11:03 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-08-18 11:03 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-08-18 11:03 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-08-18 11:03 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-08-18 11:03 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-08-18 11:03 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-08-18 11:03 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-08-18 11:03 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-08-18 11:03 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-08-18 11:03 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-08-18 11:03 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-08-18 11:03 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-08-18 11:02 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2015-08-18 11:02 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-08-18 11:02 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-08-18 11:02 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-08-18 11:02 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-08-18 11:02 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-08-18 11:02 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-08-18 11:02 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-08-18 11:02 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-08-18 11:02 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2015-08-18 11:02 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-08-18 11:02 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-08-18 11:02 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-08-18 11:02 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-08-18 11:02 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-08-18 11:02 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe

2015-08-18 11:02 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\windows\notepad.exe

2015-08-18 11:02 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\notepad.exe

2015-08-18 10:25 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2015-08-18 10:25 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll

2015-08-18 10:25 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2015-08-18 10:25 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2015-08-18 10:25 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll

2015-08-18 10:24 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll

2015-08-18 10:24 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-08-18 10:24 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2015-08-18 10:24 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2015-08-18 10:21 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2015-08-18 10:21 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2015-08-18 10:21 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2015-08-18 10:21 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2015-08-18 10:21 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll

2015-08-18 10:21 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll

2015-08-18 10:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll

2015-08-18 10:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll

2015-08-18 10:21 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2015-08-18 10:21 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2015-08-18 10:21 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2015-08-18 10:21 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-08-18 10:10 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-08-18 10:10 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-08-18 10:10 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-08-16 16:27 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\windows\system32\cewmdm.dll

2015-08-16 16:27 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\windows\SysWOW64\cewmdm.dll

2015-08-16 16:25 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2015-08-16 16:25 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll

2015-08-16 16:24 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll

2015-08-16 16:23 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\windows\system32\msi.dll

2015-08-16 16:23 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll

2015-08-16 16:23 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe

2015-08-16 16:23 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll

2015-08-16 16:23 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll

2015-08-16 16:23 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe

2015-08-16 16:23 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll

2015-08-16 16:23 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll

2015-08-16 16:21 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll

2015-08-16 16:21 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll

2015-08-16 16:11 - 2015-08-25 09:49 - 00000000 ____D C:\Users\Karner\Desktop\VWA

2015-08-01 13:49 - 2015-08-25 10:57 - 00000000 ____D C:\Users\Karner\Desktop\images
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-08-26 08:03 - 2013-02-06 17:10 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-08-26 08:01 - 2012-09-24 10:04 - 00000000 ____D C:\Users\Karner

2015-08-26 07:58 - 2009-07-14 06:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-26 07:58 - 2009-07-14 06:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-26 07:54 - 2012-02-04 15:17 - 01240681 _____ C:\windows\WindowsUpdate.log

2015-08-26 07:49 - 2014-07-11 12:31 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-08-26 07:48 - 2013-06-22 15:05 - 00065536 _____ C:\windows\system32\Ikeext.etl

2015-08-26 07:48 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-08-26 07:46 - 2011-02-11 07:14 - 00000000 ____D C:\windows\Panther

2015-08-26 07:39 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing

2015-08-26 07:31 - 2014-07-11 12:29 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-08-26 07:23 - 2011-12-23 02:04 - 00000000 ____D C:\ProgramData\PDFC

2015-08-25 18:57 - 2011-12-23 00:48 - 00699666 _____ C:\windows\system32\perfh007.dat

2015-08-25 18:57 - 2011-12-23 00:48 - 00149774 _____ C:\windows\system32\perfc007.dat

2015-08-25 18:57 - 2009-07-14 07:13 - 01620612 _____ C:\windows\system32\PerfStringBackup.INI

2015-08-25 18:51 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-25 18:48 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions

2015-08-25 18:33 - 2011-12-23 01:32 - 01594892 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2015-08-25 18:24 - 2012-11-24 18:12 - 00000000 ____D C:\windows\Minidump

2015-08-25 18:14 - 2013-08-01 20:16 - 00000000 ____D C:\windows\Lhsp

2015-08-25 18:13 - 2012-09-25 16:03 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA.job

2015-08-25 18:09 - 2014-07-11 12:31 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-08-25 17:55 - 2014-07-14 23:15 - 00001064 _____ C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2015-08-25 17:55 - 2012-11-27 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-08-25 14:21 - 2012-09-25 16:10 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log

2015-08-25 10:25 - 2015-02-07 16:42 - 00000000 ____D C:\Users\Karner\Desktop\mp3

2015-08-25 09:48 - 2013-03-10 10:22 - 00000000 ____D C:\Users\Karner\Desktop\Schule,Freunde und so zeug

2015-08-25 09:36 - 2011-12-23 01:54 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-08-25 09:33 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-08-25 09:21 - 2014-07-08 21:48 - 00000000 ____D C:\Program Files (x86)\Queen's Tales - Das Biest und die Nachtigall Sammleredition

2015-08-25 09:14 - 2013-05-11 15:28 - 00000000 ____D C:\Program Files (x86)\bfgclient

2015-08-25 09:08 - 2012-09-24 10:15 - 00003938 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{375FBF94-8F03-44C8-9A01-8B2F6A7AE292}

2015-08-25 09:05 - 2014-07-08 17:02 - 00000000 ____D C:\ProgramData\Big Fish

2015-08-25 09:05 - 2014-07-08 17:00 - 00000000 ____D C:\BigFishCache

2015-08-23 13:13 - 2012-09-25 16:03 - 00001072 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core.job

2015-08-19 13:55 - 2009-07-14 07:09 - 00000000 ____D C:\windows\System32\Tasks\WPD

2015-08-19 13:49 - 2014-12-16 17:12 - 00000000 ____D C:\windows\system32\appraiser

2015-08-19 13:49 - 2014-05-10 09:06 - 00000000 ___SD C:\windows\system32\CompatTel

2015-08-18 20:28 - 2012-09-24 15:57 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-18 20:27 - 2013-03-14 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-08-18 20:26 - 2013-03-14 20:35 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-18 20:26 - 2013-03-14 20:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-18 19:52 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-08-18 10:03 - 2013-08-15 21:10 - 00000000 ____D C:\windows\system32\MRT

2015-08-18 09:28 - 2014-07-29 17:54 - 00000000 ____D C:\ProgramData\Origin

2015-08-18 09:28 - 2014-07-29 17:54 - 00000000 ____D C:\Program Files (x86)\Origin

2015-08-18 09:02 - 2012-10-13 20:29 - 132483416 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-08-18 08:50 - 2015-04-12 11:35 - 00000000 ___SD C:\windows\SysWOW64\GWX

2015-08-18 08:50 - 2015-04-12 11:35 - 00000000 ___SD C:\windows\system32\GWX

2015-08-16 17:50 - 2014-07-11 12:29 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-08-16 17:50 - 2014-07-11 12:29 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-16 17:50 - 2014-07-11 12:29 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2014-01-01 13:56 - 2014-11-15 04:02 - 0000165 _____ () C:\Users\Karner\AppData\Roaming\WB.CFG

2015-08-18 15:33 - 2015-08-18 15:33 - 0007998 _____ () C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS

2015-08-18 15:33 - 2015-08-18 15:33 - 0000289 _____ () C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS.part

2015-04-12 12:23 - 2015-04-12 12:23 - 0385602 _____ () C:\Users\Karner\AppData\Local\5D515C96_stp.CIS

2015-04-12 12:23 - 2015-04-12 12:23 - 0000220 _____ () C:\Users\Karner\AppData\Local\5D515C96_stp.CIS.part

2013-10-04 09:20 - 2013-10-04 10:43 - 0002792 _____ () C:\Users\Karner\AppData\Local\mbt-actwiz.log

2013-03-23 17:56 - 2013-03-23 17:56 - 0000853 _____ () C:\Users\Karner\AppData\Local\recently-used.xbel
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\windows\system32\winlogon.exe => Datei ist digital signiert

C:\windows\system32\wininit.exe => Datei ist digital signiert

C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert

C:\windows\explorer.exe => Datei ist digital signiert

C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\windows\system32\svchost.exe => Datei ist digital signiert

C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\windows\system32\services.exe => Datei ist digital signiert

C:\windows\system32\User32.dll => Datei ist digital signiert

C:\windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\windows\system32\userinit.exe => Datei ist digital signiert

C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\windows\system32\rpcss.dll => Datei ist digital signiert

C:\windows\system32\dnsapi.dll => Datei ist digital signiert

C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-03-15 18:22
 

==================== Ende von FRST.txt ============================

Addition.txt und Gmer.log im nächsten Post.

Hier Teil 2:

Addition.txt:

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-08-2015 02

durchgeführt von Karner (2015-08-26 08:04:04)

Gestartet von C:\Users\Karner\Desktop\2

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1967446285-4052042257-1953947229-500 - Administrator - Disabled)

Gast (S-1-5-21-1967446285-4052042257-1953947229-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1967446285-4052042257-1953947229-1003 - Limited - Enabled)

Karner (S-1-5-21-1967446285-4052042257-1953947229-1001 - Administrator - Enabled) => C:\Users\Karner
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version: 1.16.1.0 - A1 Telekom Austria AG)

A1 Dashboard (x32 Version: 1.16.1.0 - A1 Telekom Austria AG) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.6090 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)

AMD Catalyst Install Manager (HKLM\...\{7DB34D93-22BA-BE2B-6DB9-56D84E98C1DB}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)

ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 2.0.39.12 - ArcSoft)

ArcSoft TotalMedia (x32 Version: 1.0.48.25 - ArcSoft) Hidden

ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 2.0.0.30 - ArcSoft)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CardRecoveryPro 2.6.5 (HKLM-x32\...\{D9E1CADA-D103-47AE-B3F8-0C0CD0E5856E}_is1) (Version: 2.6.5 - LionSea Software co., ltd)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 6.1.0.1 - Hewlett-Packard Company)

Drive Encryption For HP ProtectTools (HKLM\...\{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}) (Version: 6.0.100.35469 - Hewlett-Packard Company)

Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)

Face Recognition for HP ProtectTools (HKLM\...\{D3A775F2-2674-4452-8D80-1FC1446052EE}) (Version: 6.00.4407 - Hewlett-Packard Company)

File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 6.0.0.8 - Hewlett-Packard Company)

Free YouTube Download version 3.2.49.1022 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.49.1022 - DVDVideoSoft Ltd.)

Free YouTube to iPhone Converter version 2.12.9.725 (HKLM-x32\...\Free YouTube to iPhone Converter_is1) (Version: 2.12.9.725 - DVDVideoSoft Ltd.)

Free YouTube to MP3 Converter version 3.12.43.806 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.43.806 - DVDVideoSoft Ltd.)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

GeoGebra 4.2 (HKLM-x32\...\GeoGebra 4.2) (Version: 4.2.57.0 - International GeoGebra Institute)

Google Chrome (HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ACHTUNG

Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP ESU for Microsoft Windows 7 (HKLM-x32\...\{840021F2-FFC0-467A-BF85-29B8B7803717}) (Version: 2.0.8.1 - Hewlett-Packard Company)

HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 6.08.1017 - Hewlett-Packard Company)

HP QuickWeb (HKLM-x32\...\{3F437675-F102-4866-BDE1-FFFC7B45EC0B}) (Version: 3.1.2.10229 - Hewlett-Packard Company)

HP Setup (HKLM-x32\...\{03046EBB-CB7C-4B98-BEFB-690EB955DA22}) (Version: 8.5.4526.3645 - Hewlett-Packard Company)

HP SoftPaq Download Manager (HKLM-x32\...\{FE465061-894A-4023-8580-56FCDD4F23F9}) (Version: 3.4.4.0 - Hewlett-Packard Company)

HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)

HP Software Setup (HKLM-x32\...\{531000B3-DBEE-4115-BBF3-DA48B67C053F}) (Version: 8.2.1.1 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)

HP System Default Settings (HKLM-x32\...\{EE5F1911-EA95-4F1A-AF97-495972F5032D}) (Version: 2.4.3.1 - Hewlett-Packard Company)

HP Wallpaper (HKLM-x32\...\{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}) (Version: 2.00 - Hewlett-Packard Company)

HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50058.0 - Sonix)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6428.0 - IDT)

Intel(R) Identity Protection Technology 1.0.71.0 (HKLM-x32\...\{2C43790E-8470-1027-82D3-DF319F3C410F}) (Version: 1.0.71.0 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)

InterActual Player (HKLM-x32\...\InterActual Player) (Version:  - )

JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.72.4 - JMicron Technology Corp.)

Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)

Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden

L&H TTS3000 Deutsch (HKLM-x32\...\LHTTSGED) (Version:  - )

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft_VC90_CRT_x86 (HKLM-x32\...\{DF2035BE-5820-4965-BD97-7FAF8D4A7879}) (Version: 1.0.0 - Microsoft Corporation)

PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.64 - PDF Complete, Inc)

PNotes 9.0.107 (HKLM-x32\...\{949D34E5-F53F-4830-9A50-1E2C39109043}_is1) (Version: 9.0.107 - Andrey Gruber)

Privacy Manager for HP ProtectTools (HKLM\...\{ACA53F68-B003-4D0E-9C3D-0C4EE09D08A8}) (Version: 6.00.831 - Hewlett-Packard Company)

PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.58.411.2012 - Realtek)

Realtek Motorola BC8 Bluetooth 3.0+HS Adapter (HKLM\...\1DF1F719-D43A-46E8-950F-65A8D96C678A.MBT_is1) (Version: 3.0.82.298 - Motorola Solutions, Inc.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0706 - REALTEK Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden

Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 6.0.0.1 - Stellar Information Technology Pvt Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.9 - Synaptics Incorporated)

Theft Recovery for HP ProtectTools (HKLM-x32\...\InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}) (Version: 6.0.0.33 - Hewlett-Packard Company)

Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.33 - Hewlett-Packard Company) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Validity Fingerprint Sensor Driver (HKLM\...\{FFC3E41D-2C2B-45B7-9AD9-5EA19572DD26}) (Version: 4.3.117.0 - Validity Sensors, Inc.)

VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

WinZip 18.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DF}) (Version: 18.0.10661 - WinZip Computing, S.L. )

Wondershare Data Recovery(Build 4.6.1.3) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 4.6.1.3 - Wondershare Software Co.,Ltd.)

Xobni Core (x32 Version: 1.0.0 - Xobni, Inc.) Hidden
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)
 

==================== Wiederherstellungspunkte =========================
 

16-08-2015 17:53:12 Windows Update

18-08-2015 08:59:33 Windows Update

18-08-2015 20:17:20 Windows Update

19-08-2015 17:17:00 Windows Update

25-08-2015 09:17:40 Windows Update

25-08-2015 09:29:20 Removed Bonjour

25-08-2015 18:01:28 Removed Java 8 Update 25

25-08-2015 18:14:48 Removed LPT System Updater Service

25-08-2015 18:24:53 Windows Update
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {068811E7-4924-45A3-B097-01345AA85C31} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)

Task: {091535C8-09ED-4D16-BA82-336198C54C64} - System32\Tasks\{D1B5A62B-491E-4C77-BA99-4B74DEF58C2A} => Chrome.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsProgressBar

Task: {0D6DE50F-90D6-4EAA-B208-C8BA5761CFB0} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-16] (Adobe Systems Incorporated)

Task: {1412CECA-C375-4C06-B5D7-18CD9F6F62D9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-25] (Google Inc.)

Task: {19E2CD7A-36CC-4598-8209-E17B268FA073} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {36EB7F2F-93D0-4D71-B085-44AC327D0B28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-11] (Google Inc.)

Task: {401C6E53-078F-4607-9B6F-2DF3A1EDDA52} - System32\Tasks\{FDE3F9D0-4C8F-4CD8-AE47-81857AB8A49D} => Chrome.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall

Task: {42EA683E-0D1F-47C9-8457-71F03C78068D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {5ABD082D-5596-41A2-9390-F90E6A8216D6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-25] (Google Inc.)

Task: {A784BA3A-385C-4365-B77C-90ACD4E598EF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2015-08-11] (Microsoft)

Task: {B6E46B00-F658-4363-845A-00801C0EB25F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-11] (Google Inc.)

Task: {EE54F4B1-3524-4694-A9E2-FAEABA43FEF2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {EEC01B1E-C1A7-4ED4-A1CE-E8814CBE1438} - System32\Tasks\{073383A0-77F2-429C-8042-EC46BE9BFC53} => Chrome.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar

Task: {F5E64A06-D5AF-4EC4-9898-237D24880911} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core.job => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA.job => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2011-07-18 17:48 - 2011-07-18 17:48 - 00156216 _____ () C:\Program Files\Hewlett-Packard\Pre-Boot Security for HP ProtectTools\BIOSDomainPlugin.dll

2013-02-01 11:39 - 2013-02-01 11:39 - 03401216 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpeHpFve64.dll

2010-12-07 08:17 - 2010-12-07 08:17 - 00204112 _____ () C:\windows\system32\PassThroughOTP.dll

2010-09-06 14:18 - 2010-09-06 14:18 - 01412608 _____ () C:\windows\system32\LIBEAY32.dll

2013-02-01 10:38 - 2013-02-01 10:38 - 00141824 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHostInterface64.dll

2013-02-01 11:26 - 2013-02-01 11:26 - 01956864 _____ () C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcNp64.DLL

2011-09-01 10:13 - 2011-09-01 10:13 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2011-11-09 19:55 - 2011-11-09 19:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll

2011-11-03 00:03 - 2011-11-03 00:03 - 00024576 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingResources.dll

2011-10-14 02:01 - 2011-10-14 02:01 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll

2014-10-23 13:09 - 2014-10-23 13:09 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll

2012-02-04 15:19 - 2011-01-13 03:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 

AlternateDataStreams: C:\ProgramData\TEMP:09867A8B

AlternateDataStreams: C:\ProgramData\TEMP:115EA582

AlternateDataStreams: C:\ProgramData\TEMP:2B82C0BB

AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F

AlternateDataStreams: C:\ProgramData\TEMP:31C9BA96

AlternateDataStreams: C:\ProgramData\TEMP:31F2397C

AlternateDataStreams: C:\ProgramData\TEMP:3393A1CA

AlternateDataStreams: C:\ProgramData\TEMP:3D3F1635

AlternateDataStreams: C:\ProgramData\TEMP:4C5C1DD3

AlternateDataStreams: C:\ProgramData\TEMP:4E6B8D68

AlternateDataStreams: C:\ProgramData\TEMP:506698B2

AlternateDataStreams: C:\ProgramData\TEMP:538B96B5

AlternateDataStreams: C:\ProgramData\TEMP:5A8F8A0C

AlternateDataStreams: C:\ProgramData\TEMP:5C28E25F

AlternateDataStreams: C:\ProgramData\TEMP:5C353220

AlternateDataStreams: C:\ProgramData\TEMP:66F19688

AlternateDataStreams: C:\ProgramData\TEMP:68DE552E

AlternateDataStreams: C:\ProgramData\TEMP:6BD304B9

AlternateDataStreams: C:\ProgramData\TEMP:6FDE1666

AlternateDataStreams: C:\ProgramData\TEMP:7E0EFF7B

AlternateDataStreams: C:\ProgramData\TEMP:80B291A7

AlternateDataStreams: C:\ProgramData\TEMP:80E965A3

AlternateDataStreams: C:\ProgramData\TEMP:81653DC8

AlternateDataStreams: C:\ProgramData\TEMP:871526BA

AlternateDataStreams: C:\ProgramData\TEMP:89A5891E

AlternateDataStreams: C:\ProgramData\TEMP:89C2A42C

AlternateDataStreams: C:\ProgramData\TEMP:8B076EC5

AlternateDataStreams: C:\ProgramData\TEMP:8D565A9B

AlternateDataStreams: C:\ProgramData\TEMP:91486201

AlternateDataStreams: C:\ProgramData\TEMP:A1D3FEF0

AlternateDataStreams: C:\ProgramData\TEMP:A561576B

AlternateDataStreams: C:\ProgramData\TEMP:AE2EA3C2

AlternateDataStreams: C:\ProgramData\TEMP:BD4CC9FB

AlternateDataStreams: C:\ProgramData\TEMP:C7F08EA3

AlternateDataStreams: C:\ProgramData\TEMP:D0757AAB

AlternateDataStreams: C:\ProgramData\TEMP:D3A8AA31

AlternateDataStreams: C:\ProgramData\TEMP:D7C0213D

AlternateDataStreams: C:\ProgramData\TEMP:E81603BC

AlternateDataStreams: C:\ProgramData\TEMP:F0D7EE30

AlternateDataStreams: C:\ProgramData\TEMP:F264BECE

AlternateDataStreams: C:\ProgramData\TEMP:F6DA3F39

AlternateDataStreams: C:\ProgramData\TEMP:FBFC061F

AlternateDataStreams: C:\ProgramData\TEMP:FDF9B285
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

MSCONFIG\Services: ACDaemon => 3

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3

MSCONFIG\Services: AESTFilters => 2

MSCONFIG\Services: Bluetooth Device Manager => 3

MSCONFIG\Services: Bluetooth Media Service => 3

MSCONFIG\Services: Bluetooth OBEX Service => 2

MSCONFIG\Services: Bonjour Service => 2

MSCONFIG\Services: FLEXnet Licensing Service => 3

MSCONFIG\Services: FLEXnet Licensing Service 64 => 3

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: gusvc => 3

MSCONFIG\Services: McAfee Endpoint Encryption Agent => 2

MSCONFIG\Services: pdfcDispatcher => 2

MSCONFIG\Services: STacSV => 2

MSCONFIG\Services: uArcCapture => 2

MSCONFIG\startupfolder: C:^Users^Karner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: BTMTrayAgent => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp

MSCONFIG\startupreg: DTRun => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe

MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart

MSCONFIG\startupreg: Google Update => "C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: GoogleChromeAutoLaunch_62EF63C3DC09A815C0F2BB9555814766 => "C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window

MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: MfeEpePcMonitor => "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe"

MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [{42588269-55E3-4799-BAF6-51EC2EB5964B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{CEA35843-A934-4488-B8F4-EEAE1A9969D2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7B2F6CA2-E1F4-4256-A1AA-CBA9309DBD8B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{D68A3AAC-F1A0-466E-8315-518D209FE712}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{72F2F83C-0D74-4637-B3F7-2D6835F264E5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{0ED66A34-2E5E-45F5-AA1F-CF79D739C7DA}] => (Allow) LPort=2869

FirewallRules: [{204A5EFB-DC6F-4CB7-8547-5CCF936FC991}] => (Allow) LPort=1900

FirewallRules: [{F9CFB0B5-2E03-4C54-93F4-8D18BD2365A7}] => (Allow) C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (08/26/2015 07:49:40 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/26/2015 07:42:21 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

Systemfehler:

=============

Error: (08/26/2015 07:47:05 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
 

Error: (08/26/2015 07:39:34 AM) (Source: DCOM) (EventID: 10010) (User: )

Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
 
 

Microsoft Office:

=========================
 

CodeIntegrity:

===================================

  Date: 2015-08-26 08:02:14.358

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:01:39.621

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:01:12.851

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:00:55.344

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:00:53.980

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:00:35.208

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:00:33.220

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 07:52:22.502

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 07:46:33.337

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 07:46:31.987

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Speicherinformationen =========================== 
 

Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz

Prozentuale Nutzung des RAM: 46%

Installierter physikalischer RAM: 4030.36 MB

Verfügbarer physikalischer RAM: 2139.18 MB

Summe virtueller Speicher: 10172.56 MB

Verfügbarer virtueller Speicher: 7689.38 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:572.75 GB) (Free:475.4 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]

Drive e: (HP_RECOVERY) (Fixed) (Total:18.13 GB) (Free:2.76 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]

Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.1 GB) FAT32
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 12DEB3A0)

Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=572.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=18.1 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
 

==================== Ende von Addition.txt ============================

Gmer.log

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2015-08-26 08:15:37

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST640LM0 rev.2AJ1 596,17GB

Running: y2fv9j2d.exe; Driver: C:\Users\Karner\AppData\Local\Temp\ufdcapog.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                     00000000752e1401 2 bytes JMP 768bb20b C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                       00000000752e1419 2 bytes JMP 768bb336 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                     00000000752e1431 2 bytes JMP 76938f39 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                     00000000752e144a 2 bytes CALL 76894885 C:\windows\syswow64\kernel32.dll

.text   ...                                                                                                                                                                       * 9

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                        00000000752e14dd 2 bytes JMP 76938832 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                 00000000752e14f5 2 bytes JMP 76938a08 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                        00000000752e150d 2 bytes JMP 76938728 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                 00000000752e1525 2 bytes JMP 76938af2 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                       00000000752e153d 2 bytes JMP 768afc98 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                            00000000752e1555 2 bytes JMP 768b68df C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                     00000000752e156d 2 bytes JMP 76938ff1 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                       00000000752e1585 2 bytes JMP 76938b52 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                          00000000752e159d 2 bytes JMP 769386ec C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                       00000000752e15b5 2 bytes JMP 768afd31 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                     00000000752e15cd 2 bytes JMP 768bb2cc C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                 00000000752e16b2 2 bytes JMP 76938eb4 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe[3000] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                 00000000752e16bd 2 bytes JMP 76938681 C:\windows\syswow64\kernel32.dll

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                        00000000771e13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                        00000000771e1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                00000000771e18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                               00000000771e1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                  00000000771e1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31                                      00000000771e1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                    00000000771e1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                        00000000771e2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                    00000000771e26e0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                  00000000771e2702 8 bytes {JMP 0x10}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79   00000000771e275f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184  00000000771e27c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299          00000000771e2b8b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375          00000000771e2bd7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                      00000000771e30ab 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                      00000000771e3238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318                                     00000000771e38ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403                                     00000000771e3923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197         00000000771e39f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                  00000000771e3f90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                 00000000771e4041 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                 00000000771e40b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                     00000000771e41f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                     00000000771e4234 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                               00000000771e44a1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                  00000000771e468c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                  00000000771e4753 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                               00000000771e4847 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                               00000000771e4966 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256              00000000771e4a90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                 00000000771e4ae3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501              00000000771e4ce5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                         00000000771e4ee0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                   00000000771e4fe7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                     00000000771e51d3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                     00000000771e6016 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                     00000000771e60e6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!atol + 194                                        00000000771e61de 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!qsort + 76                                        00000000771e63cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45          00000000771e640d 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4              00000000771e6424 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92             00000000771e647c 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                       00000000771e6c46 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241                00000000771e7be1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119                       00000000771e7c67 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            000000007722da80 8 bytes {JMP QWORD [RIP-0x46e40]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                          000000007722dc00 8 bytes {JMP QWORD [RIP-0x465e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                000000007722dc30 8 bytes {JMP QWORD [RIP-0x47829]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                              000000007722dd50 8 bytes {JMP QWORD [RIP-0x478da]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                  000000007722de00 8 bytes {JMP QWORD [RIP-0x479e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                  000000007722e430 8 bytes {JMP QWORD [RIP-0x467cf]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread                                000000007722e680 8 bytes {JMP QWORD [RIP-0x46aa5]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread                                000000007722eee0 8 bytes {JMP QWORD [RIP-0x47403]}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312              0000000074c613cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471              0000000074c6146b 8 bytes {JMP 0xffffffffffffffb0}

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                           0000000074c616d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                        0000000074c619db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                        0000000074c619fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4860] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                  0000000074c61a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                             00000000771e13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                             00000000771e1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                     00000000771e18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                    00000000771e1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                       00000000771e1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31                                           00000000771e1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                         00000000771e1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                             00000000771e2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                         00000000771e26e0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                       00000000771e2702 8 bytes {JMP 0x10}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79        00000000771e275f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184       00000000771e27c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299               00000000771e2b8b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375               00000000771e2bd7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                           00000000771e30ab 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                           00000000771e3238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318                                          00000000771e38ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403                                          00000000771e3923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197              00000000771e39f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                       00000000771e3f90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                      00000000771e4041 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                      00000000771e40b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                          00000000771e41f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                          00000000771e4234 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                    00000000771e44a1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                       00000000771e468c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                       00000000771e4753 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                    00000000771e4847 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                    00000000771e4966 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                   00000000771e4a90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                      00000000771e4ae3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                   00000000771e4ce5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                              00000000771e4ee0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                        00000000771e4fe7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                          00000000771e51d3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                          00000000771e6016 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                          00000000771e60e6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!atol + 194                                             00000000771e61de 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!qsort + 76                                             00000000771e63cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45               00000000771e640d 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                   00000000771e6424 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                  00000000771e647c 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                            00000000771e6c46 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241                     00000000771e7be1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119                            00000000771e7c67 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                 000000007722da80 8 bytes {JMP QWORD [RIP-0x46e40]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                               000000007722dc00 8 bytes {JMP QWORD [RIP-0x465e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                     000000007722dc30 8 bytes {JMP QWORD [RIP-0x47829]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                   000000007722dd50 8 bytes {JMP QWORD [RIP-0x478da]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                       000000007722de00 8 bytes {JMP QWORD [RIP-0x479e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                       000000007722e430 8 bytes {JMP QWORD [RIP-0x467cf]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread                                     000000007722e680 8 bytes {JMP QWORD [RIP-0x46aa5]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread                                     000000007722eee0 8 bytes {JMP QWORD [RIP-0x47403]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                   0000000074c613cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                   0000000074c6146b 8 bytes {JMP 0xffffffffffffffb0}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                0000000074c616d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                             0000000074c619db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                             0000000074c619fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2960] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                       0000000074c61a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                             00000000771e13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                             00000000771e1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                     00000000771e18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                    00000000771e1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                       00000000771e1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31                                           00000000771e1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                         00000000771e1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                             00000000771e2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                         00000000771e26e0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                       00000000771e2702 8 bytes {JMP 0x10}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79        00000000771e275f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184       00000000771e27c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299               00000000771e2b8b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375               00000000771e2bd7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                           00000000771e30ab 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                           00000000771e3238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318                                          00000000771e38ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403                                          00000000771e3923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197              00000000771e39f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                       00000000771e3f90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                      00000000771e4041 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                      00000000771e40b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                          00000000771e41f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                          00000000771e4234 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                    00000000771e44a1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                       00000000771e468c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                       00000000771e4753 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                    00000000771e4847 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                    00000000771e4966 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                   00000000771e4a90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                      00000000771e4ae3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                   00000000771e4ce5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                              00000000771e4ee0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                        00000000771e4fe7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                          00000000771e51d3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                          00000000771e6016 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                          00000000771e60e6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!atol + 194                                             00000000771e61de 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!qsort + 76                                             00000000771e63cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45               00000000771e640d 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                   00000000771e6424 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                  00000000771e647c 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                            00000000771e6c46 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241                     00000000771e7be1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119                            00000000771e7c67 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                 000000007722da80 8 bytes {JMP QWORD [RIP-0x46e40]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                               000000007722dc00 8 bytes {JMP QWORD [RIP-0x465e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                     000000007722dc30 8 bytes {JMP QWORD [RIP-0x47829]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                   000000007722dd50 8 bytes {JMP QWORD [RIP-0x478da]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                       000000007722de00 8 bytes {JMP QWORD [RIP-0x479e2]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                       000000007722e430 8 bytes {JMP QWORD [RIP-0x467cf]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread                                     000000007722e680 8 bytes {JMP QWORD [RIP-0x46aa5]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread                                     000000007722eee0 8 bytes {JMP QWORD [RIP-0x47403]}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                   0000000074c613cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                   0000000074c6146b 8 bytes {JMP 0xffffffffffffffb0}

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                0000000074c616d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                             0000000074c619db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                             0000000074c619fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5600] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                       0000000074c61a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                           00000000771e13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                           00000000771e1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                                   00000000771e18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                                  00000000771e1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                                     00000000771e1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                         00000000771e1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                       00000000771e1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                           00000000771e2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                       00000000771e26e0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                                     00000000771e2702 8 bytes {JMP 0x10}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                      00000000771e275f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                                     00000000771e27c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                             00000000771e2b8b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                             00000000771e2bd7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                         00000000771e30ab 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                         00000000771e3238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                        00000000771e38ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                        00000000771e3923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                            00000000771e39f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                                     00000000771e3f90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                                    00000000771e4041 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                                    00000000771e40b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                        00000000771e41f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                        00000000771e4234 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                                  00000000771e44a1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                                     00000000771e468c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                                     00000000771e4753 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                                  00000000771e4847 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                                  00000000771e4966 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                                 00000000771e4a90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                                    00000000771e4ae3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                                 00000000771e4ce5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                            00000000771e4ee0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                      00000000771e4fe7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                        00000000771e51d3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                        00000000771e6016 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                        00000000771e60e6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!atol + 194                                                                                           00000000771e61de 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                           00000000771e63cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                             00000000771e640d 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                                 00000000771e6424 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                                00000000771e647c 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                          00000000771e6c46 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241                                                                   00000000771e7be1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119                                                                          00000000771e7c67 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                               000000007722da80 8 bytes {JMP QWORD [RIP-0x46e40]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                             000000007722dc00 8 bytes {JMP QWORD [RIP-0x465e2]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                   000000007722dc30 8 bytes {JMP QWORD [RIP-0x47829]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                 000000007722dd50 8 bytes {JMP QWORD [RIP-0x478da]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                     000000007722de00 8 bytes {JMP QWORD [RIP-0x479e2]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                     000000007722e430 8 bytes {JMP QWORD [RIP-0x467cf]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                   000000007722e680 8 bytes {JMP QWORD [RIP-0x46aa5]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                   000000007722eee0 8 bytes {JMP QWORD [RIP-0x47403]}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                                 0000000074c613cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                                 0000000074c6146b 8 bytes {JMP 0xffffffffffffffb0}

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                              0000000074c616d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                           0000000074c619db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                           0000000074c619fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\windows\SysWOW64\regsvr32.exe[5228] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                                     0000000074c61a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159                                                                     00000000771e13ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500                                                                     00000000771e1544 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126                                                                             00000000771e18ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212                                                                            00000000771e1ba8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373                                                               00000000771e1d25 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!isalpha + 31                                                                                   00000000771e1e8f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!_strnicmp + 89                                                                                 00000000771e1f75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 680                                                                     00000000771e2238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16                                                                 00000000771e26e0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18                                                               00000000771e2702 8 bytes {JMP 0x10}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79                                                00000000771e275f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184                                               00000000771e27c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299                                                       00000000771e2b8b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375                                                       00000000771e2bd7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523                                                                   00000000771e30ab 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920                                                                   00000000771e3238 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 318                                                                                  00000000771e38ce 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!_itow_s + 403                                                                                  00000000771e3923 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197                                                      00000000771e39f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80                                                               00000000771e3f90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161                                                              00000000771e4041 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277                                                              00000000771e40b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 3

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214                                                                  00000000771e41f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276                                                                  00000000771e4234 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 609                                                                            00000000771e44a1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284                                                               00000000771e468c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483                                                               00000000771e4753 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231                                                                            00000000771e4847 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518                                                                            00000000771e4966 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   ...                                                                                                                                                                       * 2

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256                                                           00000000771e4a90 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67                                                              00000000771e4ae3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501                                                           00000000771e4ce5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256                                                                      00000000771e4ee0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247                                                                00000000771e4fe7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 483                                                                  00000000771e51d3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438                                                                  00000000771e6016 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!EtwEventProviderEnabled + 198                                                                  00000000771e60e6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!atol + 194                                                                                     00000000771e61de 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!qsort + 76                                                                                     00000000771e63cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45                                                       00000000771e640d 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4                                                           00000000771e6424 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92                                                          00000000771e647c 8 bytes [50, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790                                                                    00000000771e6c46 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241                                                             00000000771e7be1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119                                                                    00000000771e7c67 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                         000000007722da80 8 bytes {JMP QWORD [RIP-0x46e40]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                       000000007722dc00 8 bytes {JMP QWORD [RIP-0x465e2]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                             000000007722dc30 8 bytes {JMP QWORD [RIP-0x47829]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                           000000007722dd50 8 bytes {JMP QWORD [RIP-0x478da]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                               000000007722de00 8 bytes {JMP QWORD [RIP-0x479e2]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                               000000007722e430 8 bytes {JMP QWORD [RIP-0x467cf]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                             000000007722e680 8 bytes {JMP QWORD [RIP-0x46aa5]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                             000000007722eee0 8 bytes {JMP QWORD [RIP-0x47403]}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312                                                           0000000074c613cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471                                                           0000000074c6146b 8 bytes {JMP 0xffffffffffffffb0}

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611                                                                        0000000074c616d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23                                                                     0000000074c619db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23                                                                     0000000074c619fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\Karner\Desktop\3\y2fv9j2d.exe[5716] C:\windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23                                                               0000000074c61a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3704:5028]                                                                                                            000007fefb292ae8

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3704:3524]                                                                                                            000007fee3a05648

Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [3704:4228]                                                                                                            000007fef7df5124

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:4936]                                                                                                    0000000075907587

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:5056]                                                                                                    000000006be18aa6

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:4520]                                                                                                    00000000773fc557

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:3696]                                                                                                    00000000774127c1

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:1520]                                                                                                    00000000774127c1

Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4900:3644]                                                                                                    00000000774127c1

Thread  C:\windows\System32\svchost.exe [2572:5936]                                                                                                                               000007fee5dc9688
 

---- Registry - GMER 2.1 ----
 

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\20107afde131                                                                                               

Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\20107afde131 (not active ControlSet)                                                                           
 

---- EOF - GMER 2.1 ----

Hi,

1. Schritt: Malwarebytes (MBAM)

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Hinweis: Nachdem ich nach Mbam neugestartet habe, wollte sich ein Update installieren. Nach ungefähr 30 Minuten habe ich den PC einfach ausgeschaltet, da sich das Update anscheinend aufgehängt hat.

mbam.txt

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlaufdatum: 27.08.2015

Suchlaufzeit: 07:16

Protokolldatei: Mbam.txt

Administrator: Ja
 

Version: 2.1.8.1057

Malware-Datenbank: v2015.08.27.01

Rootkit-Datenbank: v2015.08.16.01

Lizenz: Testversion

Malware-Schutz: Aktiviert

Schutz vor bösartigen Websites: Aktiviert

Selbstschutz: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Karner
 

Suchlauftyp: Bedrohungssuchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 354783

Abgelaufene Zeit: 38 Min., 27 Sek.
 

Speicher: Aktiviert

Start: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristik: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(keine bösartigen Elemente erkannt)
 

Module: 0

(keine bösartigen Elemente erkannt)
 

Registrierungsschlüssel: 5

PUP.Optional.Snapdo.T, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}, In Quarantäne, [725bbb52ef9cf34342aa5f784bb7ac54], 

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, In Quarantäne, [3f8e62ab860590a6e0e709980ff5f010], 

PUP.Optional.Softonic.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{3F1B0C5E-D132-4651-BFED-DA2695F0E266}, In Quarantäne, [319c60ad1d6e76c0d408c955ed16b947], 

PUP.Optional.Astromenda.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, In Quarantäne, [814c907d3a51f145f9cdfca5e81c946c], 

PUP.Optional.Babylon.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{DA45C459-3548-423C-AB4A-AEF54014E124}, In Quarantäne, [3895f21b9bf03df91539c361f40ff20e], 
 

Registrierungswerte: 14

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|URL, hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=, In Quarantäne, [3f8e62ab860590a6e0e709980ff5f010]

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|TopResultURLFallback, hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=, In Quarantäne, [44892de0800b2c0ad5f26e33ac5821df]

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|FaviconPath, C:\Program Files (x86)\Astromenda\\FavIcon.ico, In Quarantäne, [b716719c543751e5bc0bc7da38cc2dd3]

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, Astromenda, In Quarantäne, [913c53ba93f82f0704c300a1788c18e8]

PUP.Optional.Astromenda.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|DisplayName, Astromenda, In Quarantäne, [a825838a5c2f44f28245dec3c83cf10f]

PUP.Optional.Astromenda.C, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY|AppPath, C:\Program Files (x86)\Astromenda\\, In Quarantäne, [e8e5a6673c4f67cffcc5fc29e61d7f81]

PUP.Optional.SafeFinder.ShrtCln, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{006ee092-9658-4fd6-bd8e-a21a348e59f5}|URL, hxxp://feed.safefinder.com/?p=mKO_AwFzXIpYRa8ldwnKG51HJOT1XRoA82gVkpDLIiC3wcwpHk-RMWGwswQ4MFW6Jut65chF8WYN7ocCYw8iTU3JGWeNYRcTsmFPcgG3DmdDEhKkKfMZfGguAcAAHy3ynuaE_F2iipKAYNVBTsoBCZIYv9f3NtmmYkmxQq4_FRmdAVocHOKZsstzJqnzvayYyVLi8xg,&q={searchTerms}, In Quarantäne, [4885ec21513aa88e12ad7f2c689cbb45]

PUP.Optional.Softonic.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{3F1B0C5E-D132-4651-BFED-DA2695F0E266}|URL, hxxp://search.softonic.com/MOY00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=8eaa5d1800000000000020107afde130&r=222, In Quarantäne, [319c60ad1d6e76c0d408c955ed16b947]

PUP.Optional.Softonic.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{3F1B0C5E-D132-4651-BFED-DA2695F0E266}|FaviconURL, hxxp://search.softonic.com/favicon.ico, In Quarantäne, [7756a06d464530063aa2a27c669d9f61]

PUP.Optional.Astromenda.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|TopResultURLFallback, hxxp://astromenda.com/results.php?f=4&q={searchTerms}&a=ast_ir_14_31_ie&cd=2XzuyEtN2Y1L1Qzu0EyEtCtCyD0BtA0B0EyCtC0EyD0DtCzztN0D0Tzu0SzyyEtCtN1L2XzutBtFtBtCtFtCzztFtAtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StA0EyC0CyC0F0CtBtGyC0F0A0DtGyEyEtDtCtGtC0EtCyEtGyEtCtA0CyByByCtDyC0Dzzzz2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyEtD0DtDtAyEzzyCtG0F0E0CyEtG0AtDtDyBtGtB0B0CzztGtA0CyByEtDtAtC0DtDzyzyyC2Q&cr=130675288&ir=, In Quarantäne, [814c907d3a51f145f9cdfca5e81c946c]

PUP.Optional.Astromenda.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}|FaviconPath, C:\Program Files (x86)\Astromenda\\FavIcon.ico, In Quarantäne, [f9d47e8fa6e558de5472aff22dd753ad]

PUP.Optional.Astromenda.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}, Astromenda, In Quarantäne, [715c917c2665f1455571e5bc7193bb45]

PUP.Optional.Babylon.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{DA45C459-3548-423C-AB4A-AEF54014E124}|URL, hxxp://search.babylon.com/?q={searchTerms}&affID=116989&tt=4812_2&babsrc=SP_ss&mntrId=8eaa5d1800000000000020107afde130, In Quarantäne, [3895f21b9bf03df91539c361f40ff20e]

PUP.Optional.Babylon.A, HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{DA45C459-3548-423C-AB4A-AEF54014E124}|FaviconURL, search.babylon.com/favicon.ico, In Quarantäne, [824b8e7f8605290da7a7f52f54aff10f]
 

Registrierungsdaten: 0

(keine bösartigen Elemente erkannt)
 

Ordner: 0

(keine bösartigen Elemente erkannt)
 

Dateien: 3

PUP.Optional.InstallCore.A, C:\Users\Karner\Downloads\Malavida_Download_Manager.exe.VIRUS, In Quarantäne, [d9f45bb23754d6606fb8e6aa1aeb4cb4], 

PUP.Optional.Softonic, C:\Users\Karner\Downloads\SoftonicDownloader_fuer_mws-reader.exe, In Quarantäne, [5e6fe32a068553e39997499cd42c23dd], 

PUP.Optional.InstallCore, C:\Users\Karner\AppData\Local\5D515C96_stp\icc.dll, In Quarantäne, [8c41a964dcaf063061e75d3058aa8c74], 
 

Physische Sektoren: 0

(keine bösartigen Elemente erkannt)
 
 

(end)

JRT.txt

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Malwarebytes

Version: 7.5.8 (08.24.2015:1)

OS: Windows 7 Home Premium x64

Ran by Karner on 27.08.2015 at  8:48:15,43

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Tasks
 
 
 

~~~ Registry Values
 

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\\SearchAssistant
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E0035957-5AF9-4380-B95C-7C6477579430}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update Deal Keeper

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Util Deal Keeper
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Users\Karner\Appdata\Local\google\chrome\user data\default\local storage\hxxp_www.superfish.com_0.localstorage

Successfully deleted: [File] C:\Users\Karner\Appdata\Local\google\chrome\user data\default\local storage\hxxps_www.superfish.com_0.localstorage
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] C:\ProgramData\google
 
 
 

~~~ Chrome
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
 

[C:\Users\Karner\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
 

[C:\Users\Karner\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
 

[C:\Users\Karner\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
 

[C:\Users\Karner\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:

[]
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 27.08.2015 at  8:52:02,99

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-08-2015 02

durchgeführt von Karner (Administrator) auf KARNER-HP (27-08-2015 08:56:52)

Gestartet von C:\Users\Karner\Desktop

Geladene Profile: Karner (Verfügbare Profile: Karner)

Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser Pfad: "C:\Program Files (x86)\Safari\Safari.exe" -url "%1")

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2014-04-20] (Synaptics Incorporated)

HKLM-x32\...\Run: [File Sanitizer] => C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)

HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)

HKLM-x32\...\Run: [NUSB3MON] => c:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-11-17] (Renesas Electronics Corporation)

HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-10-14] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [HPQuickWebProxy] => c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [169528 2011-11-10] (Hewlett-Packard Company)

HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

Winlogon\Notify\DeviceNP-x32: DeviceNP.dll [X]

Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli

ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei

ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  Keine Datei
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
 

HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4

SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM -> {E0035957-5AF9-4380-B95C-7C6477579430} URL = hxxp://www.sm.de/?q={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = 

SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 -> {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=CMNTDF&pc=CMNTDF&src=IE-SearchBox

SearchScopes: HKU\.DEFAULT -> DefaultScope 006ee092-9658-4fd6-bd8e-a21a348e59f5 URL = 

SearchScopes: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-11] (Kaspersky Lab ZAO)

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll [2013-08-28] (Hewlett-Packard)

BHO-x32: File Sanitizer for HP ProtectTools -> {3134413B-49B4-425C-98A5-893C1F195601} -> C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll [2011-02-07] (Hewlett-Packard)

BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-10-11] (Kaspersky Lab ZAO)

BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)

BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-26] (Google Inc.)

BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)

BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll [2013-08-28] (Hewlett-Packard)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-26] (Google Inc.)

Toolbar: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-26] (Google Inc.)

Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4

Tcpip\..\Interfaces\{87CD7A81-0187-4367-B67F-0924A815EB31}: [DhcpNameServer] 10.0.0.138

Tcpip\..\Interfaces\{975F0702-582A-4EC3-A6B0-C083AF7A6472}: [DhcpNameServer] 213.162.69.170 213.162.69.2

Tcpip\..\Interfaces\{C470C547-A543-409D-9EE4-091788902395}: [DhcpNameServer] 8.8.8.8 8.8.4.4

StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 

FireFox:

========

FF Plugin: @microsoft.com/GENUINE -> disabled [Keine Datei]

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-10-11] ()

FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Keine Datei]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)

FF Plugin HKU\S-1-5-21-1967446285-4052042257-1953947229-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF Plugin HKU\S-1-5-21-1967446285-4052042257-1953947229-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-26] (Google Inc.)

FF HKLM-x32\...\Firefox\Extensions: [otis@digitalpersona.com] - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt

FF Extension: DigitalPersona Extension - C:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\FirefoxExt [2012-11-20]

FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com

FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com

FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com

FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com

FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-09-08]

FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com

FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-09-08]
 

Chrome: 

=======

CHR Profile: C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Kaspersky Protection) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-09-08]

CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Karner\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06]

CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho

StartMenuInternet: Google Chrome.5MJ2UW5X7H6ZEQVY7F6XQRHC3M - C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S4 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)

R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)

S2 DpHost; C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [486224 2011-11-10] (DigitalPersona, Inc.)

S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [476728 2011-09-05] (Hewlett-Packard Company)

S4 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [647680 2012-02-04] (Macrovision Europe Ltd.) [Datei ist nicht signiert]

S4 FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [1028096 2012-02-04] (Macrovision Europe Ltd.) [Datei ist nicht signiert]

S2 HPFSService; C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [320000 2011-02-07] (Hewlett-Packard) [Datei ist nicht signiert]

S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

S4 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1323008 2013-02-01] () [Datei ist nicht signiert]

S4 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-11] (PDF Complete Inc)

S4 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [323072 2013-06-11] (IDT, Inc.) [Datei ist nicht signiert]

S4 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)

R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)

R3 BTMNET; C:\Windows\System32\DRIVERS\btmnet.sys [30208 2010-07-16] (Motorola, Inc.)

S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [64312 2011-05-10] (Hewlett-Packard Company)

U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)

U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2010-07-27] (Huawei Technologies Co., Ltd.)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)

R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-11] (Kaspersky Lab ZAO)

R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-11] (Kaspersky Lab ZAO)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)

R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-27] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)

R0 MfeEpeOpal; C:\Windows\System32\Drivers\MfeEpeOpal.sys [101288 2013-02-01] (McAfee, Inc.)

R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [158888 2013-02-01] (McAfee, Inc.)

S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [22528 2012-09-10] (Apple Inc.) [Datei ist nicht signiert]

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [2621128 2015-07-16] (Sonix Tech. Co., Ltd.)

S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2012-12-13] (Apple, Inc.) [Datei ist nicht signiert]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-08-27 08:56 - 2015-08-27 08:56 - 00018940 _____ C:\Users\Karner\Desktop\FRST.txt

2015-08-27 08:56 - 2015-08-26 05:10 - 02186752 _____ (Farbar) C:\Users\Karner\Desktop\FRST64.exe

2015-08-27 08:43 - 2015-08-27 08:43 - 00001142 _____ C:\windows\PFRO.log

2015-08-27 07:15 - 2015-08-27 08:45 - 00113880 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2015-08-27 07:14 - 2015-08-27 07:14 - 00001066 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-08-27 07:14 - 2015-08-27 07:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-08-27 07:14 - 2015-08-27 07:14 - 00000000 ____D C:\ProgramData\Malwarebytes

2015-08-27 07:14 - 2015-08-27 07:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware

2015-08-27 07:14 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2015-08-27 07:14 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2015-08-27 07:14 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2015-08-27 07:09 - 2015-08-27 07:09 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Karner\Desktop\mbam-setup-2.1.8.1057.exe

2015-08-27 07:09 - 2015-08-27 07:09 - 01798560 _____ (Malwarebytes Corporation) C:\Users\Karner\Desktop\JRT.exe

2015-08-26 08:02 - 2015-08-27 08:56 - 00000000 ____D C:\FRST

2015-08-26 08:01 - 2015-08-27 08:54 - 00000000 ____D C:\Users\Karner\Desktop\2

2015-08-26 08:01 - 2015-08-26 08:15 - 00000000 ____D C:\Users\Karner\Desktop\fin

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\4

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\3

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 ____D C:\Users\Karner\Desktop\1

2015-08-26 08:01 - 2015-08-26 08:01 - 00000000 _____ C:\Users\Karner\defogger_reenable

2015-08-26 07:40 - 2015-08-26 07:40 - 00308632 _____ C:\windows\system32\FNTCACHE.DAT

2015-08-26 07:34 - 2015-08-27 08:43 - 00001021 _____ C:\windows\setupact.log

2015-08-26 07:34 - 2015-08-26 07:34 - 00068720 _____ C:\Users\Karner\AppData\Local\GDIPFONTCACHEV1.DAT

2015-08-26 07:34 - 2015-08-26 07:34 - 00000000 _____ C:\windows\setuperr.log

2015-08-25 18:38 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbFlt.sys

2015-08-25 18:38 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2015-08-25 18:38 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2015-08-25 18:38 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\MsRdpWebAccess.dll

2015-08-25 18:38 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\wksprtPS.dll

2015-08-25 18:38 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll

2015-08-25 18:38 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\TsUsbGDCoInstaller.dll

2015-08-25 18:38 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\windows\system32\rdvidcrl.dll

2015-08-25 18:38 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\MsRdpWebAccess.dll

2015-08-25 18:38 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\windows\SysWOW64\wksprtPS.dll

2015-08-25 18:38 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe

2015-08-25 18:38 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\wksprt.exe

2015-08-25 18:38 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll

2015-08-25 18:38 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe

2015-08-25 18:38 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdvidcrl.dll

2015-08-25 18:38 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe

2015-08-25 18:38 - 2013-10-01 22:57 - 06578176 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll

2015-08-25 18:38 - 2013-10-01 22:55 - 05698048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll

2015-08-25 18:27 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\windows\system32\rdpudd.dll

2015-08-25 18:27 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpvideominiport.sys

2015-08-25 18:27 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\TsUsbGD.sys

2015-08-25 18:27 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll

2015-08-25 18:27 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\windows\SysWOW64\rdpendp_winip.dll

2015-08-25 18:27 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\rdpendp_winip.dll

2015-08-25 18:27 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll

2015-08-25 18:24 - 2015-07-15 05:17 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll

2015-08-25 18:24 - 2015-07-15 04:54 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

2015-08-25 18:24 - 2015-07-09 19:58 - 01632256 _____ (Microsoft Corporation) C:\windows\system32\dwmcore.dll

2015-08-25 18:24 - 2015-07-09 19:58 - 00082944 _____ (Microsoft Corporation) C:\windows\system32\dwmapi.dll

2015-08-25 18:24 - 2015-07-09 19:42 - 01372160 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmcore.dll

2015-08-25 18:24 - 2015-07-09 19:42 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\dwmapi.dll

2015-08-25 18:22 - 2015-07-23 02:06 - 05568960 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe

2015-08-25 18:22 - 2015-07-23 02:06 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2015-08-25 18:22 - 2015-07-23 02:06 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2015-08-25 18:22 - 2015-07-23 02:03 - 01730496 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll

2015-08-25 18:22 - 2015-07-23 02:03 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01461760 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01390592 _____ (Microsoft Corporation) C:\windows\system32\diagtrack.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01216512 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\tdh.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00879104 _____ (Microsoft Corporation) C:\windows\system32\advapi32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe

2015-08-25 18:22 - 2015-07-23 02:02 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe

2015-08-25 18:22 - 2015-07-23 02:02 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2015-08-25 18:22 - 2015-07-23 02:02 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll

2015-08-25 18:22 - 2015-07-23 02:01 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe

2015-08-25 18:22 - 2015-07-23 02:01 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe

2015-08-25 18:22 - 2015-07-23 02:01 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2015-08-25 18:22 - 2015-07-23 01:58 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll

2015-08-25 18:22 - 2015-07-23 01:57 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:52 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2015-08-25 18:22 - 2015-07-23 01:51 - 00686080 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll

2015-08-25 18:22 - 2015-07-22 19:57 - 03989952 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe

2015-08-25 18:22 - 2015-07-22 19:57 - 03934656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe

2015-08-25 18:22 - 2015-07-22 19:54 - 01311768 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00641536 _____ (Microsoft Corporation) C:\windows\SysWOW64\advapi32.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00635392 _____ (Microsoft Corporation) C:\windows\SysWOW64\tdh.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00552960 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2015-08-25 18:22 - 2015-07-22 19:53 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00665088 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2015-08-25 18:22 - 2015-07-22 19:52 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe

2015-08-25 18:22 - 2015-07-22 19:52 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe

2015-08-25 18:22 - 2015-07-22 19:52 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll

2015-08-25 18:22 - 2015-07-22 19:47 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll

2015-08-25 18:22 - 2015-07-22 19:46 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00686080 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 19:42 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:48 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\UtcResources.dll

2015-08-25 18:22 - 2015-07-22 18:45 - 00159232 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys

2015-08-25 18:22 - 2015-07-22 18:44 - 00290816 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys

2015-08-25 18:22 - 2015-07-22 18:44 - 00129024 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys

2015-08-25 18:22 - 2015-07-22 18:34 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe

2015-08-25 18:22 - 2015-07-22 18:34 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe

2015-08-25 18:22 - 2015-07-22 18:31 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll

2015-08-25 18:22 - 2015-07-22 18:31 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll

2015-08-25 18:17 - 2015-06-25 12:06 - 00115136 _____ (Microsoft Corporation) C:\windows\system32\consent.exe

2015-08-25 18:17 - 2015-06-25 12:01 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2015-08-25 18:17 - 2015-06-25 12:01 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll

2015-08-25 18:17 - 2015-06-25 11:44 - 01805824 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2015-08-25 17:44 - 2015-08-25 17:59 - 00000000 ____D C:\Users\Karner\Desktop\ccsetup509

2015-08-19 17:17 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2015-08-19 17:17 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2015-08-19 17:17 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2015-08-19 17:17 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2015-08-18 20:27 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-08-18 20:27 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-18 15:33 - 2015-08-18 15:33 - 00007998 _____ C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS

2015-08-18 15:33 - 2015-08-18 15:33 - 00000289 _____ C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS.part

2015-08-18 15:33 - 2015-08-18 15:33 - 00000000 ____D C:\Users\Karner\AppData\Local\5408D6D7_stp

2015-08-18 12:05 - 2015-08-18 12:05 - 00000000 ____D C:\Users\Karner\AppData\Local\GWX

2015-08-18 11:07 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\basesrv.dll

2015-08-18 11:06 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe

2015-08-18 11:06 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2015-08-18 11:06 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll

2015-08-18 11:06 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2015-08-18 11:06 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mountmgr.sys

2015-08-18 11:06 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\windows\system32\sysmain.dll

2015-08-18 11:06 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\windows\system32\msmmsp.dll

2015-08-18 11:03 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2015-08-18 11:03 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2015-08-18 11:03 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2015-08-18 11:03 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2015-08-18 11:03 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2015-08-18 11:03 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2015-08-18 11:03 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2015-08-18 11:03 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2015-08-18 11:03 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2015-08-18 11:03 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2015-08-18 11:03 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2015-08-18 11:03 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2015-08-18 11:03 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2015-08-18 11:03 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2015-08-18 11:03 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2015-08-18 11:03 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2015-08-18 11:03 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2015-08-18 11:03 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2015-08-18 11:03 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2015-08-18 11:03 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2015-08-18 11:03 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2015-08-18 11:03 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2015-08-18 11:03 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2015-08-18 11:03 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2015-08-18 11:03 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2015-08-18 11:03 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2015-08-18 11:03 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2015-08-18 11:03 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2015-08-18 11:03 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2015-08-18 11:03 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2015-08-18 11:03 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2015-08-18 11:03 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2015-08-18 11:03 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2015-08-18 11:03 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2015-08-18 11:03 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2015-08-18 11:03 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2015-08-18 11:03 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2015-08-18 11:03 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2015-08-18 11:03 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2015-08-18 11:02 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec

2015-08-18 11:02 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2015-08-18 11:02 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2015-08-18 11:02 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2015-08-18 11:02 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2015-08-18 11:02 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2015-08-18 11:02 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2015-08-18 11:02 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2015-08-18 11:02 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2015-08-18 11:02 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec

2015-08-18 11:02 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2015-08-18 11:02 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2015-08-18 11:02 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2015-08-18 11:02 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2015-08-18 11:02 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2015-08-18 11:02 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\windows\system32\notepad.exe

2015-08-18 11:02 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\windows\notepad.exe

2015-08-18 11:02 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\windows\SysWOW64\notepad.exe

2015-08-18 10:25 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll

2015-08-18 10:25 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\windows\system32\FntCache.dll

2015-08-18 10:25 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll

2015-08-18 10:25 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll

2015-08-18 10:25 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\windows\system32\d3d10warp.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll

2015-08-18 10:24 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\windows\SysWOW64\d3d10warp.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll

2015-08-18 10:24 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll

2015-08-18 10:24 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll

2015-08-18 10:24 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2015-08-18 10:24 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll

2015-08-18 10:24 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll

2015-08-18 10:21 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2015-08-18 10:21 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2015-08-18 10:21 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2015-08-18 10:21 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2015-08-18 10:21 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll

2015-08-18 10:21 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll

2015-08-18 10:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll

2015-08-18 10:21 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll

2015-08-18 10:21 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\windows\system32\WebClnt.dll

2015-08-18 10:21 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\windows\system32\davclnt.dll

2015-08-18 10:21 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\windows\SysWOW64\WebClnt.dll

2015-08-18 10:21 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\windows\SysWOW64\davclnt.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe

2015-08-18 10:10 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\windows\system32\WinSetupUI.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\windows\system32\wups2.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe

2015-08-18 10:10 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\windows\system32\wups.dll

2015-08-18 10:10 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\windows\system32\wu.upgrade.ps.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll

2015-08-18 10:10 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe

2015-08-18 10:10 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\windows\SysWOW64\wups.dll

2015-08-16 16:27 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\windows\system32\cewmdm.dll

2015-08-16 16:27 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\windows\SysWOW64\cewmdm.dll

2015-08-16 16:25 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2015-08-16 16:25 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll

2015-08-16 16:24 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll

2015-08-16 16:24 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll

2015-08-16 16:24 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll

2015-08-16 16:23 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\windows\system32\msi.dll

2015-08-16 16:23 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll

2015-08-16 16:23 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe

2015-08-16 16:23 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll

2015-08-16 16:23 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll

2015-08-16 16:23 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe

2015-08-16 16:23 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll

2015-08-16 16:23 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll

2015-08-16 16:21 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\windows\system32\ole32.dll

2015-08-16 16:21 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\windows\SysWOW64\ole32.dll

2015-08-16 16:11 - 2015-08-25 09:49 - 00000000 ____D C:\Users\Karner\Desktop\VWA

2015-08-01 13:49 - 2015-08-25 10:57 - 00000000 ____D C:\Users\Karner\Desktop\images
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-08-27 08:49 - 2012-02-04 15:17 - 01642674 _____ C:\windows\WindowsUpdate.log

2015-08-27 08:49 - 2009-07-14 06:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-08-27 08:49 - 2009-07-14 06:45 - 00028576 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-08-27 08:46 - 2013-02-06 17:10 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-08-27 08:44 - 2014-07-11 12:31 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-08-27 08:44 - 2013-06-22 15:05 - 00065536 _____ C:\windows\system32\Ikeext.etl

2015-08-27 08:44 - 2009-07-14 05:20 - 00000000 ____D C:\windows\tracing

2015-08-27 08:43 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2015-08-27 08:31 - 2014-07-11 12:29 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2015-08-27 08:13 - 2012-09-25 16:03 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA.job

2015-08-27 08:10 - 2014-07-11 12:31 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-08-27 08:08 - 2015-07-10 19:28 - 00000000 ___HD C:\$Windows.~BT

2015-08-27 07:56 - 2015-04-12 12:23 - 00000000 ____D C:\Users\Karner\AppData\Local\5D515C96_stp

2015-08-27 07:56 - 2012-09-24 10:15 - 00001425 _____ C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2015-08-27 07:27 - 2011-02-11 07:14 - 00000000 ____D C:\windows\Panther

2015-08-27 07:18 - 2012-09-24 10:15 - 00003938 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{375FBF94-8F03-44C8-9A01-8B2F6A7AE292}

2015-08-27 07:18 - 2011-12-23 00:48 - 00699666 _____ C:\windows\system32\perfh007.dat

2015-08-27 07:18 - 2011-12-23 00:48 - 00149774 _____ C:\windows\system32\perfc007.dat

2015-08-27 07:18 - 2009-07-14 07:13 - 01620612 _____ C:\windows\system32\PerfStringBackup.INI

2015-08-26 08:01 - 2012-09-24 10:04 - 00000000 ____D C:\Users\Karner

2015-08-26 07:23 - 2011-12-23 02:04 - 00000000 ____D C:\ProgramData\PDFC

2015-08-25 18:51 - 2009-07-14 05:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-25 18:48 - 2009-07-14 05:20 - 00000000 ____D C:\windows\PolicyDefinitions

2015-08-25 18:33 - 2011-12-23 01:32 - 01594892 _____ C:\windows\SysWOW64\PerfStringBackup.INI

2015-08-25 18:24 - 2012-11-24 18:12 - 00000000 ____D C:\windows\Minidump

2015-08-25 18:14 - 2013-08-01 20:16 - 00000000 ____D C:\windows\Lhsp

2015-08-25 17:55 - 2014-07-14 23:15 - 00001064 _____ C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk

2015-08-25 17:55 - 2012-11-27 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-08-25 14:21 - 2012-09-25 16:10 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log

2015-08-25 10:25 - 2015-02-07 16:42 - 00000000 ____D C:\Users\Karner\Desktop\mp3

2015-08-25 09:48 - 2013-03-10 10:22 - 00000000 ____D C:\Users\Karner\Desktop\Schule,Freunde und so zeug

2015-08-25 09:36 - 2011-12-23 01:54 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-08-25 09:33 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

2015-08-25 09:21 - 2014-07-08 21:48 - 00000000 ____D C:\Program Files (x86)\Queen's Tales - Das Biest und die Nachtigall Sammleredition

2015-08-25 09:14 - 2013-05-11 15:28 - 00000000 ____D C:\Program Files (x86)\bfgclient

2015-08-25 09:05 - 2014-07-08 17:02 - 00000000 ____D C:\ProgramData\Big Fish

2015-08-25 09:05 - 2014-07-08 17:00 - 00000000 ____D C:\BigFishCache

2015-08-23 13:13 - 2012-09-25 16:03 - 00001072 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core.job

2015-08-19 13:55 - 2009-07-14 07:09 - 00000000 ____D C:\windows\System32\Tasks\WPD

2015-08-19 13:49 - 2014-12-16 17:12 - 00000000 ____D C:\windows\system32\appraiser

2015-08-19 13:49 - 2014-05-10 09:06 - 00000000 ___SD C:\windows\system32\CompatTel

2015-08-18 20:28 - 2012-09-24 15:57 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-18 20:27 - 2013-03-14 20:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2015-08-18 20:26 - 2013-03-14 20:35 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2015-08-18 20:26 - 2013-03-14 20:35 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2015-08-18 19:52 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk

2015-08-18 10:03 - 2013-08-15 21:10 - 00000000 ____D C:\windows\system32\MRT

2015-08-18 09:28 - 2014-07-29 17:54 - 00000000 ____D C:\ProgramData\Origin

2015-08-18 09:28 - 2014-07-29 17:54 - 00000000 ____D C:\Program Files (x86)\Origin

2015-08-18 09:02 - 2012-10-13 20:29 - 132483416 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2015-08-18 08:50 - 2015-04-12 11:35 - 00000000 ___SD C:\windows\SysWOW64\GWX

2015-08-18 08:50 - 2015-04-12 11:35 - 00000000 ___SD C:\windows\system32\GWX

2015-08-16 17:50 - 2014-07-11 12:29 - 00778440 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2015-08-16 17:50 - 2014-07-11 12:29 - 00142536 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-16 17:50 - 2014-07-11 12:29 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2014-01-01 13:56 - 2014-11-15 04:02 - 0000165 _____ () C:\Users\Karner\AppData\Roaming\WB.CFG

2015-08-18 15:33 - 2015-08-18 15:33 - 0007998 _____ () C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS

2015-08-18 15:33 - 2015-08-18 15:33 - 0000289 _____ () C:\Users\Karner\AppData\Local\5408D6D7_stp.CIS.part

2015-04-12 12:23 - 2015-04-12 12:23 - 0385602 _____ () C:\Users\Karner\AppData\Local\5D515C96_stp.CIS

2015-04-12 12:23 - 2015-04-12 12:23 - 0000220 _____ () C:\Users\Karner\AppData\Local\5D515C96_stp.CIS.part

2013-10-04 09:20 - 2013-10-04 10:43 - 0002792 _____ () C:\Users\Karner\AppData\Local\mbt-actwiz.log

2013-03-23 17:56 - 2013-03-23 17:56 - 0000853 _____ () C:\Users\Karner\AppData\Local\recently-used.xbel
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\windows\system32\winlogon.exe => Datei ist digital signiert

C:\windows\system32\wininit.exe => Datei ist digital signiert

C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert

C:\windows\explorer.exe => Datei ist digital signiert

C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert

C:\windows\system32\svchost.exe => Datei ist digital signiert

C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert

C:\windows\system32\services.exe => Datei ist digital signiert

C:\windows\system32\User32.dll => Datei ist digital signiert

C:\windows\SysWOW64\User32.dll => Datei ist digital signiert

C:\windows\system32\userinit.exe => Datei ist digital signiert

C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert

C:\windows\system32\rpcss.dll => Datei ist digital signiert

C:\windows\system32\dnsapi.dll => Datei ist digital signiert

C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-03-15 18:22
 

==================== Ende von FRST.txt ============================

Addition.txt

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-08-2015 02

durchgeführt von Karner (2015-08-27 08:57:10)

Gestartet von C:\Users\Karner\Desktop

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-1967446285-4052042257-1953947229-500 - Administrator - Disabled)

Gast (S-1-5-21-1967446285-4052042257-1953947229-501 - Limited - Disabled)

HomeGroupUser$ (S-1-5-21-1967446285-4052042257-1953947229-1003 - Limited - Enabled)

Karner (S-1-5-21-1967446285-4052042257-1953947229-1001 - Administrator - Enabled) => C:\Users\Karner
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Kaspersky Internet Security (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}

AS: Kaspersky Internet Security (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Disabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

A1 Dashboard (HKLM-x32\...\A1 Dashboard) (Version: 1.16.1.0 - A1 Telekom Austria AG)

A1 Dashboard (x32 Version: 1.16.1.0 - A1 Telekom Austria AG) Hidden

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.6.0.6090 - Adobe Systems Incorporated)

Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)

AMD Catalyst Install Manager (HKLM\...\{7DB34D93-22BA-BE2B-6DB9-56D84E98C1DB}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)

ArcSoft TotalMedia (HKLM-x32\...\ArcSoft TotalMedia) (Version: 2.0.39.12 - ArcSoft)

ArcSoft TotalMedia (x32 Version: 1.0.48.25 - ArcSoft) Hidden

ArcSoft Webcam Sharing Manager (HKLM-x32\...\{190A7D93-3823-439C-91B9-ADCE3EC2A6A2}) (Version: 2.0.0.30 - ArcSoft)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

CardRecoveryPro 2.6.5 (HKLM-x32\...\{D9E1CADA-D103-47AE-B3F8-0C0CD0E5856E}_is1) (Version: 2.6.5 - LionSea Software co., ltd)

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Device Access Manager for HP ProtectTools (HKLM\...\{55B52830-024A-443E-AF61-61E1E71AFA1B}) (Version: 6.1.0.1 - Hewlett-Packard Company)

Drive Encryption For HP ProtectTools (HKLM\...\{8A0041CD-277C-4C1F-BFE4-7AC508B20B4C}) (Version: 6.0.100.35469 - Hewlett-Packard Company)

Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)

Face Recognition for HP ProtectTools (HKLM\...\{D3A775F2-2674-4452-8D80-1FC1446052EE}) (Version: 6.00.4407 - Hewlett-Packard Company)

File Sanitizer For HP ProtectTools (HKLM-x32\...\{6D6ADF03-B257-4EA5-BBC1-1D145AF8D514}) (Version: 6.0.0.8 - Hewlett-Packard Company)

Free YouTube Download version 3.2.49.1022 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.49.1022 - DVDVideoSoft Ltd.)

Free YouTube to iPhone Converter version 2.12.9.725 (HKLM-x32\...\Free YouTube to iPhone Converter_is1) (Version: 2.12.9.725 - DVDVideoSoft Ltd.)

Free YouTube to MP3 Converter version 3.12.43.806 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.43.806 - DVDVideoSoft Ltd.)

Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

GeoGebra 4.2 (HKLM-x32\...\GeoGebra 4.2) (Version: 4.2.57.0 - International GeoGebra Institute)

Google Chrome (HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\...\Google Chrome) (Version: 44.0.2403.157 - Google Inc.)

Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.6710.2136 - Google Inc.)

Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden

Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ACHTUNG

Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

HP ESU for Microsoft Windows 7 (HKLM-x32\...\{840021F2-FFC0-467A-BF85-29B8B7803717}) (Version: 2.0.8.1 - Hewlett-Packard Company)

HP ProtectTools Security Manager (HKLM\...\HPProtectTools) (Version: 6.08.1017 - Hewlett-Packard Company)

HP QuickWeb (HKLM-x32\...\{3F437675-F102-4866-BDE1-FFFC7B45EC0B}) (Version: 3.1.2.10229 - Hewlett-Packard Company)

HP Setup (HKLM-x32\...\{03046EBB-CB7C-4B98-BEFB-690EB955DA22}) (Version: 8.5.4526.3645 - Hewlett-Packard Company)

HP SoftPaq Download Manager (HKLM-x32\...\{FE465061-894A-4023-8580-56FCDD4F23F9}) (Version: 3.4.4.0 - Hewlett-Packard Company)

HP Software Framework (HKLM-x32\...\{D2462056-BA75-4B2C-8267-DFEA2B6AC4AE}) (Version: 4.6.10.1 - Hewlett-Packard Company)

HP Software Setup (HKLM-x32\...\{531000B3-DBEE-4115-BBF3-DA48B67C053F}) (Version: 8.2.1.1 - Hewlett-Packard Company)

HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)

HP System Default Settings (HKLM-x32\...\{EE5F1911-EA95-4F1A-AF97-495972F5032D}) (Version: 2.4.3.1 - Hewlett-Packard Company)

HP Wallpaper (HKLM-x32\...\{11C9A461-DD9D-4C71-85A4-6DCE7F99CC44}) (Version: 2.00 - Hewlett-Packard Company)

HP Webcam Driver (HKLM-x32\...\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}) (Version: 5.8.50058.0 - Sonix)

IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6428.0 - IDT)

Intel(R) Identity Protection Technology 1.0.71.0 (HKLM-x32\...\{2C43790E-8470-1027-82D3-DF319F3C410F}) (Version: 1.0.71.0 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)

Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)

InterActual Player (HKLM-x32\...\InterActual Player) (Version:  - )

JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.72.4 - JMicron Technology Corp.)

Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)

Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden

L&H TTS3000 Deutsch (HKLM-x32\...\LHTTSGED) (Version:  - )

Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft_VC90_CRT_x86 (HKLM-x32\...\{DF2035BE-5820-4965-BD97-7FAF8D4A7879}) (Version: 1.0.0 - Microsoft Corporation)

PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.64 - PDF Complete, Inc)

PNotes 9.0.107 (HKLM-x32\...\{949D34E5-F53F-4830-9A50-1E2C39109043}_is1) (Version: 9.0.107 - Andrey Gruber)

Privacy Manager for HP ProtectTools (HKLM\...\{ACA53F68-B003-4D0E-9C3D-0C4EE09D08A8}) (Version: 6.00.831 - Hewlett-Packard Company)

PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden

QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)

Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Realtek Ethernet Controller All-In-One Windows Driver (HKLM-x32\...\{F7E7F0CB-AA41-4D5A-B6F2-8E6738EB063F}) (Version: 7.58.411.2012 - Realtek)

Realtek Motorola BC8 Bluetooth 3.0+HS Adapter (HKLM\...\1DF1F719-D43A-46E8-950F-65A8D96C678A.MBT_is1) (Version: 3.0.82.298 - Motorola Solutions, Inc.)

REALTEK Wireless LAN Driver (HKLM-x32\...\{9D3D8C60-A55F-4123-B2B9-173F09590E16}) (Version: 1.00.11.0706 - REALTEK Semiconductor Corp.)

Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)

Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.0.32.0 - Renesas Electronics Corporation)

Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0 - Renesas Electronics Corporation) Hidden

Safari (HKLM-x32\...\{C779648B-410E-4BBA-B75B-5815BCEFE71D}) (Version: 5.34.57.2 - Apple Inc.)

Stellar Phoenix Photo Recovery (HKLM-x32\...\Stellar Phoenix Photo Recovery_is1) (Version: 6.0.0.1 - Stellar Information Technology Pvt Ltd.)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.9 - Synaptics Incorporated)

Theft Recovery for HP ProtectTools (HKLM-x32\...\InstallShield_{ADC70B7A-530B-46E3-8384-48D22681A41E}) (Version: 6.0.0.33 - Hewlett-Packard Company)

Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.33 - Hewlett-Packard Company) Hidden

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Validity Fingerprint Sensor Driver (HKLM\...\{FFC3E41D-2C2B-45B7-9AD9-5EA19572DD26}) (Version: 4.3.117.0 - Validity Sensors, Inc.)

VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

WinZip 18.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DF}) (Version: 18.0.10661 - WinZip Computing, S.L. )

Wondershare Data Recovery(Build 4.6.1.3) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 4.6.1.3 - Wondershare Software Co.,Ltd.)

Xobni Core (x32 Version: 1.0.0 - Xobni, Inc.) Hidden
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001_Classes\CLSID\{5C8C2A98-6133-4EBA-BBCC-34D9EA01FC2E}\InprocServer32 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)

CustomCLSID: HKU\S-1-5-21-1967446285-4052042257-1953947229-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Karner\AppData\Local\Google\Update\1.3.28.1\psuser_64.dll (Google Inc.)
 

==================== Wiederherstellungspunkte =========================
 

18-08-2015 20:17:20 Windows Update

19-08-2015 17:17:00 Windows Update

25-08-2015 09:17:40 Windows Update

25-08-2015 09:29:20 Removed Bonjour

25-08-2015 18:01:28 Removed Java 8 Update 25

25-08-2015 18:14:48 Removed LPT System Updater Service

25-08-2015 18:24:53 Windows Update

27-08-2015 08:48:24 JRT Pre-Junkware Removal
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {068811E7-4924-45A3-B097-01345AA85C31} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)

Task: {091535C8-09ED-4D16-BA82-336198C54C64} - System32\Tasks\{D1B5A62B-491E-4C77-BA99-4B74DEF58C2A} => Chrome.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsProgressBar

Task: {0D6DE50F-90D6-4EAA-B208-C8BA5761CFB0} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-16] (Adobe Systems Incorporated)

Task: {1412CECA-C375-4C06-B5D7-18CD9F6F62D9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-25] (Google Inc.)

Task: {19E2CD7A-36CC-4598-8209-E17B268FA073} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis Install => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {36EB7F2F-93D0-4D71-B085-44AC327D0B28} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-11] (Google Inc.)

Task: {401C6E53-078F-4607-9B6F-2DF3A1EDDA52} - System32\Tasks\{FDE3F9D0-4C8F-4CD8-AE47-81857AB8A49D} => Chrome.exe hxxp://ui.skype.com/ui/0/6.2.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall

Task: {42EA683E-0D1F-47C9-8457-71F03C78068D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {5ABD082D-5596-41A2-9390-F90E6A8216D6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-25] (Google Inc.)

Task: {A784BA3A-385C-4365-B77C-90ACD4E598EF} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2015-08-11] (Microsoft)

Task: {B6E46B00-F658-4363-845A-00801C0EB25F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-07-11] (Google Inc.)

Task: {EE54F4B1-3524-4694-A9E2-FAEABA43FEF2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {EEC01B1E-C1A7-4ED4-A1CE-E8814CBE1438} - System32\Tasks\{073383A0-77F2-429C-8042-EC46BE9BFC53} => Chrome.exe hxxp://ui.skype.com/ui/0/6.1.0.129.272/de/abandoninstall?page=tsProgressBar

Task: {F5E64A06-D5AF-4EC4-9898-237D24880911} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001Core.job => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe

Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967446285-4052042257-1953947229-1001UA.job => C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2014-03-06 15:00 - 2014-03-06 15:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 

AlternateDataStreams: C:\ProgramData\TEMP:09867A8B

AlternateDataStreams: C:\ProgramData\TEMP:115EA582

AlternateDataStreams: C:\ProgramData\TEMP:2B82C0BB

AlternateDataStreams: C:\ProgramData\TEMP:2CB9631F

AlternateDataStreams: C:\ProgramData\TEMP:31C9BA96

AlternateDataStreams: C:\ProgramData\TEMP:31F2397C

AlternateDataStreams: C:\ProgramData\TEMP:3393A1CA

AlternateDataStreams: C:\ProgramData\TEMP:3D3F1635

AlternateDataStreams: C:\ProgramData\TEMP:4C5C1DD3

AlternateDataStreams: C:\ProgramData\TEMP:4E6B8D68

AlternateDataStreams: C:\ProgramData\TEMP:506698B2

AlternateDataStreams: C:\ProgramData\TEMP:538B96B5

AlternateDataStreams: C:\ProgramData\TEMP:5A8F8A0C

AlternateDataStreams: C:\ProgramData\TEMP:5C28E25F

AlternateDataStreams: C:\ProgramData\TEMP:5C353220

AlternateDataStreams: C:\ProgramData\TEMP:66F19688

AlternateDataStreams: C:\ProgramData\TEMP:68DE552E

AlternateDataStreams: C:\ProgramData\TEMP:6BD304B9

AlternateDataStreams: C:\ProgramData\TEMP:6FDE1666

AlternateDataStreams: C:\ProgramData\TEMP:7E0EFF7B

AlternateDataStreams: C:\ProgramData\TEMP:80B291A7

AlternateDataStreams: C:\ProgramData\TEMP:80E965A3

AlternateDataStreams: C:\ProgramData\TEMP:81653DC8

AlternateDataStreams: C:\ProgramData\TEMP:871526BA

AlternateDataStreams: C:\ProgramData\TEMP:89A5891E

AlternateDataStreams: C:\ProgramData\TEMP:89C2A42C

AlternateDataStreams: C:\ProgramData\TEMP:8B076EC5

AlternateDataStreams: C:\ProgramData\TEMP:8D565A9B

AlternateDataStreams: C:\ProgramData\TEMP:91486201

AlternateDataStreams: C:\ProgramData\TEMP:A1D3FEF0

AlternateDataStreams: C:\ProgramData\TEMP:A561576B

AlternateDataStreams: C:\ProgramData\TEMP:AE2EA3C2

AlternateDataStreams: C:\ProgramData\TEMP:BD4CC9FB

AlternateDataStreams: C:\ProgramData\TEMP:C7F08EA3

AlternateDataStreams: C:\ProgramData\TEMP:D0757AAB

AlternateDataStreams: C:\ProgramData\TEMP:D3A8AA31

AlternateDataStreams: C:\ProgramData\TEMP:D7C0213D

AlternateDataStreams: C:\ProgramData\TEMP:E81603BC

AlternateDataStreams: C:\ProgramData\TEMP:F0D7EE30

AlternateDataStreams: C:\ProgramData\TEMP:F264BECE

AlternateDataStreams: C:\ProgramData\TEMP:F6DA3F39

AlternateDataStreams: C:\ProgramData\TEMP:FBFC061F

AlternateDataStreams: C:\ProgramData\TEMP:FDF9B285
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-1967446285-4052042257-1953947229-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Karner\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

DNS Servers: 8.8.8.8 - 8.8.4.4

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)

Windows Firewall ist aktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

MSCONFIG\Services: ACDaemon => 3

MSCONFIG\Services: AdobeFlashPlayerUpdateSvc => 3

MSCONFIG\Services: AESTFilters => 2

MSCONFIG\Services: Bluetooth Device Manager => 3

MSCONFIG\Services: Bluetooth Media Service => 3

MSCONFIG\Services: Bluetooth OBEX Service => 2

MSCONFIG\Services: Bonjour Service => 2

MSCONFIG\Services: FLEXnet Licensing Service => 3

MSCONFIG\Services: FLEXnet Licensing Service 64 => 3

MSCONFIG\Services: gupdate => 2

MSCONFIG\Services: gupdatem => 3

MSCONFIG\Services: gusvc => 3

MSCONFIG\Services: McAfee Endpoint Encryption Agent => 2

MSCONFIG\Services: pdfcDispatcher => 2

MSCONFIG\Services: STacSV => 2

MSCONFIG\Services: uArcCapture => 2

MSCONFIG\startupfolder: C:^Users^Karner^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk => C:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: BTMTrayAgent => rundll32.exe "C:\Program Files\Motorola\Bluetooth\btmshell.dll",TrayApp

MSCONFIG\startupreg: DTRun => c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe

MSCONFIG\startupreg: EADM => "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart

MSCONFIG\startupreg: Google Update => "C:\Users\Karner\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: GoogleChromeAutoLaunch_62EF63C3DC09A815C0F2BB9555814766 => "C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window

MSCONFIG\startupreg: iCloudServices => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe

MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

MSCONFIG\startupreg: MfeEpePcMonitor => "C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe"

MSCONFIG\startupreg: PDF Complete => C:\Program Files (x86)\PDF Complete\pdfsty.exe

MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

MSCONFIG\startupreg: Sony PC Companion => "C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe" /Background

MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

MSCONFIG\startupreg: swg => "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

MSCONFIG\startupreg: SysTrayApp => C:\Program Files\IDT\WDM\sttray64.exe
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [{42588269-55E3-4799-BAF6-51EC2EB5964B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{CEA35843-A934-4488-B8F4-EEAE1A9969D2}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe

FirewallRules: [{7B2F6CA2-E1F4-4256-A1AA-CBA9309DBD8B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{D68A3AAC-F1A0-466E-8315-518D209FE712}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe

FirewallRules: [{72F2F83C-0D74-4637-B3F7-2D6835F264E5}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

FirewallRules: [{0ED66A34-2E5E-45F5-AA1F-CF79D739C7DA}] => (Allow) LPort=2869

FirewallRules: [{204A5EFB-DC6F-4CB7-8547-5CCF936FC991}] => (Allow) LPort=1900

FirewallRules: [{F9CFB0B5-2E03-4C54-93F4-8D18BD2365A7}] => (Allow) C:\Users\Karner\AppData\Local\Google\Chrome\Application\chrome.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 

Name: Teredo Tunneling Pseudo-Interface

Description: Microsoft-Teredo-Tunneling-Adapter

Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}

Manufacturer: Microsoft

Service: tunnel

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (08/27/2015 08:45:03 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/27/2015 07:12:01 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/26/2015 07:49:40 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (08/26/2015 07:42:21 AM) (Source: WinMgmt) (EventID: 10) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
 

Systemfehler:

=============

Error: (08/27/2015 08:49:28 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/27/2015 08:49:28 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "Intel(R) Rapid Storage Technology" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/27/2015 08:49:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "HP Support Assistant Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Microsoft .NET Framework NGEN v4.0.30319_X64" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:27 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:26 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Software Protection" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:26 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "HP Software Framework Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (08/27/2015 08:49:26 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Modules Installer" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
 

Error: (08/27/2015 08:49:25 AM) (Source: Service Control Manager) (EventID: 7031) (User: )

Description: Der Dienst "Windows Live ID Sign-in Assistant" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
 
 

Microsoft Office:

=========================
 

CodeIntegrity:

===================================

  Date: 2015-08-27 08:56:36.307

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:56:35.055

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:56:26.393

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:56:25.016

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:56:18.634

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:55:53.271

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:50:54.627

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-27 08:48:08.833

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:17:13.825

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 

  Date: 2015-08-26 08:16:24.190

  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\AESTAR64.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
 
 

==================== Speicherinformationen =========================== 
 

Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz

Prozentuale Nutzung des RAM: 41%

Installierter physikalischer RAM: 4030.36 MB

Verfügbarer physikalischer RAM: 2364.93 MB

Summe virtueller Speicher: 10172.56 MB

Verfügbarer virtueller Speicher: 8302.37 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:572.75 GB) (Free:472.28 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]

Drive d: (desinfDATA) (Removable) (Total:4.81 GB) (Free:4.81 GB) FAT32

Drive e: (HP_RECOVERY) (Fixed) (Total:18.13 GB) (Free:2.76 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]

Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.1 GB) FAT32
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 12DEB3A0)

Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=572.7 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=18.1 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
 

========================================================

Disk: 1 (Size: 14.6 GB) (Disk ID: 00000000)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Google Update Helper
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Ein Google Update Helper ist nicht installiert.

Abgesehen davon, dass eine Menge Junkware, Adware etc... entfernt wurde (Vielen Dank dafür!), glaube ich, dass das System wegen Kaspersky und den ganzen (eigentlich unnötigen) HP-"Optimierungs"tools so langsam ist.

Dann vergiss den Schritt :D

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fixlog.txt

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-08-2015 02

durchgeführt von Karner (2015-08-27 10:34:50) Run:1

Gestartet von C:\Users\Karner\Desktop

Geladene Profile: Karner (Verfügbare Profile: Karner)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

EmptyTemp:

         

*****************
 

EmptyTemp: => 81.7 MB temporäre Dateien entfernt.
 
 

Das System musste neu gestartet werden.. 
 

==== Ende von Fixlog 10:34:54 ====

Okay, dann Kontrollscans mit ESET und SC bitte:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Eset log.txt

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# end=init

# utc_time=2015-08-27 09:03:31

# local_time=2015-08-27 11:03:31 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 25472

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# end=updated

# utc_time=2015-08-27 09:11:38

# local_time=2015-08-27 11:11:38 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# engine=25472

# end=stopped

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-08-27 10:54:23

# local_time=2015-08-27 12:54:23 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Kaspersky Internet Security'

# compatibility_mode=1296 16777213 100 100 7601 44749145 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 10329 192302713 0 0

# scanned=187754

# found=12

# cleaned=0

# scan_time=6164

sh=EE2D8A0C16CB4F60E07AD30BC8F4AF2D25E4FF62 ft=1 fh=c2a60ef126908cf5 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSS.exe"

sh=24A108C48173FDD9962F7CC3D4DB4B852D864838 ft=1 fh=0501d0dc4c9a869f vn="Variante von Win32/Systweak.N evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSHelper.dll"

sh=915239C2678EFCE5C2E45012595BEA0C050864B4 ft=1 fh=9ca6c4d86ffea4d8 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSPrivacyProtector.exe"

sh=67A75BAA7A5BBB2EEEBB99D490F00F82D0BB1E09 ft=1 fh=5d5a0ac2ab2c0a85 vn="Variante von Win32/Systweak evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegClean.exe"

sh=2C09414F7BCF16F3C9A358B5CCD4492EF7EEF08E ft=1 fh=5545a1a02bc092d6 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegistryOptimizer.exe"

sh=322DCE4CCA5EB266FFEDD900C6D628769AD18300 ft=1 fh=b3d66e50f9e4f6b1 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSSystemCleaner.exe"

sh=1B3BC0E13B5802F3964DC83B429152E76C836942 ft=1 fh=d18784b6cbc4f915 vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Karner\Downloads\vlc-2.1.3-win32 (1).exe"

sh=DE0F453AD7E45914C2F6E2A6BC782AFB6DB94B9D ft=1 fh=1f461786edf5f19c vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Karner\Downloads\vlc-2.1.3-win32.exe"

sh=4E5D92595443236644E528632B6699C8A7EBE8D5 ft=1 fh=1eb7510ee00f9c58 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.shdocvw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll.VIRUS"

sh=23A8AD9A547A04515A095AD30A92081316A9BEC3 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\Installer\192b56.msi"

sh=23A839B25012DC3927ED54415B909EA64E0B4507 ft=1 fh=0c1023af87e9e4b9 vn="Variante von Win64/BrowseFox.AS evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.VIRUS"

sh=7BCB9BA8A6F017842C686AC5F03A292F9ABDBB17 ft=1 fh=209f032113ea6f71 vn="Variante von Win64/BrowseFox.AS evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys.VIRUS"

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# end=init

# utc_time=2015-08-27 01:16:32

# local_time=2015-08-27 03:16:32 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# osver=6.1.7601 NT Service Pack 1

Update Init

Update Download

Update Finalize

Updated modules version: 25475

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# end=updated

# utc_time=2015-08-27 01:17:07

# local_time=2015-08-27 03:17:07 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# osver=6.1.7601 NT Service Pack 1

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7777

# api_version=3.1.1

# EOSSerial=880eca8d84b90c43ad6900a4ecb36480

# engine=25475

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2015-08-27 02:48:50

# local_time=2015-08-27 04:48:50 (+0100, Mitteleuropäische Sommerzeit)

# country="Austria"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1='Kaspersky Internet Security'

# compatibility_mode=1296 16777213 100 100 5775 44763212 0 0

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 24396 192316780 0 0

# scanned=222254

# found=12

# cleaned=0

# scan_time=5503

sh=EE2D8A0C16CB4F60E07AD30BC8F4AF2D25E4FF62 ft=1 fh=c2a60ef126908cf5 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSS.exe"

sh=24A108C48173FDD9962F7CC3D4DB4B852D864838 ft=1 fh=0501d0dc4c9a869f vn="Variante von Win32/Systweak.N evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSHelper.dll"

sh=915239C2678EFCE5C2E45012595BEA0C050864B4 ft=1 fh=9ca6c4d86ffea4d8 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSPrivacyProtector.exe"

sh=67A75BAA7A5BBB2EEEBB99D490F00F82D0BB1E09 ft=1 fh=5d5a0ac2ab2c0a85 vn="Variante von Win32/Systweak evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegClean.exe"

sh=2C09414F7BCF16F3C9A358B5CCD4492EF7EEF08E ft=1 fh=5545a1a02bc092d6 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegistryOptimizer.exe"

sh=322DCE4CCA5EB266FFEDD900C6D628769AD18300 ft=1 fh=b3d66e50f9e4f6b1 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSSystemCleaner.exe"

sh=1B3BC0E13B5802F3964DC83B429152E76C836942 ft=1 fh=d18784b6cbc4f915 vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Karner\Downloads\vlc-2.1.3-win32 (1).exe"

sh=DE0F453AD7E45914C2F6E2A6BC782AFB6DB94B9D ft=1 fh=1f461786edf5f19c vn="NSIS/StartPage.CC Trojaner" ac=I fn="C:\Users\Karner\Downloads\vlc-2.1.3-win32.exe"

sh=4E5D92595443236644E528632B6699C8A7EBE8D5 ft=1 fh=1eb7510ee00f9c58 vn="Variante von Win32/Toolbar.Linkury.G evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\assembly\GAC_MSIL\Interop.shdocvw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll.VIRUS"

sh=23A8AD9A547A04515A095AD30A92081316A9BEC3 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\Installer\192b56.msi"

sh=23A839B25012DC3927ED54415B909EA64E0B4507 ft=1 fh=0c1023af87e9e4b9 vn="Variante von Win64/BrowseFox.AS evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.VIRUS"

sh=7BCB9BA8A6F017842C686AC5F03A292F9ABDBB17 ft=1 fh=209f032113ea6f71 vn="Variante von Win64/BrowseFox.AS evtl. unerwÃŒnschte Anwendung" ac=I fn="C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys.VIRUS"

checkup.txt

Code:

 Results of screen317's Security Check version 1.006  

 Windows 7 Service Pack 1 x64 (UAC is disabled!)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

Kaspersky Internet Security   

 Antivirus up to date!  (On Access scanning disabled!) 
 `````````Anti-malware/Other Utilities Check:````````` 

 Google Chrome (44.0.2403.155) 

 Google Chrome (44.0.2403.157) 
 ````````Process Check: objlist.exe by Laurent````````  

 Kaspersky Lab Kaspersky Internet Security 15.0.0 avp.exe  

 Kaspersky Lab Kaspersky Internet Security 15.0.0 avpui.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST-Fix

Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft!

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

C:\Program Files\WinZip\Utils\WzSysScan

C:\Users\Karner\Downloads\vlc-2.1.3-win32 (1).exe

C:\Users\Karner\Downloads\vlc-2.1.3-win32.exe

C:\Windows\assembly\GAC_MSIL\Interop.shdocvw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll.VIRUS

C:\Windows\Installer\192b56.msi

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.VIRUS

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys.VIRUS

EmptyTemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Fixlog.txt

Code:

Entferungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-08-2015 02

durchgeführt von Karner (2015-08-27 18:46:58) Run:4

Gestartet von C:\Users\Karner\Desktop

Geladene Profile: Karner (Verfügbare Profile: Karner)

Start-Modus: Normal

==============================================
 

fixlist Inhalt:

*****************

C:\Program Files\WinZip\Utils\WzSysScan

C:\Users\Karner\Downloads\vlc-2.1.3-win32 (1).exe

C:\Users\Karner\Downloads\vlc-2.1.3-win32.exe

C:\Windows\assembly\GAC_MSIL\Interop.shdocvw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll.VIRUS

C:\Windows\Installer\192b56.msi

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.VIRUS

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys.VIRUS

EmptyTemp:

         
 

*****************
 

C:\Program Files\WinZip\Utils\WzSysScan => erfolgreich verschoben

C:\Users\Karner\Downloads\vlc-2.1.3-win32 (1).exe => erfolgreich verschoben

C:\Users\Karner\Downloads\vlc-2.1.3-win32.exe => erfolgreich verschoben

C:\Windows\assembly\GAC_MSIL\Interop.shdocvw\1.1.0.0__84542ff99aed6a4d\Interop.SHDocVw.dll.VIRUS => erfolgreich verschoben

C:\Windows\Installer\192b56.msi => erfolgreich verschoben

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys.VIRUS => erfolgreich verschoben

C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}w64.sys.VIRUS => erfolgreich verschoben

EmptyTemp: => 106.8 MB temporäre Dateien entfernt.
 
 

Das System musste neu gestartet werden.. 
 

==== Ende von Fixlog 18:46:59 ====

Sieht soweit ok aus :daumenhoc

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) empfehle ich die Erweiterung Ghostery, diese verhindert weitgehend Usertracking bzw. das Anzeigen von Werbebannern.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Ghostery kenn ich, habe ich jetzt auch hier installiert. Danke für den Tipp!

Prinzipiell habe ich jetzt keine Beschwerden/Probleme mehr, allerdings läuft das System immer noch etwas langsam. Aber ich glaube, dass ist nur meine persönliche Meinung, ich bin halt ein wesentlich schnellers System (unter anderem mit SSD) gewohnt.

Wie auch immer, vielen Dank! Der Spendenlink unterstüzt alle Helfer hier, oder?

Dann wären wir durch! :daumenhoc

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

Abschließend müssen wir noch ein paar Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern.

http://deeprybka.trojaner-board.de/b...cleanupneu.png
Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
http://deeprybka.trojaner-board.de/b.../combofix2.pngCombofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

http://deeprybka.trojaner-board.de/b...ast/schild.png
Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

	Emsisoft	MSE
	http://filepony.de/icon/emsisoft_anti_malware.png	http://filepony.de/icon/microsoft_se...essentials.png

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
http://filepony.de/icon/ghostery_chrome.pngGhostery Erkennt und blockiert Tracker, Web Bugs, Pixel und Beacons und weitere Scripte, die das Surfverhalten ausspähen/beobachten.
http://filepony.de/icon/malwarebytes_anti_exploit.pngMalwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie http://filepony.de/images/microbanner.gif.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich dieses Thema aus meinen Abos löschen kann.