Hi schrauber,
ich hoffe ich war nicht zu ungeduldig, aber ich brauch den Rechner morgen unbedingt "sauber", deshalb hab ich mich an einigen ähnlichen Threads orientiert und nach Mbar auch Mbam und AdwCleaner durchgeführt.
Mbam: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Suchlaufdatum: 03.09.2015
Suchlaufzeit: 20:34
Protokolldatei: mbam.txt
Administrator: Ja
Version: 2.1.8.1057
Malware-Datenbank: v2015.09.03.06
Rootkit-Datenbank: v2015.08.16.01
Lizenz: Kostenlose Version
Malware-Schutz: Deaktiviert
Schutz vor bösartigen Websites: Deaktiviert
Selbstschutz: Deaktiviert
Betriebssystem: Windows 8.1
CPU: x64
Dateisystem: NTFS
Benutzer: cagiv_000
Suchlauftyp: Bedrohungssuchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 347065
Abgelaufene Zeit: 24 Min., 35 Sek.
Speicher: Aktiviert
Start: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert
Prozesse: 1
PUP.Optional.HideBaid, C:\Program Files (x86)\baidu\pps.exe, 3012, Löschen bei Neustart, [ceb478b3f19a88ae7f1fdbfdc33eb34d]
Module: 0
(keine bösartigen Elemente erkannt)
Registrierungsschlüssel: 9
PUP.Optional.OasisSpace, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{567dbf58-4713-45f4-a623-e7b41f898209}, In Quarantäne, [daa8a586761544f2e09b1bc46a984cb4],
PUP.Optional.OasisSpace, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{567DBF58-4713-45F4-A623-E7B41F898209}, In Quarantäne, [daa8a586761544f2e09b1bc46a984cb4],
PUP.Optional.OasisSpace, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{567DBF58-4713-45F4-A623-E7B41F898209}, In Quarantäne, [daa8a586761544f2e09b1bc46a984cb4],
PUP.Optional.OasisSpace, HKU\S-1-5-21-3288637145-890345418-2317591297-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{567DBF58-4713-45F4-A623-E7B41F898209}, In Quarantäne, [daa8a586761544f2e09b1bc46a984cb4],
PUP.Optional.OasisSpace, HKU\S-1-5-21-3288637145-890345418-2317591297-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{567DBF58-4713-45F4-A623-E7B41F898209}, In Quarantäne, [daa8a586761544f2e09b1bc46a984cb4],
PUP.Optional.OasisSpace, HKLM\SOFTWARE\WOW6432NODE\Oasis Space, In Quarantäne, [b8ca40ebc6c54beb9fc5623f3bc9629e],
PUP.Optional.WordShark, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\WordSharkAutoUpdateClient_RASAPI32, In Quarantäne, [d7ab2209187358de6e4a665516ee8b75],
PUP.Optional.WordShark, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\WordSharkAutoUpdateClient_RASMANCS, In Quarantäne, [01812dfe6823e4523187ae0d2dd7a15f],
PUP.Optional.OasisSpace, HKU\S-1-5-21-3288637145-890345418-2317591297-1001\SOFTWARE\Oasis Space, In Quarantäne, [a5ddb07b39528babef73475a24e0b54b],
Registrierungswerte: 7
PUP.Optional.HideBaid, HKU\S-1-5-21-3288637145-890345418-2317591297-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|apphide, C:\Program Files (x86)\baidu\pps.exe, In Quarantäne, [ceb478b3f19a88ae7f1fdbfdc33eb34d]
PUP.Optional.IOProtect, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|IOPROTECT, C:\Users\CAGIV_~1\AppData\Local\Temp\WIZZ\ioproduct_service.bat, In Quarantäne, [abd7f437246725111aaef69ff80cad53]
PUP.Optional.SpaceSoundPro, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SpaceSoundPro, "C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe", In Quarantäne, [d8aa68c3711aea4cc130baf5f50fbd43]
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS, Crossbrowse, In Quarantäne, [2a58a2895d2ef145a787c9bbef15629e]
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS|StubPath, "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\39.6.2171.95\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level, In Quarantäne, [a5dd24073655ee4867c7d5affe06a759]
PUP.Optional.CrossBrowse, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS|Localized Name, Crossbrowse, In Quarantäne, [0f7314177f0c71c51f0f99eb61a39967]
PUP.Optional.CrossBrowse, HKU\S-1-5-21-3288637145-890345418-2317591297-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|GoogleChromeAutoLaunch_9ED3C245CA04F4CE6CBAB75328AA24EA, "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window, In Quarantäne, [85fd89a26b20b87e42e7483c788c966a]
Registrierungsdaten: 0
(keine bösartigen Elemente erkannt)
Ordner: 6
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ, Löschen bei Neustart, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.MultiPlug, C:\Program Files (x86)\C8D80BD0-1440964834-11E3-8279-54EE751A7601, In Quarantäne, [473b042793f81026b98e2a754abaa858],
PUP.Optional.OasisSpace, C:\Users\cagiv_000\AppData\Local\Temp\Oasis Space, In Quarantäne, [0b779893f09bcf6768aee52f778c758b],
PUP.Optional.ProtectWindowsManager, C:\ProgramData\MWdsManProM, In Quarantäne, [cfb380ab18734bebe135d1518182936d],
PUP.Optional.ProtectWindowsManager, C:\ProgramData\rWdsManPror, In Quarantäne, [a4de210a484393a353c3c260e51e4ab6],
PUP.Optional.ProtectWindowsManager, C:\ProgramData\rWdsManPror\update, In Quarantäne, [a4de210a484393a353c3c260e51e4ab6],
Dateien: 88
PUP.Optional.HideBaid, C:\Program Files (x86)\baidu\pps.exe, Löschen bei Neustart, [ceb478b3f19a88ae7f1fdbfdc33eb34d],
PUP.Optional.WProtectManager, C:\ProgramData\MWdsManProM\WdsManPro.exe, In Quarantäne, [0e749a91b6d59c9ad391f5a25fa637c9],
PUP.Optional.WProtectManager, C:\ProgramData\rWdsManPror\WdsManPro.exe, In Quarantäne, [a9d9d358acdf2412b5af8e098f76f709],
PUP.Optional.HideBaid, C:\Program Files (x86)\baidu\Bind.exe, In Quarantäne, [127072b9acdf9f974954696f7c85619f],
PUP.Optional.CrossRider, C:\Users\cagiv_000\AppData\Local\Temp\4170.exe, In Quarantäne, [b4ce3bf018731125ee36494d887d07f9],
PUP.Optional.CrossRider, C:\Users\cagiv_000\AppData\Local\Temp\7147.exe, In Quarantäne, [483aaa81c5c66ccadb494056848108f8],
Trojan.MSIL.Dropper, C:\Users\cagiv_000\AppData\Local\Temp\rt-update.exe, In Quarantäne, [354d2ffc404ba98d98e3a6a27c890cf4],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\nsj7BDB.tmp, In Quarantäne, [6a18bf6cc8c3cd6905063a8c02ff42be],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\ICReinstall_nsj7BDB.tmp, In Quarantäne, [29598e9df29937ff6c9f9432d130629e],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\ICReinstall_nsuA47F.tmp, In Quarantäne, [b1d1111a8cffb28418f3daec0ef3c43c],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\ICReinstall_nsz37BD.tmp, In Quarantäne, [2f53bf6c6328f83ee427893d26dbe61a],
PUP.Optional.OptimizerPro, C:\Users\cagiv_000\AppData\Local\Temp\optprosetup.exe, In Quarantäne, [4042bc6f612a1d19831a755240c10df3],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\nsz37BD.tmp, In Quarantäne, [0b77dd4e8209e94db952c7ff20e114ec],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\nsuA47F.tmp, In Quarantäne, [e69c52d91d6e0c2a987302c47f82da26],
PUP.Optional.WordShark, C:\Users\cagiv_000\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\adv_151.exe, In Quarantäne, [641ef932f794003602edc108877af907],
PUP.Optional.ShopperPro, C:\Users\cagiv_000\AppData\Local\Temp\Install_9180\ins_shopperpro.exe, In Quarantäne, [dda56bc09eed0135ccf60cbcd42d13ed],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-0EJLT.tmp\436.exe, In Quarantäne, [5e2473b86f1c9f972660972d778abd43],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-0EJLT.tmp\465.exe, In Quarantäne, [1a68a18a5c2fa492275faf15a25f01ff],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-0EJLT.tmp\package_oursurfing_installer_multilang.exe, In Quarantäne, [d7ab0d1e8704d0661f675b69a65b728e],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-0EJLT.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [b0d2df4c2d5eb97d0d79952f03fe51af],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-0EJLT.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [2e542efd850684b26c1a06be5aa70af6],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-BG1GK.tmp\436.exe, In Quarantäne, [0082f13a90fb92a4bbcba42048b91ee2],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [f0920d1e5c2ffc3acd82123923e256aa],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\11.exe, In Quarantäne, [aed41e0d66250e28d17e3f0c0bfa649c],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\380.exe, In Quarantäne, [4f3385a6800bf046f857c78465a021df],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\420.exe, In Quarantäne, [3e443cef008bca6c7ed14605ba4b2cd4],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\436.exe, In Quarantäne, [5f2323080487f1452d22b299f80dce32],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\465.exe, In Quarantäne, [bac8ae7d4a41a393b699a9a2fa0bfc04],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_bobrowser_installer_multilang.exe, In Quarantäne, [4a38f437adde6dc983cc0e3d8d7807f9],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_oursurfing_installer_multilang.exe, In Quarantäne, [2b57111a4c3fab8bf45bb19aa362d52b],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [fd854be0f398f44247081c2f788dd22e],
PUP.Optional.SearchProtect, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [5c26bd6e2d5ed2640f6b3c1b6b95a759],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-C83CB.tmp\package_vuupc_installer_multilang.exe, In Quarantäne, [e99988a3dcaf270ff55ade6d38cdc43c],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\package_oursurfing_installer_multilang.exe, In Quarantäne, [98ea210a3d4e3ef890f6289c33ce26da],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\380.exe, In Quarantäne, [10722a014c3ff73fd6b07a4a659c6c94],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\420.exe, In Quarantäne, [79090724b5d63303374f8341ca3746ba],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\436.exe, In Quarantäne, [e2a054d7e9a253e3d0b6bf05857c7f81],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\455.exe, In Quarantäne, [0e74082384070e284b3b289cc93818e8],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\465.exe, In Quarantäne, [e49e38f338534aecfc8a5e665fa209f7],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\600.exe, In Quarantäne, [a1e147e4f89396a0fa8c22a2d22fba46],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\607.exe, In Quarantäne, [c6bca08ba3e865d16b1bc4004ab76997],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\611.exe, In Quarantäne, [790960cbb3d8c67044428341eb16d729],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\package_bobrowser_installer_multilang.exe, In Quarantäne, [5d25ec3facdf5adc40466f5536cb827e],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [0181e7444c3f2f070b7b269eec150cf4],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [22602209b1da60d66125d3f13ac7ef11],
PUP.Optional.SearchProtect, C:\Users\cagiv_000\AppData\Local\Temp\is-EFOOR.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [443eba7128635bdbd5a54f0854aced13],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-F1GDP.tmp\11.exe, In Quarantäne, [52301f0ce2a9b581ed62dc6f1bea857b],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-F1GDP.tmp\436.exe, In Quarantäne, [681ad754fb902115450a06456a9b51af],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-F1GDP.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [1171ae7db4d7cf67321da1aa689daf51],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-F1GDP.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [d6ac19128506082e85ca014a04018a76],
PUP.Optional.SearchProtect, C:\Users\cagiv_000\AppData\Local\Temp\is-F1GDP.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [4f3337f4c2c9f83e28525dfa8b7504fc],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\package_oursurfing_installer_multilang.exe, In Quarantäne, [661c73b84e3de05650366a5a35ccce32],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\420.exe, In Quarantäne, [1b67db50494294a2c5c16d572dd48b75],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\436.exe, In Quarantäne, [681abb70f19a1323bacc2e96a65bfb05],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\455.exe, In Quarantäne, [572b06250c7f26108afc0fb591702bd5],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\465.exe, In Quarantäne, [117168c373181b1b7412dee62ad7cf31],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\557.exe, In Quarantäne, [b7cb0823d9b2f0461c6affc5ec15b848],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\600.exe, In Quarantäne, [334fa5869bf0bb7bbcca655f15ecfe02],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\607.exe, In Quarantäne, [740e0c1f8b00181efe88bf0545bc649c],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\610.exe, In Quarantäne, [3151141792f987afb9cd61638f7237c9],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\611.exe, In Quarantäne, [5929d5567615290da4e2c202da2730d0],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\package_bobrowser_installer_multilang.exe, In Quarantäne, [aed4f13a1f6c4cea7c0a2d975aa716ea],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [cfb30c1f0f7c40f6a6e0d8ec41c05aa6],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [f38f7ab1612a5cdafc8ab80c3ec306fa],
PUP.Optional.SearchProtect, C:\Users\cagiv_000\AppData\Local\Temp\is-R5JDP.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [40426ac1632853e3295190c749b74cb4],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\package_oursurfing_installer_multilang.exe, In Quarantäne, [71110922aeddd1652066dbe95da4db25],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\380.exe, In Quarantäne, [483a49e291fa76c0a6e08c389e639a66],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\420.exe, In Quarantäne, [3a4874b722699a9cfd89834138c9f907],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\436.exe, In Quarantäne, [cab8c467b0db89ad206605bf33ceae52],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\455.exe, In Quarantäne, [c6bca18a6b209b9bd9ad982c7f82619f],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\465.exe, In Quarantäne, [b9c963c84942043201856c58ba4726da],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\600.exe, In Quarantäne, [cdb5b07b2c5fa591ec9accf8e31ed729],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\607.exe, In Quarantäne, [bbc7e7449bf06cca46409331c43d758b],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\611.exe, In Quarantäne, [a1e146e5404b0d2951350eb6ef12ad53],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\package_bobrowser_installer_multilang.exe, In Quarantäne, [156dc8638308bb7b1670f6ce45bcc040],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\package_pcrossbrowser_installer_multilang.exe, In Quarantäne, [bac85fccc3c8b1858ff7d3f145bcb54b],
PUP.Optional.EoRezo, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\package_SByoutube_installer_multilang.exe, In Quarantäne, [d4ae76b5e0abe94dbfc76d5708f914ec],
PUP.Optional.SearchProtect, C:\Users\cagiv_000\AppData\Local\Temp\is-USLV1.tmp\package_secureprotect_installer_multilang.exe, In Quarantäne, [f68c9f8c2566e5510f6b45121ce4b24e],
PUP.Optional.InstallCore, C:\Users\cagiv_000\AppData\Local\Temp\is45637729\100625443_stp\icc.dll, In Quarantäne, [2b57c467b7d4c67096ce434e0bf79e62],
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ\ioprotect_conf.xml, In Quarantäne, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ\config.cfg, In Quarantäne, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ\ioproduct.exe, Löschen bei Neustart, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ\ioproduct_service.bat, In Quarantäne, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.IOProtect, C:\Users\cagiv_000\AppData\Local\Temp\WIZZ\ioprotect.exe, Löschen bei Neustart, [abd7f437246725111aaef69ff80cad53],
PUP.Optional.MultiPlug, C:\Program Files (x86)\C8D80BD0-1440964834-11E3-8279-54EE751A7601\vnsw6D14.tmp, In Quarantäne, [473b042793f81026b98e2a754abaa858],
PUP.Optional.MultiPlug, C:\Program Files (x86)\C8D80BD0-1440964834-11E3-8279-54EE751A7601\rnsvC280.exe, In Quarantäne, [473b042793f81026b98e2a754abaa858],
PUP.Optional.MultiPlug, C:\Program Files (x86)\C8D80BD0-1440964834-11E3-8279-54EE751A7601\Uninstall.exe, In Quarantäne, [473b042793f81026b98e2a754abaa858],
PUP.Optional.ProtectWindowsManager, C:\ProgramData\rWdsManPror\updateconf, In Quarantäne, [a4de210a484393a353c3c260e51e4ab6],
Physische Sektoren: 0
(keine bösartigen Elemente erkannt)
(end)
FRST: Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:31-08-2015
durchgeführt von cagiv_000 (Administrator) auf LENOVO-PC (03-09-2015 21:06:33)
Gestartet von C:\Users\cagiv_000\Desktop
Geladene Profile: cagiv_000 (Verfügbare Profile: cagiv_000)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(Intel Corporation) C:\WINDOWS\System32\igfxCUIService.exe
(Microsoft Corporation) C:\WINDOWS\System32\wlanext.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Lenovo\Lenovo Recommends\Service\x64\LenovoRecommends.AppService.exe
(IObit) C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
(Nalpeiron Ltd.) C:\WINDOWS\SysWOW64\NLSSRV32.EXE
(PointGrab LTD) C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Lenovo) C:\ProgramData\LenovoTransition\Server\x64\ymc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\WINDOWS\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\WINDOWS\System32\igfxEM.exe
(Intel Corporation) C:\WINDOWS\System32\igfxHK.exe
() C:\WINDOWS\System32\igfxTray.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(Microsoft Corporation) C:\WINDOWS\System32\GWX\GWX.exe
(Microsoft Corporation) C:\WINDOWS\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek semiconductor) C:\WINDOWS\RTFTrack.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvTrayLoad.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
(Lenovo) C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Recommends\Lenovo Recommends.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
() C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(IObit) C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
(Microsoft Corporation) C:\WINDOWS\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17709_none_fa7932f59afc2e40\TiWorker.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvController.exe
(Microsoft Corporation) C:\WINDOWS\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
(Microsoft Corporation) C:\WINDOWS\System32\dllhost.exe
==================== Registry (Nicht auf der Ausnahmeliste) ===========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [IgfxTray] => C:\WINDOWS\system32\igfxtray.exe [393480 2015-03-19] ()
HKLM\...\Run: [HotKeysCmds] => "C:\WINDOWS\system32\hkcmd.exe"
HKLM\...\Run: [Persistence] => "C:\WINDOWS\system32\igfxpers.exe"
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286056 2013-09-24] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13667032 2014-02-24] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_DOLBYDRAGON] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_LENOVO_MICPKEY] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1381744 2014-02-25] (Realtek Semiconductor)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [280576 2013-10-21] (Realtek Semiconductor Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-10-17] (Realtek semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2786032 2014-02-25] (Synaptics Incorporated)
HKLM\...\Run: [AutoStartTransition] => C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe [294672 2014-06-09] ()
HKLM\...\Run: [PhoneCompanion] => C:\Program Files\Lenovo PhoneCompanion\Phone Companion.exe [836592 2014-06-09] (Lenovo)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [16094704 2014-06-09] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [10841584 2014-06-09] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [Lenovo Recommends] => C:\Program Files (x86)\Lenovo\Lenovo Recommends\Lenovo Recommends.exe [119280 2014-01-09] (Lenovo)
HKLM-x32\...\Run: [CitrixReceiver] => "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Citrix\Receiver Updater.lnk"
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [407904 2014-11-27] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153952 2014-11-27] (Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{40DD82DC-7A58-4C6C-9FC8-A77D583682EC}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{C969BCA5-B87B-4549-AC16-51C4D6CC2849}: [DhcpNameServer] 172.168.137.2
Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130856909202668786&GUID=C0308816-B3CF-4FD4-8052-8E3585F0BC3C
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130856909202692374&GUID=C0308816-B3CF-4FD4-8052-8E3585F0BC3C
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-3288637145-890345418-2317591297-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130856909202788358&GUID=C0308816-B3CF-4FD4-8052-8E3585F0BC3C
HKU\S-1-5-21-3288637145-890345418-2317591297-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-3288637145-890345418-2317591297-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
URLSearchHook: HKLM-x32 -> Standard = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll [2014-11-27] (Citrix Systems, Inc.)
FireFox:
========
FF ProfilePath: C:\Users\cagiv_000\AppData\Roaming\Mozilla\Firefox\Profiles\h0k4vvui.default
FF Homepage: hxxps://www.google.de/
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll [2014-11-27] (Citrix Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll [2013-08-17] (Nitro PDF)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-30] (Google Inc.)
FF Extension: Adblock Plus - C:\Users\cagiv_000\AppData\Roaming\Mozilla\Firefox\Profiles\h0k4vvui.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-08-03]
FF Extension: Adblock Edge - C:\Users\cagiv_000\AppData\Roaming\Mozilla\Firefox\Profiles\h0k4vvui.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-08-03]
Chrome:
=======
CHR Profile: C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-08-12]
CHR Extension: (Google Docs) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-08-12]
CHR Extension: (Google Drive) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-08-12]
CHR Extension: (YouTube) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-08-12]
CHR Extension: (Google Search) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-08-12]
CHR Extension: (Google Sheets) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-08-12]
CHR Extension: (Google Docs Offline) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-01]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-08-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-12]
CHR Extension: (Gmail) - C:\Users\cagiv_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-12]
==================== Dienste (Nicht auf der Ausnahmeliste) ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [66560 2013-11-06] () [Datei ist nicht signiert]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [14696 2013-09-24] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [345864 2015-03-19] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LenovoRecommends.AppService; C:\Program Files (x86)\Lenovo\Lenovo Recommends\Service\x64\LenovoRecommends.AppService.exe [19440 2014-01-09] ()
R2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-08-25] (IObit)
R2 LsvUIService; C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvUIService.exe [70416 2014-06-09] (Lenovo)
R2 LUService; C:\Program Files (x86)\Lenovo\Lenovo Updates\LUService.exe [37624 2014-04-21] (Lenovo(beijing) Limited)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NitroDriverReadSpool8; C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [230408 2013-08-17] (Nitro PDF Software)
R2 PGService; C:\Program Files (x86)\Lenovo\Motion Control\PGService.exe [163624 2014-01-07] (PointGrab LTD)
R2 PhoneCompanionPusher; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionPusher.exe [288240 2014-06-09] (Lenovo)
S3 PhoneCompanionVap; C:\Program Files\Lenovo PhoneCompanion\PhoneCompanionVap.exe [305136 2014-06-09] (Lenovo)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
S3 TESHelper; c:\Program Files\Common Files\Lenovo\Magic Transfer\x64\MagicTransferTESHelper.exe [104696 2014-06-09] (Lenovo)
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe [67856 2014-06-09] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 ymc; C:\ProgramData\LenovoTransition\Server\x64\ymc.exe [33040 2014-06-09] (Lenovo)
S2 MaxthonUpdateSvc; "C:\Program Files (x86)\Maxthon\Modules\Service\Update\MaxthonUpdateSvc.exe" [X]
S2 PTwtFmHmfGQ; "C:\ProgramData\MicfCNWy\PTwtFmHmfGQ.exe" [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [146856 2013-06-04] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [21928 2013-06-04] (Windows (R) Win 7 DDK provider)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 GeneStor; C:\Windows\System32\drivers\GeneStor.sys [107208 2014-01-17] (GenesysLogic)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [555224 2013-11-18] (Realtek Semiconductor Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8876248 2013-10-17] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3558104 2014-08-15] (Realtek Semiconductor Corporation )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2014-02-25] (Synaptics Incorporated)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-03 21:05 - 2015-09-03 21:05 - 00017944 _____ C:\Users\cagiv_000\Desktop\mbar.txt
2015-09-03 18:14 - 2015-09-03 18:14 - 00001125 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-03 18:14 - 2015-09-03 18:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-03 18:14 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-09-03 18:14 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-09-03 18:13 - 2015-09-03 18:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-03 17:36 - 2015-09-03 17:37 - 00000000 ____D C:\Users\cagiv_000\Downloads\RevoUninstallerPortable
2015-09-03 17:35 - 2015-09-03 17:36 - 02785665 _____ (PortableApps.com) C:\Users\cagiv_000\Downloads\RevoUninstallerPortable_1.95_Rev_2.paf.exe
2015-09-03 17:14 - 2015-09-03 17:14 - 00000000 ____D C:\Users\cagiv_000\Downloads\Mw-Tools
2015-09-03 17:13 - 2015-09-03 17:14 - 40864874 _____ C:\Users\cagiv_000\Downloads\Mw-Tools.zip
2015-09-02 21:26 - 2015-09-02 22:09 - 00000000 ____D C:\Users\cagiv_000\AppData\Roaming\Opera Software
2015-09-02 21:26 - 2015-09-02 22:09 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\Opera Software
2015-09-02 21:24 - 2015-09-02 21:26 - 00003258 _____ C:\WINDOWS\System32\Tasks\runTask
2015-09-02 21:24 - 2015-09-02 21:26 - 00003162 _____ C:\WINDOWS\System32\Tasks\updateTask
2015-09-02 21:12 - 2015-09-02 21:13 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\cagiv_000\Downloads\mbam-setup-2.1.8.1057.exe
2015-09-02 21:09 - 2015-09-03 18:13 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-09-02 21:08 - 2015-09-03 21:03 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-09-02 21:08 - 2015-09-03 18:42 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-09-02 21:07 - 2015-09-03 18:12 - 00000000 ____D C:\Users\cagiv_000\Desktop\mbar
2015-09-02 21:07 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-09-02 20:31 - 2015-09-03 21:06 - 00021731 _____ C:\Users\cagiv_000\Desktop\FRST.txt
2015-09-02 20:03 - 2015-09-02 20:47 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-09-02 20:03 - 2015-09-02 20:03 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\CrashRpt
2015-09-02 19:38 - 2015-09-03 21:06 - 00000000 ____D C:\FRST
2015-09-02 19:38 - 2015-09-02 19:38 - 02188800 _____ (Farbar) C:\Users\cagiv_000\Downloads\FRST64.exe
2015-09-02 19:38 - 2015-09-02 19:38 - 02188800 _____ (Farbar) C:\Users\cagiv_000\Desktop\FRST64.exe
2015-09-01 21:24 - 2015-09-01 21:24 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\GWX
2015-09-01 18:03 - 2015-09-01 18:03 - 00000000 ____D C:\Users\cagiv_000\Tracing
2015-09-01 18:02 - 2015-09-02 19:34 - 00000000 ____D C:\Users\cagiv_000\AppData\Roaming\Skype
2015-09-01 18:02 - 2015-09-01 18:02 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\Skype
2015-09-01 18:01 - 2015-09-01 18:02 - 00000000 ____D C:\ProgramData\Skype
2015-09-01 18:01 - 2015-09-01 18:01 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-09-01 18:01 - 2015-09-01 18:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-09-01 18:00 - 2015-09-01 18:00 - 01494048 _____ (Skype Technologies S.A.) C:\Users\cagiv_000\Downloads\SkypeSetup (1).exe
2015-08-31 21:57 - 2015-07-28 11:01 - 129304528 ____N (Microsoft Corporation) C:\WINDOWS\SysWOW64\MRT.exe
2015-08-31 21:44 - 2015-08-31 21:44 - 00000000 ____D C:\Users\cagiv_000\AppData\Roaming\ProductData
2015-08-31 21:43 - 2015-09-02 22:12 - 00002414 _____ C:\WINDOWS\System32\Tasks\Uninstaller_SkipUac_cagiv_000
2015-08-31 21:43 - 2015-09-02 22:12 - 00000306 _____ C:\WINDOWS\Tasks\Uninstaller_SkipUac_cagiv_000.job
2015-08-31 21:43 - 2015-08-31 21:44 - 00000000 ____D C:\ProgramData\IObit
2015-08-31 21:43 - 2015-08-31 21:43 - 00001393 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Uninstaller.lnk
2015-08-31 21:43 - 2015-08-31 21:43 - 00000000 ____D C:\Users\cagiv_000\AppData\Roaming\IObit
2015-08-31 21:43 - 2015-08-31 21:43 - 00000000 ____D C:\ProgramData\ProductData
2015-08-31 21:43 - 2015-08-31 21:43 - 00000000 ____D C:\Program Files (x86)\IObit
2015-08-31 20:58 - 2015-08-31 20:58 - 01605632 _____ C:\Users\cagiv_000\Downloads\adwcleaner_5.003.exe
2015-08-31 20:48 - 2015-09-03 21:00 - 00000000 ____D C:\Program Files (x86)\baidu
2015-08-31 20:48 - 2015-09-02 21:26 - 00001018 _____ C:\task.vbs
2015-08-31 20:48 - 2015-09-02 20:47 - 00000004 _____ C:\WINDOWS\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-31 20:47 - 2015-08-31 20:47 - 00000000 _____ C:\dummy.htm
2015-08-30 22:02 - 2013-08-22 15:25 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2015-08-30 19:47 - 2015-08-30 21:04 - 00000000 ____D C:\Users\cagiv_000\Documents\3D Wohnung
2015-08-30 19:37 - 2015-08-30 19:37 - 00000000 ____D C:\Users\cagiv_000\eTeks
2015-08-30 19:08 - 2015-08-30 19:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eTeks Sweet Home 3D
2015-08-30 19:08 - 2015-08-30 19:08 - 00000000 ____D C:\Program Files\Sweet Home 3D
2015-08-30 19:07 - 2015-08-30 19:08 - 40823408 _____ (eTeks ) C:\Users\cagiv_000\Downloads\SweetHome3D-5.0-windows.exe
2015-08-30 19:06 - 2015-08-30 19:06 - 00004468 _____ C:\Users\cagiv_000\Downloads\SweetHome3D.jnlp
2015-08-30 13:57 - 2015-08-30 13:57 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\PackageStaging
2015-08-30 13:39 - 2015-09-03 18:46 - 00000000 ____D C:\AdwCleaner
2015-08-30 13:07 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-08-30 13:07 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-08-30 12:31 - 2015-07-30 16:04 - 00124624 _____ (Microsoft Corporation) C:\WINDOWS\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-30 12:31 - 2015-07-30 15:48 - 00103120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-30 12:19 - 2015-07-19 03:58 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-08-30 12:19 - 2015-07-18 20:51 - 03704320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-08-30 12:19 - 2015-07-18 20:31 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-08-30 12:19 - 2015-07-18 20:31 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-08-30 12:19 - 2015-07-18 20:31 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-08-30 12:19 - 2015-07-18 20:29 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-08-30 12:19 - 2015-07-18 20:29 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-08-30 12:19 - 2015-07-18 20:29 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-08-30 12:19 - 2015-07-18 20:28 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-08-30 12:19 - 2015-07-18 20:12 - 02228736 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-08-30 12:19 - 2015-07-18 20:10 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-08-30 12:19 - 2015-07-18 20:09 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-08-30 12:19 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-08-30 12:19 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\WINDOWS\system32\html.iec
2015-08-30 12:19 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-08-30 12:19 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-08-30 12:19 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll
2015-08-30 12:19 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-08-30 12:19 - 2015-07-16 21:53 - 00145408 _____ (Microsoft Corporation) C:\WINDOWS\system32\iepeers.dll
2015-08-30 12:19 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-08-30 12:19 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\html.iec
2015-08-30 12:19 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-08-30 12:19 - 2015-07-16 21:45 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-08-30 12:19 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll
2015-08-30 12:19 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-08-30 12:19 - 2015-07-16 21:38 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll
2015-08-30 12:19 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-08-30 12:19 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-08-30 12:19 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2015-08-30 12:19 - 2015-07-16 21:14 - 02880000 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2015-08-30 12:19 - 2015-07-16 21:13 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-08-30 12:19 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-08-30 12:19 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-08-30 12:19 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-08-30 12:19 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-08-30 12:19 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-08-30 12:19 - 2015-07-16 20:52 - 01048576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2015-08-30 12:19 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-08-30 12:19 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-08-30 12:19 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-08-30 12:19 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-08-12 21:59 - 2015-07-16 02:29 - 07458648 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-08-12 21:59 - 2015-07-02 00:19 - 00228864 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2015-08-12 21:59 - 2015-07-02 00:16 - 00104448 _____ (Microsoft Corporation) C:\WINDOWS\system32\davclnt.dll
2015-08-12 21:59 - 2015-07-01 23:37 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2015-08-12 21:59 - 2015-07-01 23:35 - 00087040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\davclnt.dll
2015-08-12 21:58 - 2015-07-29 01:24 - 00025776 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2015-08-12 21:58 - 2015-07-28 16:24 - 01148416 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2015-08-12 21:58 - 2015-07-28 16:24 - 01116160 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2015-08-12 21:58 - 2015-07-28 16:24 - 00774144 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2015-08-12 21:58 - 2015-07-28 16:24 - 00743424 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2015-08-12 21:58 - 2015-07-28 16:24 - 00437248 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2015-08-12 21:58 - 2015-07-28 16:24 - 00069120 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2015-08-12 21:58 - 2015-07-16 02:29 - 01735000 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2015-08-12 21:58 - 2015-07-16 02:29 - 00101720 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mountmgr.sys
2015-08-12 21:58 - 2015-07-16 02:28 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2015-08-12 21:58 - 2015-07-10 19:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\sysmain.dll
2015-08-12 21:58 - 2015-07-07 11:40 - 00270168 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2015-08-12 21:58 - 2015-07-07 11:40 - 00114520 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2015-08-12 21:58 - 2015-07-07 11:40 - 00044560 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys
2015-08-12 21:47 - 2015-08-12 21:48 - 00000206 _____ C:\WLAN.log
2015-08-12 21:47 - 2015-07-29 16:37 - 01994752 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll
2015-08-12 21:47 - 2015-07-29 16:30 - 01381888 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll
2015-08-12 21:47 - 2015-07-29 16:23 - 01559552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll
2015-08-12 21:47 - 2015-07-24 20:57 - 04177408 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-08-12 21:47 - 2015-07-24 20:57 - 00358912 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll
2015-08-12 21:47 - 2015-07-24 20:52 - 00044032 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll
2015-08-12 21:47 - 2015-07-24 19:27 - 00301568 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll
2015-08-12 21:47 - 2015-07-24 19:23 - 00035840 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll
2015-08-12 21:47 - 2015-07-14 05:22 - 02529880 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2015-08-12 21:47 - 2015-07-14 05:21 - 01901776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2015-08-12 21:47 - 2015-07-13 21:46 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\csrsrv.dll
2015-08-12 21:47 - 2015-07-13 21:45 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\basesrv.dll
2015-08-12 21:47 - 2015-07-10 20:19 - 01101824 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2015-08-12 21:47 - 2015-07-10 19:42 - 02345472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2015-08-12 21:47 - 2015-07-10 19:14 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2015-08-12 21:47 - 2015-07-10 19:13 - 07032320 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2015-08-12 21:47 - 2015-07-10 18:47 - 01556992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2015-08-12 21:47 - 2015-07-10 18:31 - 06213120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2015-08-12 21:47 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\system32\notepad.exe
2015-08-12 21:47 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\WINDOWS\notepad.exe
2015-08-12 21:47 - 2015-07-09 18:30 - 00212992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\notepad.exe
2015-08-12 21:32 - 2015-09-03 21:01 - 00050979 _____ C:\Users\cagiv_000\AppData\Local\BTServer.log
2015-08-12 20:32 - 2015-08-12 20:32 - 00000000 ____D C:\$SysReset
2015-08-12 20:18 - 2015-08-12 20:18 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\VirtualStore
2015-08-12 13:20 - 2015-08-30 12:52 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\Google
2015-08-11 13:11 - 2015-08-11 13:11 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\Citrix
2015-08-09 20:02 - 2015-08-09 20:02 - 00000114 ____H C:\Users\cagiv_000\Downloads\.~lock.muster_kuendigung_staufenbiel.doc#
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2015-09-03 21:06 - 2014-11-28 20:15 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3288637145-890345418-2317591297-1001
2015-09-03 21:03 - 2014-11-28 20:14 - 00000000 ___DO C:\Users\cagiv_000\OneDrive
2015-09-03 21:03 - 2014-06-09 17:43 - 01834371 _____ C:\WINDOWS\WindowsUpdate.log
2015-09-03 21:01 - 2014-11-28 23:20 - 00001134 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-03 21:00 - 2014-06-09 19:11 - 00002560 _____ C:\WINDOWS\system32\VfService.trf
2015-09-03 21:00 - 2013-10-07 20:23 - 00084024 _____ C:\WINDOWS\PFRO.log
2015-09-03 21:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-09-03 21:00 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\L2Schemas
2015-09-03 21:00 - 2013-08-22 16:46 - 00004739 _____ C:\WINDOWS\setupact.log
2015-09-03 21:00 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-09-03 21:00 - 2013-08-22 15:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI
2015-09-03 20:36 - 2014-11-28 20:15 - 00003806 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{07BD74D3-BC6B-4FD5-8625-E5F041315C1F}
2015-09-03 20:31 - 2014-06-10 03:27 - 00766620 _____ C:\WINDOWS\system32\perfh007.dat
2015-09-03 20:31 - 2014-06-10 03:27 - 00159902 _____ C:\WINDOWS\system32\perfc007.dat
2015-09-03 20:31 - 2013-10-07 20:27 - 01780340 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-09-03 18:42 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\PLA
2015-09-03 17:20 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-09-02 21:08 - 2015-07-10 19:28 - 00000000 ___HD C:\$Windows.~BT
2015-09-02 20:58 - 2013-08-22 15:25 - 00000194 _____ C:\WINDOWS\win.ini
2015-09-02 20:12 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Common Files\System
2015-09-01 21:54 - 2013-10-07 21:23 - 00000000 ____D C:\WINDOWS\Panther
2015-09-01 18:03 - 2014-11-28 20:08 - 00000000 ____D C:\Users\cagiv_000
2015-08-31 21:46 - 2014-11-28 20:09 - 00000000 ____D C:\Users\cagiv_000\AppData\Local\Packages
2015-08-31 21:14 - 2015-03-16 20:51 - 00153088 ___SH C:\Users\cagiv_000\Downloads\Thumbs.db
2015-08-30 16:35 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-08-30 13:49 - 2014-11-28 23:20 - 00004110 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2015-08-30 13:49 - 2014-11-28 23:20 - 00003874 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2015-08-30 13:49 - 2014-11-28 23:20 - 00001138 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-30 13:43 - 2015-01-21 13:28 - 00002264 _____ C:\WINDOWS\System32\Tasks\NNYOXBV
2015-08-30 12:34 - 2014-06-09 19:17 - 00000000 ____D C:\ProgramData\LU
2015-08-30 12:34 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-30 12:34 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2015-08-30 12:34 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Defender
2015-08-30 12:34 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-08-30 12:27 - 2014-12-11 15:28 - 00000000 ____D C:\WINDOWS\system32\appraiser
2015-08-30 12:27 - 2014-12-01 22:55 - 00000000 ___SD C:\WINDOWS\system32\CompatTel
2015-08-30 12:23 - 2013-08-22 16:44 - 00371584 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-08-30 12:22 - 2015-03-20 11:12 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-30 12:22 - 2015-03-20 11:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-30 12:19 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-30 12:19 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-08-30 12:17 - 2015-03-20 11:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-12 22:19 - 2015-01-21 13:38 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2015-08-12 22:19 - 2014-06-09 19:10 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDirector 10
2015-08-12 22:19 - 2014-06-09 19:08 - 00000000 ____D C:\ProgramData\Lenovo
2015-08-12 22:19 - 2014-06-09 19:04 - 00000000 ____D C:\Program Files\Lenovo
2015-08-12 22:19 - 2014-06-09 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo Photos
2015-08-12 22:19 - 2014-06-09 19:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-08-12 22:19 - 2014-06-09 19:03 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-08-12 22:19 - 2014-06-09 19:01 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PhotoDirector 3
2015-08-12 22:19 - 2014-06-09 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Realtek
2015-08-12 22:19 - 2014-06-09 18:29 - 00000000 ____D C:\Program Files\Dolby Digital Plus
2015-08-12 22:19 - 2014-06-09 18:25 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
2015-08-12 22:19 - 2014-06-09 18:25 - 00000000 ____D C:\Program Files\Intel
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\spool
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\Recovery
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\MediaViewer
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\LiveKernelReports
2015-08-12 22:19 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-08-12 22:19 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\system32\oobe
2015-08-12 21:47 - 2014-06-09 18:28 - 00000000 ____D C:\Program Files (x86)\Realtek
2015-08-12 21:41 - 2015-07-18 20:03 - 00001279 _____ C:\Users\cagiv_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wi-FiHotspotChgToast.lnk
2015-08-12 21:14 - 2014-12-01 20:19 - 132483416 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-08-12 20:04 - 2014-12-24 17:31 - 00000000 ____D C:\Program Files (x86)\Citrix
2015-08-09 20:16 - 2014-11-28 22:39 - 00000000 ____D C:\Users\cagiv_000\AppData\Roaming\Nitro PDF
2015-08-08 15:55 - 2014-12-01 23:04 - 00794088 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-08-08 15:55 - 2014-12-01 23:04 - 00179688 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2015-08-12 21:32 - 2015-09-03 21:01 - 0050979 _____ () C:\Users\cagiv_000\AppData\Local\BTServer.log
2014-06-09 18:29 - 2014-06-09 18:29 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-09-02 20:03 - 2015-09-02 20:47 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Dateien, die verschoben oder gelöscht werden sollten:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Einige Dateien in TEMP:
====================
C:\Users\cagiv_000\AppData\Local\Temp\AF8E1EEE-80C0-F871-96D5-CAC36D1D4721.exe
C:\Users\cagiv_000\AppData\Local\Temp\CloudBackup8828.exe
C:\Users\cagiv_000\AppData\Local\Temp\COMAP.EXE
C:\Users\cagiv_000\AppData\Local\Temp\EC2D7F3D-18F6-24EE-2C4C-F10C4962EBE6.dll
C:\Users\cagiv_000\AppData\Local\Temp\EC2D7F3D-18F6-24EE-2C4C-F10C4962EBE6.exe
C:\Users\cagiv_000\AppData\Local\Temp\FBS3B22.exe
C:\Users\cagiv_000\AppData\Local\Temp\FBS5F78.exe
C:\Users\cagiv_000\AppData\Local\Temp\fsd3E5A.exe
C:\Users\cagiv_000\AppData\Local\Temp\fsd6B2B.exe
C:\Users\cagiv_000\AppData\Local\Temp\fsd92FD.exe
C:\Users\cagiv_000\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe
C:\Users\cagiv_000\AppData\Local\Temp\KERNELBASE.dll
C:\Users\cagiv_000\AppData\Local\Temp\OnlineBackup.exe
C:\Users\cagiv_000\AppData\Local\Temp\setup3.exe
C:\Users\cagiv_000\AppData\Local\Temp\sqlite3.dll
C:\Users\cagiv_000\AppData\Local\Temp\System.Data.SQLite.dll
C:\Users\cagiv_000\AppData\Local\Temp\System.Data.SQLitea024755a-a3e1-442f-a563-7a109a8c1e9e.dll
C:\Users\cagiv_000\AppData\Local\Temp\System.Data.SQLitee5802543-78ae-4b6e-ad2a-c47135c4d856.dll
C:\Users\cagiv_000\AppData\Local\Temp\Uninstall.exe
==================== Bamital & volsnap =================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert
C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert
C:\WINDOWS\explorer.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert
C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert
C:\WINDOWS\system32\services.exe => Datei ist digital signiert
C:\WINDOWS\system32\User32.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert
C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert
C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert
C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert
C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2015-08-30 21:59
==================== Ende von FRST.txt ============================
Addition: Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:31-08-2015
durchgeführt von cagiv_000 (2015-09-03 21:08:34)
Gestartet von C:\Users\cagiv_000\Desktop
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-3288637145-890345418-2317591297-500 - Administrator - Disabled)
cagiv_000 (S-1-5-21-3288637145-890345418-2317591297-1001 - Administrator - Enabled) => C:\Users\cagiv_000
Gast (S-1-5-21-3288637145-890345418-2317591297-501 - Limited - Disabled)
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Benutzerhandbücher (x32 Version: 3.0.0.3 - Lenovo) Hidden
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{AF312B06-5C5C-468E-89B3-BE6DE2645722}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{0A4EF0E6-A912-4CDE-A7F3-6E56E7C13A2F}) (Version: 1.1.6 - Cisco Systems, Inc.)
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.2.0.10 - Citrix Systems, Inc.)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.4107 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.2810 - CyberLink Corp.)
CyberLink PowerDirector 10 (Version: 10.0.0.2810 - CyberLink Corp.) Hidden
Dolby Digital Plus Advanced Audio (HKLM\...\{B0BFC63F-EA07-419E-960B-3FB2ED5DD0B2}) (Version: 7.5.1.1 - Dolby Laboratories Inc)
Energy Manager (HKLM-x32\...\InstallShield_{AC768037-7079-4658-AC24-2897650E0ABE}) (Version: 1.5.0.20 - Lenovo)
Energy Manager (x32 Version: 1.5.0.20 - Lenovo) Hidden
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.1.0 - Genesys Logic)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 45.0.2454.85 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.13 - Google Inc.) Hidden
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{0EC7F9CC-4741-45AE-9F55-6E9343F726F5}) (Version: 1.1.0.36960 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.5.1000 - Intel Corporation)
IObit Uninstaller (HKLM-x32\...\IObitUninstall) (Version: 5.0.3.171 - IObit)
Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10249 - Realtek Semiconductor Corp.)
Lenovo Motion Control (HKLM-x32\...\InstallShield_{0D740B00-2307-44AC-B91B-F3E67444ECA6}) (Version: 2.0.1.0107 - PointGrab)
Lenovo Motion Control (x32 Version: 2.0.1.0107 - PointGrab) Hidden
Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 8.1.0.2326 - CyberLink Corp.)
Lenovo OneKey Recovery (Version: 8.1.0.2326 - CyberLink Corp.) Hidden
Lenovo PhoneCompanion (HKLM-x32\...\InstallShield_{0F82EA83-B0C5-4AB9-9695-DFE92C5FD57B}) (Version: 1.2.0.0 - Lenovo)
Lenovo PhoneCompanion (x32 Version: 1.2.0.0 - Lenovo) Hidden
Lenovo Photos (HKLM-x32\...\Lenovo Photos) (Version: 4.8.7 - CEWE COLOR AG u Co. OHG)
Lenovo Recommends (HKLM-x32\...\{267C8BA0-876B-4589-9F14-EFB84ABCEA7F}) (Version: 1.5.014.0211 - Lenovo)
Lenovo Smart Voice (HKLM\...\Lenovo SmartVoice) (Version: 1.0.2.2 - Lenovo)
Lenovo Transition (HKLM\...\Lenovo Transition) (Version: 2.1.14.1221 - Lenovo)
Lenovo Updates (HKLM-x32\...\InstallShield_{A2E1E9F0-0B68-4166-8C7F-85B563B84DF4}) (Version: 1.3.0.6 - Lenovo)
Lenovo Updates (x32 Version: 1.3.0.6 - Lenovo) Hidden
Lenovo VeriFace Pro (HKLM\...\Lenovo VeriFace) (Version: 5.0.14.1061 - Lenovo)
Magic Transfer (HKLM\...\{AD2B2BD1-A1D7-4798-8FDD-B2A58FD94E68}) (Version: 1.1.1.11 - )
Magic Transfer (HKLM-x32\...\InstallShield_{AD2B2BD1-A1D7-4798-8FDD-B2A58FD94E68}) (Version: 1.1.1.11 - Lenovo)
Magic Transfer (x32 Version: 1.1.1.11 - Lenovo) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Maxthon Cloud Browser (HKLM-x32\...\Maxthon3) (Version: 4.1.3.5000 - Maxthon International Limited)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Nitro Pro 8 (HKLM\...\{84DAF9F1-513C-49F8-89D2-63CB3F4A7E39}) (Version: 8.5.7.1 - Nitro)
Online Plug-in (x32 Version: 14.2.0.10 - Citrix Systems, Inc.) Hidden
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
REALTEK Bluetooth Driver (HKLM-x32\...\{9D3D8C60-A5EF-4123-B2B9-172095903AB}) (Version: 3.787.787.111213 - REALTEK Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver (HKLM-x32\...\{9DAABC60-A5EF-41FF-B2B9-17329590CD5}) (Version: 1.20.243 - )
Self-Service Plug-in (x32 Version: 4.2.0.2495 - Citrix Systems, Inc.) Hidden
Skype™ 7.9 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.9.103 - Skype Technologies S.A.)
Sweet Home 3D version 5.0 (HKLM\...\Sweet Home 3D_is1) (Version: 5.0 - eTeks)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.14.80 - Synaptics Incorporated)
User Manuals (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 3.0.0.3 - Lenovo)
Windows-Treiberpaket - Lenovo (ACPIVPC) System (09/24/2013 19.29.2.34) (HKLM\...\EE9B1F2037C580F36D92FA431CC02BFF04C31F15) (Version: 09/24/2013 19.29.2.34 - Lenovo)
Windows-Treiberpaket - Lenovo (WUDFRd) LenovoVhid (07/25/2013 10.30.0.288) (HKLM\...\6BCA401E9CBEED970D75F55FA5320F60D11984E9) (Version: 07/25/2013 10.30.0.288 - Lenovo)
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-3288637145-890345418-2317591297-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Wiederherstellungspunkte =========================
12-08-2015 21:42:26 Konfiguriert Lenovo Updates
30-08-2015 12:09:35 Windows Update
02-09-2015 21:47:41 Malwarebytes Anti-Rootkit Restore Point
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> Keine Datei <==== ACHTUNG
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> Keine Datei <==== ACHTUNG
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> Keine Datei <==== ACHTUNG
Task: {52CB7ECA-D49F-498F-9D79-9E242CB7FF89} - System32\Tasks\runTask => %TEMP%/Updater.exe
Task: {56B09122-086C-44AC-8C38-1ACB1FA75621} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-08-12] (Microsoft Corporation)
Task: {56F0D7F6-899C-4B25-A152-5655E28C7227} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {6BE3E178-8C33-4627-B78B-870C18F3C1D3} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> Keine Datei <==== ACHTUNG
Task: {84B3AC7D-8326-4E6F-B917-E1909FC305C6} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2013-03-07] (Intel Corporation)
Task: {91CC6BCD-7CFE-4AE0-A3EE-95EA4A2DF25D} - System32\Tasks\updateTask => c:\task.vbs [2015-09-02] ()
Task: {B2A19D8E-9B5D-4E66-8595-DBA13B100176} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-08-30] (Google Inc.)
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> Keine Datei <==== ACHTUNG
Task: {C5BE525E-5E86-4E42-92D8-1D0BD94B1038} - System32\Tasks\NNYOXBV => C:\ProgramData\3a8e94626c7e455eab9ee6b45c18d0d0\3a8e94626c7e455eab9ee6b45c18d0d0.exe <==== ACHTUNG
Task: {C804D9E2-0E8A-446D-B531-BC9CAA5E9F6A} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\mxup.exe
Task: {CDDF4371-806B-4BD3-93A9-1B1FF1CD6452} - System32\Tasks\Uninstaller_SkipUac_cagiv_000 => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe [2015-08-25] (IObit)
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> Keine Datei <==== ACHTUNG
Task: {E4CE300A-2055-4B47-8A89-9CDEDEAF5438} - System32\Tasks\Lenovo Smart Voice => C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LsvTrayLoad.exe [2014-06-09] (Lenovo)
Task: {FCCE3F19-E9D9-47A7-B238-F183600EDC49} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Uninstaller_SkipUac_cagiv_000.job => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2014-06-09 18:31 - 2013-11-06 21:24 - 00066560 _____ () C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe
2014-06-09 19:03 - 2014-01-09 18:27 - 00019440 _____ () C:\Program Files (x86)\Lenovo\Lenovo Recommends\Service\x64\LenovoRecommends.AppService.exe
2014-06-09 19:10 - 2012-04-24 12:43 - 00390632 ____N () C:\Program Files\CyberLink\Shared files\RichVideo64.exe
2014-06-09 19:11 - 2014-06-09 19:11 - 00067856 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfConnectorService.exe
2014-06-09 19:11 - 2014-06-09 19:11 - 00672016 _____ () C:\Program Files (x86)\Lenovo\Lenovo VeriFace Pro\VfDataStorageInterface.dll
2014-06-09 19:03 - 2014-06-09 19:03 - 00061200 _____ () C:\ProgramData\LenovoTransition\Server\x64\dptf.dll
2014-06-09 11:04 - 2015-03-19 21:02 - 00393480 _____ () C:\WINDOWS\system32\igfxTray.exe
2014-06-09 19:03 - 2014-06-09 19:03 - 00294672 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Transition.exe
2014-03-26 12:50 - 2014-06-09 19:14 - 00058864 _____ () C:\Program Files (x86)\Lenovo\Energy Manager\kbdhook.dll
2014-06-09 19:03 - 2014-01-09 18:30 - 00044016 _____ () C:\Program Files (x86)\Lenovo\Lenovo Recommends\Util.dll
2013-08-22 09:19 - 2013-08-22 08:54 - 00066560 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Security.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00020480 _____ () C:\WINDOWS\system32\WinMetadata\Windows.System.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00054784 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Globalization.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00112640 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Networking.winmd
2013-08-22 09:19 - 2013-08-22 08:54 - 00030208 _____ () C:\WINDOWS\system32\WinMetadata\Windows.Foundation.winmd
2014-06-09 19:03 - 2014-06-09 19:03 - 00109328 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\TransitionServer.exe
2015-08-31 21:43 - 2015-08-25 14:54 - 00622880 _____ () C:\Program Files (x86)\IObit\LiveUpdate\ProductStatistics.dll
2014-06-09 19:10 - 2014-06-09 19:10 - 00101648 _____ () C:\Program Files (x86)\Lenovo\Lenovo Smart Voice\LUpdatePackage.dll
2014-06-09 19:03 - 2014-06-09 19:03 - 00105744 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\Config\1366\TransitionLib.dll
2014-06-09 19:03 - 2014-06-09 19:03 - 00102160 _____ () C:\Program Files (x86)\Lenovo\Lenovo Transition\LUpdatePackage.dll
2015-08-31 21:43 - 2015-08-25 14:54 - 00348960 _____ () C:\Program Files (x86)\IObit\IObit Uninstaller\madExcept_.bpl
2015-08-31 21:43 - 2015-08-25 14:54 - 00183584 _____ () C:\Program Files (x86)\IObit\IObit Uninstaller\madBasic_.bpl
2015-08-31 21:43 - 2015-08-25 14:54 - 00050976 _____ () C:\Program Files (x86)\IObit\IObit Uninstaller\madDisAsm_.bpl
2014-06-09 18:26 - 2013-09-04 01:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\WINDOWS:nlsPreferences
AlternateDataStreams: C:\Users\cagiv_000\OneDrive:ms-properties
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cmwf.sys => ""="Driver" <==== ACHTUNG
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\cmwr.sys => ""="Driver" <==== ACHTUNG
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\cmwf.sys => ""="Driver" <==== ACHTUNG
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CMWFP => ""="Driver" <==== ACHTUNG
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\cmwr.sys => ""="Driver" <==== ACHTUNG
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-3288637145-890345418-2317591297-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\Lenovo\LenovoWallPaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{D13D96B7-9AB6-47D9-9AAA-CBCF8551D07D}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{A35123FA-CAD1-4C29-96B3-53884D3F2FA4}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{9DD071A2-0635-4B80-97A9-D64E863CD77C}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\MxUp.exe
FirewallRules: [{FBA6EBF6-ECAB-4E26-ACA5-5A82F6A901F8}] => (Allow) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
FirewallRules: [{F82FDAE7-99EB-431F-95D8-BA4A4480B566}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{36A6C0A7-729B-4905-BFC8-1477C2555D08}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{9816A13E-B3BF-449C-824B-921A1A2E4078}] => (Allow) C:\Program Files\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{0404631F-610E-4D17-B552-01A8C414BA4B}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{41C340C8-001C-4D05-A7BB-BBAA46A35911}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
FirewallRules: [{3FAFD513-47C9-4BD2-92F5-A6212B706613}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{409CCB61-C29B-4321-ABE8-D48A1B3FCEC2}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{6AB7F882-860C-44B6-9B85-A033600BFCEB}] => (Allow) C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe
==================== Fehlerhafte Geräte im Gerätemanager =============
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (09/03/2015 09:04:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17418, Zeitstempel: 0x5458237f
Name des fehlerhaften Moduls: FileManagerApp.dll, Version: 6.3.9600.17418, Zeitstempel: 0x54582358
Ausnahmecode: 0x80000003
Fehleroffset: 0x00000000000214ec
ID des fehlerhaften Prozesses: 0x1764
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5
Error: (09/03/2015 09:04:35 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 09:04:19 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: FileManager_cw5n1h2txyewy3
Error: (09/03/2015 09:04:19 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 08:38:52 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm backgroundTaskHost.exe, Version 6.3.9600.17415 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1568
Startzeit: 01d0e67711140f46
Endzeit: 4294967295
Anwendungspfad: C:\WINDOWS\syswow64\backgroundTaskHost.exe
Berichts-ID: 04aceb00-526b-11e5-8284-90489a784abe
Vollständiger Name des fehlerhaften Pakets: E046963F.LenovoSupport_2.0.5.0_x86__k1h2ywk1493x8
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App
Error: (09/03/2015 08:33:57 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: E046963F.LenovoSupport_k1h2ywk1493x83
Error: (09/03/2015 08:33:53 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: E046963F.LenovoSupport_k1h2ywk1493x83
Error: (09/03/2015 08:31:58 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 08:31:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PhotosApp.exe, Version: 6.3.9600.17418, Zeitstempel: 0x5458237f
Name des fehlerhaften Moduls: FileManagerApp.dll, Version: 6.3.9600.17418, Zeitstempel: 0x54582358
Ausnahmecode: 0x80000003
Fehleroffset: 0x00000000000214ec
ID des fehlerhaften Prozesses: 0xb50
Startzeit der fehlerhaften Anwendung: 0xPhotosApp.exe0
Pfad der fehlerhaften Anwendung: PhotosApp.exe1
Pfad des fehlerhaften Moduls: PhotosApp.exe2
Berichtskennung: PhotosApp.exe3
Vollständiger Name des fehlerhaften Pakets: PhotosApp.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: PhotosApp.exe5
Error: (09/03/2015 08:31:27 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: FileManager_cw5n1h2txyewy3
Systemfehler:
=============
Error: (09/03/2015 09:01:10 PM) (Source: bowser) (EventID: 8016) (User: )
Description: Der Suchdiensttreiber erhielt zu viele nicht erlaubte Datagramme vom Remotecomputer "EASYBOX" zum Namen "LENOVO-PC" auf Transport "NetBT_Tcpip_{40DD82DC-7A58-4C6C-9FC8-A77D583682EC}". Das Datagramm steht in den Daten.
Es werden keine weiteren Ereignisse erzeugt, solange die Rücksetzfrequenz nicht abgelaufen ist.
Error: (09/03/2015 09:01:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PTwtFmHmfGQ" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/03/2015 09:01:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Maxthon Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/03/2015 08:41:22 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Home
Error: (09/03/2015 06:47:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "PTwtFmHmfGQ" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/03/2015 06:47:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Maxthon Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (09/03/2015 06:47:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\system32\Rtlihvs.dll
Error: (09/03/2015 06:47:02 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)
Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
Modulpfad: C:\WINDOWS\system32\Rtlihvs.dll
Error: (09/03/2015 06:47:01 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.
Error: (09/03/2015 06:46:51 PM) (Source: Service Control Manager) (EventID: 7032) (User: )
Description: Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden des Dienstes "Windows Search" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen, ist fehlgeschlagen. Fehler:
%%1056
Microsoft Office:
=========================
Error: (09/03/2015 09:04:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.174185458237fFileManagerApp.dll6.3.9600.17418545823588000000300000000000214ec176401d0e67b5542b92eC:\WINDOWS\FileManager\PhotosApp.exeC:\Windows\FileManager\FileManagerApp.dll9eb288ee-526e-11e5-8285-90489a784abeFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager
Error: (09/03/2015 09:04:35 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 09:04:19 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: FileManager_cw5n1h2txyewy3
Error: (09/03/2015 09:04:19 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 08:38:52 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: backgroundTaskHost.exe6.3.9600.17415156801d0e67711140f464294967295C:\WINDOWS\syswow64\backgroundTaskHost.exe04aceb00-526b-11e5-8284-90489a784abeE046963F.LenovoSupport_2.0.5.0_x86__k1h2ywk1493x8App
Error: (09/03/2015 08:33:57 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: E046963F.LenovoSupport_k1h2ywk1493x83
Error: (09/03/2015 08:33:53 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: E046963F.LenovoSupport_k1h2ywk1493x83
Error: (09/03/2015 08:31:58 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 13) (User: LENOVO-PC)
Description: C:\Users\cagiv_000\AppData\Local\Packages\FileManager_cw5n1h2txyewy\LocalStateFileManager_cw5n1h2txyewy-2147024894
Error: (09/03/2015 08:31:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PhotosApp.exe6.3.9600.174185458237fFileManagerApp.dll6.3.9600.17418545823588000000300000000000214ecb5001d0e676be1be49eC:\WINDOWS\FileManager\PhotosApp.exeC:\Windows\FileManager\FileManagerApp.dll0f03d71f-526a-11e5-8284-90489a784abeFileManager_6.3.9600.16384_neutral_neutral_cw5n1h2txyewyMicrosoft.Windows.PhotoManager
Error: (09/03/2015 08:31:27 PM) (Source: Microsoft-Windows-AppModel-State) (EventID: 10) (User: LENOVO-PC)
Description: FileManager_cw5n1h2txyewy3
CodeIntegrity:
===================================
Date: 2015-09-03 18:32:51.546
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:51.171
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:49.905
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:49.421
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:48.827
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:48.311
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:47.718
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:47.265
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:46.749
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
Date: 2015-09-03 18:32:46.171
Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
==================== Speicherinformationen ===========================
Prozessor: Intel(R) Pentium(R) 3558U @ 1.70GHz
Prozentuale Nutzung des RAM: 43%
Installierter physikalischer RAM: 4004.01 MB
Verfügbarer physikalischer RAM: 2276.22 MB
Summe virtueller Speicher: 4708.01 MB
Verfügbarer virtueller Speicher: 2614.74 MB
==================== Laufwerke ================================
Drive c: (Windows8_OS) (Fixed) (Total:423.66 GB) (Free:348.74 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]
Drive d: (LENOVO) (Fixed) (Total:25 GB) (Free:22.72 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: F02D1BCB)
Partition: GPT.
==================== Ende von Addition.txt ============================
AdwCleaner Code:
# AdwCleaner v5.005 - Bericht erstellt am 03/09/2015 um 21:23:20
# Aktualisiert am 31/08/2015 von Xplode
# Datenbank : 2015-08-31.2 [Server]
# Betriebssystem : Windows 8.1 (x64)
# Benutzername : cagiv_000 - LENOVO-PC
# Gestartet von : C:\Users\cagiv_000\Downloads\AdwCleaner_5.005.exe
# Option : Löschen
# Unterstützung : hxxp://toolslib.net/forum
***** [ Dienste ] *****
***** [ Ordner ] *****
***** [ Dateien ] *****
***** [ Verknüpfungen ] *****
***** [ Geplante Tasks ] *****
[-] Task Gelöscht : runTask
[-] Task Gelöscht : updateTask
***** [ Registrierungsdatenbank ] *****
[-] Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\Class\{0014298C-A9BA-440D-AAA8-AD12C7010EE5}
[-] Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Control\Class\{181A06EA-B82C-47DE-B851-E20FD0E1CC7D}
***** [ Internetbrowser ] *****
*************************
:: Winsock Einstellungen zurückgesetzt
########## EOF - C:\AdwCleaner\AdwCleaner[C9].txt - [946 Bytes] ##########
JRT: Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.6.0 (08.31.2015:1)
OS: Windows 8.1 x64
Ran by cagiv_000 on 03.09.2015 at 21:30:24,81
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Tasks
Successfully deleted: [Task] C:\WINDOWS\system32\tasks\Uninstaller_SkipUac_cagiv_000
Successfully deleted: [Task] C:\WINDOWS\Tasks\Uninstaller_SkipUac_cagiv_000.job
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Update Oasis Space
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\Util Oasis Space
~~~ Files
Successfully deleted: [File] C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
Successfully deleted: [File] C:\Users\cagiv_000\Appdata\Local\google\chrome\user data\default\local storage\hxxp_fugupdates120.com_0.localstorage
Successfully deleted: [File] C:\Users\cagiv_000\Appdata\Local\google\chrome\user data\default\local storage\hxxp_fugupdates120.com_0.localstorage-journal
~~~ Folders
Successfully deleted: [Folder] C:\ProgramData\productdata
Successfully deleted: [Folder] C:\Users\cagiv_000\Appdata\Local\crashrpt
Successfully deleted: [Folder] C:\Users\cagiv_000\Appdata\Local\installer
Successfully deleted: [Folder] C:\Users\cagiv_000\AppData\Roaming\productdata
~~~ Chrome
[C:\Users\cagiv_000\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - default search provider reset
[C:\Users\cagiv_000\Appdata\Local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:
[C:\Users\cagiv_000\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset
[C:\Users\cagiv_000\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.09.2015 at 21:32:59,20
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SecurityCheck: Code:
Results of screen317's Security Check version 1.008
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Google Chrome (44.0.2403.157)
Google Chrome (45.0.2454.85)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
ESET ESET Online Scanner OnlineScannerApp.exe
ESET ESET Online Scanner OnlineCmdLineScanner.exe
Windows Defender MpCmdRun.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
|
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
dann auf 
und dann auf 
. 