| Kavasaki | 24.12.2017 14:38 |
Sorry,
mir ist bekannt, das eine ZIP ein Container ist. Ich hatte aber noch nicht dieses Verhalten. Normakerweise werde ich nach einem Pfad gefragt.
Aber gut, jetzt zu den Logs:
FRST.TXT
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 23-12-2017 01
Ran by admin (administrator) on TRON (24-12-2017 14:33:08)
Running from C:\Users\admin\Desktop
Loaded Profiles: admin (Available Profiles: admin)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Englisch (USA)
Internet Explorer Version 11 (Default browser: "P:\FirefoxPortable\App\Firefox64\firefox.exe" -osint -url "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Chip Digital GmbH) C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe
() C:\Users\admin\AppData\Local\Kingosoft\Kingo Root\update_27205\bin\KingoSoftService.exe
(Microsoft Corporation) C:\Windows\System32\Locator.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Uwe Sieber - www.uwe-sieber.de) C:\Program Files\USBDLM\USBDLM_usr.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() P:\Rainlendar2\Rainlendar2.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
() P:\Rainmeter\Rainmeter.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\sp6\LU1\LULnchr.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\sp6\LU1\LogitechUpdate.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(PortableApps.com) P:\FirefoxPortable\FirefoxPortable.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(PortableApps.com) P:\ThunderbirdPortable\ThunderbirdPortable.exe
(Mozilla Corporation) P:\ThunderbirdPortable\App\thunderbird\thunderbird.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Mozilla Corporation) P:\FirefoxPortable\App\Firefox64\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE
(Vallen Systeme GmbH) P:\jpegger\jpegger.exe
(Vallen Systeme GmbH) P:\jpegger\jpegger.exe
==================== Registry (Whitelisted) ===========================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [3111880 2015-07-23] (Logitech, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [374784 2014-01-09] (shbox.de)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [1021736 2016-01-08] (Samsung)
HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8591272 2015-11-16] (Piriform Ltd)
HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\Run: [Rainlendar2] => P:\Rainlendar2\Rainlendar2.exe [3097640 2015-11-13] ()
HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\MountPoints2: {77d02200-ff33-11e2-a3f3-806e6f6e6963} - F:\DTVP_Launcher.exe
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\An OneNote senden.lnk [2016-02-24]
ShortcutTarget: An OneNote senden.lnk -> C:\Program Files\Microsoft Office 15\root\office15\onenotem.exe (Microsoft Corporation)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.exe - Verknüpfung.lnk [2012-12-29]
ShortcutTarget: Rainmeter.exe - Verknüpfung.lnk -> P:\Rainmeter\Rainmeter.exe ()
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
Tcpip\Parameters: [DhcpNameServer] 192.168.227.250
Tcpip\..\Interfaces\{38466EC1-4A0E-4C96-9F9A-ABA8913E5EC3}: [DhcpNameServer] 192.168.227.250
Tcpip\..\Interfaces\{3F99CA3C-168B-4727-BCBC-10017F0FAA0A}: [DhcpNameServer] 192.168.227.250
Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2017-11-22] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll [2015-07-23] (Logitech, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2017-11-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2017-11-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\ssv.dll [2015-03-08] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Logitech SetPoint -> {AF949550-9094-4807-95EC-D1C317803333} -> C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll [2015-07-23] (Logitech, Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2017-11-22] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\jp2ssv.dll [2015-03-08] (Oracle Corporation)
Handler: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2017-11-22] (Microsoft Corporation)
FireFox:
========
FF DefaultProfile: fdq7l2kw.default-1381326936455
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\fdq7l2kw.default-1381326936455 [2017-12-24]
FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: (Logitech SetPoint) - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2015-08-24] [Legacy] [not signed]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_27_0_0_187.dll [2017-11-20] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_27_0_0_187.dll [2017-11-20] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\dtplugin\npDeployJava1.dll [2015-03-08] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.40.2 -> C:\Program Files (x86)\Java\jre1.8.0_40\bin\plugin2\npjp2.dll [2015-03-08] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2015-12-18] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> P:\VLCPortable\App\VLC\npvlc.dll [2015-04-13] (VideoLAN)
StartMenuInternet: Firefox-AF8EC8F02CFD3F50 - P:\FirefoxPortable\App\Firefox64\firefox.exe
==================== Services (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 chip1click; C:\Program Files (x86)\Chip Digital GmbH\chip1click\chip 1-click installer.exe [91136 2016-10-27] (Chip Digital GmbH) [File not signed] <==== ATTENTION
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [3058416 2017-09-05] (Microsoft Corporation)
S3 ElfoService; C:\Program Files (x86)\ElsterFormular Update Service\elfoService.exe [1283336 2017-04-21] ()
R2 HFGService; C:\Windows\System32\HFGService.dll [535552 2009-12-21] (CSR, plc) [File not signed]
R2 KingoSoftService; C:\Users\admin\AppData\Local\Kingosoft\Kingo Root\update_27205\bin\checkupdate.exe [367584 2016-09-20] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10945264 2017-11-24] (TeamViewer GmbH)
R2 USBDLM; C:\Program Files\USBDLM\USBDLM.exe [483792 2014-10-14] (Uwe Sieber - www.uwe-sieber.de) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 WiseBootAssistant; P:\Wise Care 365\BootTime.exe [646904 2016-10-13] (WiseCleaner.com) [File not signed]
===================== Drivers (Whitelisted) ======================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-10-05] (AVM Berlin) [File not signed]
S3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [79872 2009-06-10] (AVM GmbH)
S3 BthAudioHF; C:\Windows\System32\DRIVERS\BthAudioHF.sys [52224 2009-12-21] (CSR, plc) [File not signed]
R3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [13896 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
S3 FPCMBASE; C:\Windows\System32\DRIVERS\fpcmbase.sys [893824 2009-06-10] (AVM Berlin)
S3 guardian2; C:\Windows\System32\Drivers\oz776x64.sys [85280 2009-09-09] (O2Micro)
S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10x64.sys [60288 2010-09-15] (Generic USB smartcard reader)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R1 MpKsl89c8aa8a; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D69BC7F7-2A1A-4E73-8A91-AB44B866694A}\MpKsl89c8aa8a.sys [58120 2017-12-22] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [748648 2010-08-12] (Realtek Semiconductor Corporation )
S3 SNPSTD3; C:\Windows\System32\DRIVERS\snpstd3.sys [10550272 2007-03-27] (Sonix Co. Ltd.) [File not signed]
R3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [213088 2016-01-08] (DEVGURU Co., LTD.(www.devguru.co.kr))
R0 vidsflt53; C:\Windows\System32\DRIVERS\vsflt53.sys [141920 2013-01-01] (Acronis)
R2 VMparport; C:\Windows\system32\drivers\VMparport.sys [31936 2015-11-25] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [75512 2015-11-05] (VMware, Inc.)
S3 WiseRegNotify; C:\Windows\WiseRegNotify.sys [29616 2016-12-30] (WiseCleaner.com) [File not signed]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-12-24 14:33 - 2017-12-24 14:33 - 000014802 _____ C:\Users\admin\Desktop\FRST.txt
2017-12-24 14:31 - 2017-12-24 14:31 - 002392064 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2017-12-12 21:17 - 2017-12-12 21:17 - 001820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\temp.002
2017-12-12 21:17 - 2017-12-12 21:17 - 001389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\temp.000
2017-12-12 21:17 - 2017-12-12 21:17 - 000278581 _____ (Microsoft Corporation) C:\Windows\SysWOW64\temp.001
2017-12-12 21:12 - 2017-12-12 21:26 - 000000000 ____D C:\Users\admin\Desktop\Lumix
2017-12-12 21:12 - 2017-12-12 21:17 - 000249856 ____N (Microsoft Corporation) C:\Windows\Setup1.exe
2017-12-12 21:12 - 2017-12-12 21:17 - 000073216 _____ (Microsoft Corporation) C:\Windows\ST6UNST.EXE
2017-12-12 21:12 - 2017-12-12 21:17 - 000000000 ____D C:\Program Files (x86)\LumixControl
2017-12-12 21:12 - 2017-12-12 21:12 - 000000303 _____ C:\Windows\ST6UNST.000
2017-12-12 21:12 - 2017-12-12 21:12 - 000000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LumixControl
2017-11-30 19:20 - 2017-11-30 19:20 - 000001045 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 13.lnk
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2017-12-24 14:33 - 2015-11-22 10:15 - 000000000 ____D C:\FRST
2017-12-24 12:58 - 2014-12-27 15:00 - 000003914 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{1D8F97C0-8271-4640-BF1F-E61F0ECB2114}
2017-12-24 03:28 - 2009-07-14 05:45 - 000020992 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-12-24 03:28 - 2009-07-14 05:45 - 000020992 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-12-23 14:12 - 2017-09-01 17:28 - 000000000 ____D C:\Users\admin\AppData\Roaming\Thunderbird
2017-12-23 14:12 - 2016-11-21 19:52 - 000000000 ____D C:\Users\admin\AppData\LocalLow\Mozilla
2017-12-23 04:29 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2017-12-22 17:49 - 2013-06-07 16:42 - 000000000 ____D C:\Users\admin\AppData\Local\Downloaded Installations
2017-12-22 17:48 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\ModemLogs
2017-12-22 15:58 - 2012-12-30 09:48 - 000000000 ____D C:\Users\admin\AppData\Roaming\Mozilla
2017-12-22 10:02 - 2013-01-01 17:37 - 000000000 ____D C:\Users\admin\AppData\Roaming\Foxit Software
2017-11-30 19:22 - 2015-01-02 19:02 - 000000000 ____D C:\Users\admin\AppData\Local\TeamViewer
2017-11-30 19:21 - 2015-01-02 17:18 - 000000000 ____D C:\Program Files (x86)\TeamViewer
2017-11-30 19:20 - 2015-01-02 17:18 - 000000000 ____D C:\Users\admin\AppData\Roaming\TeamViewer
2017-11-30 19:19 - 2016-12-21 18:40 - 000000000 ____D C:\Users\admin\AppData\Local\Skype
2017-11-26 11:47 - 2017-08-27 15:15 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
==================== Files in the root of some directories =======
2017-02-26 17:56 - 2017-11-12 17:39 - 000000004 _____ () C:\ProgramData\hscanpdfdata.dat
2013-06-03 17:00 - 2013-06-03 17:00 - 000000193 _____ () C:\Program Files (x86)\gToolChange.log
2014-02-22 15:41 - 2015-11-20 16:53 - 000033193 _____ () C:\Users\admin\AppData\Roaming\UserTile.png
2014-12-16 18:58 - 2016-08-27 11:04 - 000012867 _____ () C:\Users\admin\AppData\Local\HDGraph.log
2012-12-29 19:40 - 2017-06-05 18:17 - 000007659 _____ () C:\Users\admin\AppData\Local\resmon.resmoncfg
2016-09-20 17:06 - 2016-09-20 17:06 - 000000176 _____ () C:\Users\admin\AppData\Local\uts.ini
==================== Bamital & volsnap ======================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2017-12-19 00:30
==================== End of FRST.txt ============================
--- --- ---
Addition-txt
[CODE]Additional
FRST Logfile: Code:
scan result of Farbar Recovery Scan Tool (x64) Version: 23-12-2017 01
Ran by admin (24-12-2017 14:34:03)
Running from C:\Users\admin\Desktop
Windows 7 Ultimate Service Pack 1 (X64) (2012-12-29 14:31:56)
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
admin (S-1-5-21-4130048562-87666382-793842908-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-4130048562-87666382-793842908-500 - Administrator - Disabled)
Guest (S-1-5-21-4130048562-87666382-793842908-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-4130048562-87666382-793842908-1002 - Limited - Enabled)
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Acronis True Image WD*Edition (HKLM-x32\...\{9B683A28-2172-4CF1-B85D-41375E80652A}) (Version: 13.0.14189 - Acronis)
Adobe Flash Player 27 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 27.0.0.187 - Adobe Systems Incorporated)
Adobe Flash Player 27 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 27.0.0.187 - Adobe Systems Incorporated)
Canon CanoScan Toolbox 5.0 (HKLM-x32\...\CanoScan Toolbox 5.0) (Version: - )
CanoScan LiDE 70 (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2411) (Version: - )
CCleaner (HKLM\...\CCleaner) (Version: 5.12 - Piriform)
chip 1-click download service (HKLM-x32\...\{503CA94E-0834-4CEE-AD92-BA17AF4E809A}) (Version: 3.6.9.0 - Chip Digital GmbH) <==== ATTENTION
ConvertHelper 3.1.1 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version: - DownloadHelper)
D3DX10 (HKLM-x32\...\{E09C4DB7-630C-4F06-A631-8EA7239923AF}) (Version: 15.4.2368.0902 - Microsoft) Hidden
Dell System Detect (HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\58d94f3ce2c27db0) (Version: 7.4.0.3 - Dell)
DVD Shrink 3.2 (HKLM-x32\...\DVD Shrink_is1) (Version: - DVD Shrink)
EaseUS Partition Master 9.3.0 (HKLM-x32\...\EaseUS Partition Master_is1) (Version: - EaseUS)
ElsterFormular (HKLM-x32\...\{C75F51E9-3DDE-42EC-9D00-97E7C4F9CEF8}) (Version: 18.3.0 - Thüringer Landesfinanzdirektion)
eReg (HKLM-x32\...\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}) (Version: 1.20.138.34 - Logitech, Inc.) Hidden
Exact Audio Copy 1.0beta3 (HKLM-x32\...\Exact Audio Copy) (Version: 1.0beta3 - Andre Wiethoff)
FileZilla Client 3.11.0.1 (HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\FileZilla Client) (Version: 3.11.0.1 - Tim Kosse)
Fotogalerie (HKLM-x32\...\{0FD66C6F-4023-4C74-AF8E-9B8B2053868E}) (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free Video Dub version 2.0.22.925 (HKLM-x32\...\Free Video Dub_is1) (Version: 2.0.22.925 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version: - )
Gigaset QuickSync (HKLM\...\{b49e8cfb-f094-4467-925a-97c23972cb50}) (Version: 8.3.0868.3 - Gigaset Communications GmbH)
Google Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
HD Tune Pro 5.50 (HKLM-x32\...\HD Tune Pro_is1) (Version: - EFD Software)
Horland's Scan2Pdf (HKLM-x32\...\Horlands Scan2Pdf 5_is1) (Version: 5.5.0.4 - Horland Software)
HP Color LaserJet 2600 series (HKLM\...\HP Color LaserJet 2600 series) (Version: - )
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1930 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.670 - Oracle)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Kingo ROOT version 1.5.3.3086 (HKLM-x32\...\{AE7675D6-0B31-494F-ABFA-822E1A0FDF17}_is1) (Version: 1.5.3.3086 - Kingosoft Technology Ltd.)
Logitech SetPoint 6.67 (HKLM\...\sp6) (Version: 6.67.82 - Logitech)
LumixControl (C:\Program Files (x86)\LumixControl\) #3 (HKLM-x32\...\ST6UNST #3) (Version: - )
LumixControl (C:\Program Files (x86)\LumixControl\) (HKLM-x32\...\ST6UNST #2) (Version: - )
LumixControl (HKLM-x32\...\ST6UNST #1) (Version: - )
Microsoft Office Home and Business 2013 - de-de (HKLM\...\HomeBusinessRetail - de-de) (Version: 15.0.4981.1001 - Microsoft Corporation)
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4981.1001 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50906.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022.218 (HKLM\...\{BBBE35B2-9349-3C48-BD3D-F574B17C7924}) (Version: 9.0.21022.218 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Movie Maker (HKLM-x32\...\{45898170-E68C-4F02-AA35-C2186BF347A3}) (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Movie Maker (HKLM-x32\...\{6066D3FE-3692-4449-A3C8-D1EAA2C0E9E7}) (Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 56.0.2 (x64 de) (HKLM\...\Mozilla Firefox 56.0.2 (x64 de)) (Version: 56.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 56.0.2 - Mozilla)
Office 15 Click-to-Run Extensibility Component (HKLM-x32\...\{90150000-008C-0000-0000-0000000FF1CE}) (Version: 15.0.4981.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (HKLM\...\{90150000-008F-0000-1000-0000000FF1CE}) (Version: 15.0.4981.1001 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (HKLM-x32\...\{90150000-008C-0407-0000-0000000FF1CE}) (Version: 15.0.4981.1001 - Microsoft Corporation) Hidden
paint.net (HKLM\...\{DD393E4D-76FA-4CCD-84F3-CD9D75C14862}) (Version: 4.0.10 - dotPDN LLC)
Parrot Software Update Tool (HKLM-x32\...\Parrot Flash Update Wizard) (Version: - )
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version: - )
Samsung Kies (HKLM-x32\...\{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13043_14 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (HKLM-x32\...\{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14055.3 - Samsung Electronics Co., Ltd.) Hidden
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14055.3 - Samsung Electronics Co., Ltd.)
Samsung USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.59.0 - Samsung Electronics Co., Ltd.)
Shark007 Advanced Codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 5.0.0 - Shark007)
Skype™ 7.30 (HKLM-x32\...\{FC965A47-4839-40CA-B618-18F486F042C6}) (Version: 7.30.105 - Skype Technologies S.A.)
TeamViewer 13 (HKLM-x32\...\TeamViewer) (Version: 13.0.5058 - TeamViewer)
Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VMware Player (HKLM\...\{57AA4E8A-E2C9-4F1C-B3F1-762C36E34472}) (Version: 12.1.0 - VMware, Inc.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)
x264vfw - H.264/MPEG-4 AVC codec (remove only) (HKLM-x32\...\x264vfw) (Version: - )
x264vfw - H.264/MPEG-4 AVC codec for x64 (remove only) (HKLM-x32\...\x264vfw64) (Version: - )
x64 Components v5.0.0 (HKLM\...\Advanced x64Components_is1) (Version: 5.0.0 - Shark007)
XMedia Recode Version 3.1.7.8 (HKLM-x32\...\{DDA3C325-47B2-4730-9672-BF3771C08799}_is1) (Version: 3.1.7.8 - XMedia Recode)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
ContextMenuHandlers1: [DVSShellContextMenu] -> {34CBB076-0260-416C-9FE4-765D66E89C15} => C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\DVSShellContextMenuExtension64.dll [2013-09-26] (DVDVideoSoft Ltd.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [WondershareVideoConverterFileOpreation] -> {FEB746CA-95C2-485F-B386-C30D4E56D22E} => C:\Windows\SysWOW64\WSCM64.dll [2013-08-23] ()
ContextMenuHandlers2: [DVSShellContextMenu] -> {34CBB076-0260-416C-9FE4-765D66E89C15} => C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\DVSShellContextMenuExtension64.dll [2013-09-26] (DVDVideoSoft Ltd.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers2-x32: [VMDiskMenuHandler] -> {271DC252-6FE1-4D59-9053-E4CF50AB99DE} => C:\Program Files (x86)\VMware\VMware Player\vmdkShellExt.dll [2015-11-25] (VMware, Inc.)
ContextMenuHandlers2-x32: [VMDiskMenuHandler64] -> {E4D28EDC-8C0B-43EE-9E7D-C8A8682334DC} => C:\Program Files (x86)\VMware\VMware Player\x64\vmdkShellExt64.dll [2015-11-25] (VMware, Inc.)
ContextMenuHandlers4: [DVSShellContextMenu] -> {34CBB076-0260-416C-9FE4-765D66E89C15} => C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\DVSShellContextMenuExtension64.dll [2013-09-26] (DVDVideoSoft Ltd.)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers5: [DVSShellContextMenu] -> {34CBB076-0260-416C-9FE4-765D66E89C15} => C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\DVSShellContextMenuExtension64.dll [2013-09-26] (DVDVideoSoft Ltd.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => C:\Windows\system32\igfxpph.dll [2009-09-23] (Intel Corporation)
ContextMenuHandlers6: [DVSShellContextMenu] -> [CC]{34CBB076-0260-416C-9FE4-765D66E89C15} => -> No File
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1A794CE2-B22F-4E21-97A0-59CC2370FD09} - System32\Tasks\{1381B9B8-255A-4E62-A4BE-4F01591935EF} => P:\ext3\explore2fs-1.07\explore2fs.exe [2005-04-02] (John Newbigin)
Task: {5B8F263B-8CD1-4FF1-955B-67DAE84BBB75} - System32\Tasks\{050CAFA8-7C40-4BDC-8F1C-4409AFAE1BDC} => C:\Windows\system32\pcalua.exe -a Z:\020\Vallen_JPegger\wvsetup.exe -d Z:\020\Vallen_JPegger
Task: {73086E80-6C5F-4163-9BE1-E85A97847564} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-11-16] (Piriform Ltd)
Task: {A4B18A7E-1274-4799-847A-2359E314B978} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-11-20] (Adobe Systems Incorporated)
Task: {C19CA8F1-5BB3-4202-A904-111E025AE5BE} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-09-05] (Microsoft Corporation)
Task: {C60C9317-82D2-4D0E-A536-078C103ACDB2} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {D01F85FD-386B-461A-8637-9A4BC1646E33} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {D01F85FD-386B-461A-8637-9A4BC1646E33} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {D3AFFF70-0052-4A81-9179-B5CF9A4C3496} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfig
Task: {D3AFFF70-0052-4A81-9179-B5CF9A4C3496} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(2): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshContent
Task: {D3AFFF70-0052-4A81-9179-B5CF9A4C3496} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => Command(3): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {D566EE34-1152-4F67-8E5B-7E621764F918} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(1): %windir%\system32\GWX\GWXUXWorker.exe -> /ScheduleUpgradeReminderTime
Task: {D566EE34-1152-4F67-8E5B-7E621764F918} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {E314C48D-4715-4337-99A7-06C4B0F07913} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(1): %windir%\system32\GWX\GWXConfigManager.exe -> /RefreshConfigAndContent
Task: {E314C48D-4715-4337-99A7-06C4B0F07913} - C:\Windows\System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent => Command(2): C:\Windows\system32\GWX\GWXDetector.exe [2016-03-20] (Microsoft Corporation)
Task: {F2898C13-3A23-46DE-BF77-9913DC30154F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-09-05] (Microsoft Corporation)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
==================== Shortcuts & WMI ========================
(The entries could be listed to be restored or removed.)
==================== Loaded Modules (Whitelisted) ==============
2013-06-02 18:12 - 2011-02-17 18:13 - 000136704 _____ () C:\Windows\System32\zlhp2600.dll
2013-06-02 18:51 - 2010-06-17 19:56 - 000087040 _____ () C:\Windows\System32\redmonnt.dll
2016-08-19 16:03 - 2013-05-06 07:03 - 000034304 _____ () C:\Windows\System32\sst9clm.dll
2016-09-20 17:06 - 2016-09-20 17:06 - 000017376 _____ () C:\Users\admin\AppData\Local\Kingosoft\Kingo Root\update_27205\bin\KingoSoftService.exe
2015-05-22 15:46 - 2015-05-22 15:46 - 000043480 _____ () P:\FileZillaPortable\App\filezilla\fzshellext_64.dll
2012-05-10 16:23 - 2012-05-10 16:23 - 001233528 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll
2014-02-12 18:00 - 2013-08-23 13:36 - 000721263 _____ () C:\Windows\SysWOW64\WSCM64.dll
2015-11-16 17:55 - 2015-11-16 17:55 - 000057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2015-11-13 13:19 - 2015-11-13 13:19 - 003097640 _____ () P:\Rainlendar2\Rainlendar2.exe
2014-04-28 07:19 - 2014-04-28 07:19 - 000184320 _____ () P:\Rainlendar2\lua52.dll
2015-11-13 10:51 - 2015-11-13 10:51 - 000330240 _____ () P:\Rainlendar2\libical.dll
2015-11-13 10:51 - 2015-11-13 10:51 - 000060928 _____ () P:\Rainlendar2\libicalss.dll
2015-11-13 13:19 - 2015-11-13 13:19 - 000075816 _____ () P:\Rainlendar2\plugins\iCalendarPlugin.dll
2015-11-13 13:20 - 2015-11-13 13:20 - 000283176 _____ () P:\Rainlendar2\plugins\GoogleCalendarPlugin.dll
2015-11-13 13:19 - 2015-11-13 13:19 - 000141864 _____ () P:\Rainlendar2\plugins\NetworkPlugin.dll
2014-04-28 07:19 - 2014-04-28 07:19 - 000015872 _____ () P:\Rainlendar2\lfs.dll
2016-03-18 21:10 - 2016-03-18 21:10 - 000037008 _____ () P:\Rainmeter\Rainmeter.exe
2015-12-15 17:28 - 2017-01-17 04:25 - 000117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2015-11-25 18:10 - 2015-11-25 18:10 - 001301696 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2016-03-18 21:10 - 2016-03-18 21:10 - 001101968 _____ () P:\Rainmeter\Rainmeter.dll
2016-03-18 21:06 - 2016-03-18 21:06 - 000104960 _____ () P:\Rainmeter\Plugins\WifiStatus.dll
2016-03-18 21:07 - 2016-03-18 21:07 - 000107008 _____ () P:\Rainmeter\Plugins\SysInfo.dll
2016-03-18 21:06 - 2016-03-18 21:06 - 000196608 _____ () P:\Rainmeter\Plugins\WebParser.dll
2017-06-20 19:16 - 2017-06-20 19:16 - 000325824 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2017-12-22 15:58 - 2017-12-22 15:58 - 000011776 _____ () C:\Users\admin\AppData\Local\Temp\nsaFCA0.tmp\System.dll
2017-12-22 15:58 - 2017-12-22 15:58 - 000029696 _____ () C:\Users\admin\AppData\Local\Temp\nsaFCA0.tmp\registry.dll
2017-12-22 15:58 - 2017-12-22 15:58 - 000008704 _____ () C:\Users\admin\AppData\Local\Temp\nsaFCA0.tmp\newadvsplash.dll
2017-12-23 14:12 - 2017-12-23 14:12 - 000011264 _____ () C:\Users\admin\AppData\Local\Temp\nsy92FE.tmp\System.dll
2017-12-23 14:12 - 2017-12-23 14:12 - 000029696 _____ () C:\Users\admin\AppData\Local\Temp\nsy92FE.tmp\registry.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
==================== Safe Mode (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
IE trusted site: HKU\S-1-5-21-4130048562-87666382-793842908-1000\...\dell.com -> dell.com
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 000000824 _____ C:\Windows\system32\Drivers\etc\hosts
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-4130048562-87666382-793842908-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.227.250
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall is enabled.
==================== MSCONFIG/TASK MANAGER disabled items ==
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: EaseUS EPM tray => C:\Program Files (x86)\EaseUS\EaseUS Partition Master 9.3.0\bin\EpmNews.exe
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: snpstd3 => C:\Windows\vsnpstd3.exe
MSCONFIG\startupreg: TrueImageMonitor.exe => "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [TCP Query User{8D4504E6-2088-481D-BC40-22AA613D164A}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [UDP Query User{F4357882-129C-4004-861F-F16DF7BB36EF}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe] => (Allow) C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe
FirewallRules: [VirtualPC-In-UDP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-UDP-2] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [VirtualPC-In-TCP-1] => (Allow) %SystemRoot%\System32\vpc.exe
FirewallRules: [TCP Query User{A1E77461-693D-4F78-AB4A-61FDF5E9D4A3}P:\microsipportable\app\microsip\microsip.exe] => (Allow) P:\microsipportable\app\microsip\microsip.exe
FirewallRules: [UDP Query User{360DAF91-585F-4D4E-903A-A04F85E7B124}P:\microsipportable\app\microsip\microsip.exe] => (Allow) P:\microsipportable\app\microsip\microsip.exe
FirewallRules: [{F3D2E8AA-06B2-4F1A-88FA-F4A363FC824B}] => (Allow) C:\hp_CLJ_2600n_Full_Solution\ProdInst64.exe
FirewallRules: [{0C49B46D-C49B-4017-AB57-39F62C442FE5}] => (Allow) C:\hp_CLJ_2600n_Full_Solution\ProdInst64.exe
FirewallRules: [{13BD1F88-9713-40DE-AB1D-D13C5A6A7DF5}] => (Allow) LPort=9100
FirewallRules: [{FAF2C6CE-E55B-4F98-8A37-9C16883B4531}] => (Allow) LPort=427
FirewallRules: [{B907EF5D-FB62-410C-B720-F92BBFDF7835}] => (Allow) LPort=161
FirewallRules: [{E443ED30-533E-4C8E-B346-B27AED5F6B56}] => (Allow) LPort=427
FirewallRules: [TCP Query User{2C55F907-176A-4089-8893-10472B0F5F68}P:\vlcportable\app\vlc\vlc.exe] => (Allow) P:\vlcportable\app\vlc\vlc.exe
FirewallRules: [UDP Query User{09F95678-8B07-49C3-9178-B0E2C9DC9ADF}P:\vlcportable\app\vlc\vlc.exe] => (Allow) P:\vlcportable\app\vlc\vlc.exe
FirewallRules: [TCP Query User{5CB3B7F9-D506-4C78-8D3C-4F3F0186C498}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [UDP Query User{6382315D-3A0B-4E67-8FD8-9E9CEB995AA2}C:\windows\system32\wfs.exe] => (Allow) C:\windows\system32\wfs.exe
FirewallRules: [{6254A689-0C08-479B-9BAE-8051F5E5992C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{82262126-56E0-42E6-93F7-53C40C139422}] => (Allow) LPort=2869
FirewallRules: [{F9B0E358-4229-4D41-AF04-EB92E57AA30C}] => (Allow) LPort=1900
FirewallRules: [TCP Query User{05A480B6-DF36-4039-87DD-55AC31A822B2}Z:\° arduino\arduino-1.5.6-r2-windows\arduino-1.5.6-r2\java\bin\javaw.exe] => (Allow) Z:\° arduino\arduino-1.5.6-r2-windows\arduino-1.5.6-r2\java\bin\javaw.exe
FirewallRules: [UDP Query User{0995C18A-092C-4ACB-93AB-49D5C4E29DE0}Z:\° arduino\arduino-1.5.6-r2-windows\arduino-1.5.6-r2\java\bin\javaw.exe] => (Allow) Z:\° arduino\arduino-1.5.6-r2-windows\arduino-1.5.6-r2\java\bin\javaw.exe
FirewallRules: [TCP Query User{62DF4ECD-40F3-4185-B76A-A744CF7967A6}P:\arduino-1.5.6-r2\java\bin\javaw.exe] => (Allow) P:\arduino-1.5.6-r2\java\bin\javaw.exe
FirewallRules: [UDP Query User{EB438BEB-2E38-4A55-B9A2-074FAF243BDC}P:\arduino-1.5.6-r2\java\bin\javaw.exe] => (Allow) P:\arduino-1.5.6-r2\java\bin\javaw.exe
FirewallRules: [TCP Query User{DEA9FF63-DFCA-431C-BDCD-E73B3B185F27}P:\skypeportable\app\skype\phone\skype.exe] => (Allow) P:\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{8DF73AAB-0BF9-4339-991F-96A0521F38E1}P:\skypeportable\app\skype\phone\skype.exe] => (Allow) P:\skypeportable\app\skype\phone\skype.exe
FirewallRules: [TCP Query User{247D9B07-3766-4065-88D8-D054D4EDE8E0}P:\firefoxportable\app\firefox\firefox.exe] => (Block) P:\firefoxportable\app\firefox\firefox.exe
FirewallRules: [UDP Query User{308E2A8D-7FAE-44D5-B21E-AF1C4D08FCEE}P:\firefoxportable\app\firefox\firefox.exe] => (Block) P:\firefoxportable\app\firefox\firefox.exe
FirewallRules: [{091317F6-141B-468C-9A7E-78A0669565B0}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{E983BA30-2957-489C-9A85-6E4B6305FCF0}P:\myphoneexplorer\myphoneexplorer portable.exe] => (Allow) P:\myphoneexplorer\myphoneexplorer portable.exe
FirewallRules: [UDP Query User{054F543D-BA26-4070-857D-775E1CC3F54B}P:\myphoneexplorer\myphoneexplorer portable.exe] => (Allow) P:\myphoneexplorer\myphoneexplorer portable.exe
FirewallRules: [{105E7C46-1AE7-42E1-8A54-CE8C501644F6}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{30ECAFB4-3FD4-42D1-A592-07A026221A61}] => (Allow) LPort=8743
FirewallRules: [{D4B838D7-3F46-408A-9198-F2E49A1FE2EE}] => (Allow) LPort=8643
FirewallRules: [{B998A934-F5A0-45DE-984D-70B1844A80C8}] => (Allow) LPort=7676
FirewallRules: [{F05B8BA0-2CC6-4850-B734-B26A2D70BE8B}] => (Allow) LPort=7679
FirewallRules: [{6935DCCC-46DE-439D-BE7F-04DC10055018}] => (Allow) LPort=24234
FirewallRules: [{AB708811-71F7-4B55-BA7A-C8A088CEAAA0}] => (Allow) LPort=7900
FirewallRules: [{BDCBB0CC-FFD9-4D79-BCD6-74DD549F7A41}] => (Allow) LPort=1900
FirewallRules: [{B9F34101-3BF5-4BBF-A3B7-F11D0B16FE7C}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{F4BA0C06-01CA-48CB-BA09-46B8917241A7}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{4EBFA9F5-7F95-4E9B-B800-8D5A50BC489E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{5A5109AA-0C5E-4393-96DA-D771600DE4F3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{6D00493D-5EAA-496E-8F5C-98FCD303FA9E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{FCCE7E43-40C3-4493-B497-17678CEFF94E}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [TCP Query User{6723156C-36EB-4FC3-8CA5-C92E8A2136A3}P:\myphoneexplorer\myphoneexplorer portable.exe] => (Allow) P:\myphoneexplorer\myphoneexplorer portable.exe
FirewallRules: [UDP Query User{CCA48564-5836-4019-8839-B3CEE03DCA96}P:\myphoneexplorer\myphoneexplorer portable.exe] => (Allow) P:\myphoneexplorer\myphoneexplorer portable.exe
FirewallRules: [TCP Query User{7A231ACF-8A99-4CBF-96F3-C76E21EA14C0}P:\skypeportable\app\skype\phone\skype.exe] => (Block) P:\skypeportable\app\skype\phone\skype.exe
FirewallRules: [UDP Query User{7AB38591-94ED-4A27-90FA-2B217B2BC670}P:\skypeportable\app\skype\phone\skype.exe] => (Block) P:\skypeportable\app\skype\phone\skype.exe
FirewallRules: [{AD41AC51-7E6D-47FB-84F4-CBD39890D606}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{A66B5884-A8B0-40BB-9D3D-D5C724832A2E}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{DAED6DE9-0297-48A8-83DC-51DA61A6AB30}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{BBC21F8A-5085-49A5-83EC-B42CF5DDCC8F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{01916166-2BF6-4986-A6E6-124B7FFE5CFA}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{41CC5D39-0AC3-411D-A40E-EEE524E32EDF}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [TCP Query User{6BB1780E-F075-4392-ADBE-29949AADD0A6}P:\firefoxportable\app\firefox64\firefox.exe] => (Block) P:\firefoxportable\app\firefox64\firefox.exe
FirewallRules: [UDP Query User{3022C82C-08B7-4C3D-907D-EA468173D7CA}P:\firefoxportable\app\firefox64\firefox.exe] => (Block) P:\firefoxportable\app\firefox64\firefox.exe
FirewallRules: [TCP Query User{D702C550-A0BC-4F66-AB29-BA7BE756EF30}C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe
FirewallRules: [UDP Query User{C9B66878-A9FA-421F-A9A5-3BA9B53FBF3C}C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_40\bin\javaw.exe
==================== Restore Points =========================
30-11-2017 00:00:00 Scheduled Checkpoint
30-11-2017 19:25:40 Windows Update
07-12-2017 19:55:07 Windows Update
15-12-2017 00:00:01 Scheduled Checkpoint
22-12-2017 15:53:51 Windows Update
==================== Faulty Device Manager Devices =============
Name: O2Micro OZ776 USB CCID Smartcard Reader
Description: O2Micro OZ776 USB CCID Smartcard Reader
Class Guid: {50dd5230-ba8a-11d1-bf5d-0000f805f530}
Manufacturer: O2Micro
Service: guardian2
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4400} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Details:
The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.
Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.
Context: Windows Application
Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.
Context: Windows Application, SystemIndex Catalog
Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.
Context: Windows Application, SystemIndex Catalog
Details:
Element not found. (HRESULT : 0x80070490) (0x80070490)
Error: (12/24/2017 02:33:47 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.
Context: Windows Application, SystemIndex Catalog
Details:
The content index database is corrupt. (HRESULT : 0xc0041800) (0xc0041800)
Error: (12/24/2017 02:33:46 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.
Context: Windows Application
Details:
The content index catalog is corrupt. 0xc0041801 (0xc0041801)
Error: (12/24/2017 02:33:46 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=2801} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.
Context: Windows Application
Details:
The content index catalog is corrupt. 0xc0041801 (0xc0041801)
Error: (12/24/2017 02:33:11 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SearchIndexer.exe, Version: 7.0.7601.17610, Zeitstempel: 0x4dc0d019
Name des fehlerhaften Moduls: msvcrt.dll, Version: 7.0.7601.17744, Zeitstempel: 0x4eeb033f
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000000011fd
ID des fehlerhaften Prozesses: 0x10b4
Startzeit der fehlerhaften Anwendung: 0x01d363c0c79abd57
Pfad der fehlerhaften Anwendung: C:\Windows\system32\SearchIndexer.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\msvcrt.dll
Berichtskennung: fbea50ee-e8ae-11e7-a037-005056c00008
System errors:
=============
Error: (12/24/2017 02:33:47 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 2 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Restart the service.
Error: (12/24/2017 02:33:47 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473536.
Error: (12/24/2017 02:33:16 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Restart the service.
Error: (12/24/2017 01:58:57 PM) (Source: BROWSER) (EventID: 8032) (User: )
Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{38466EC1-4A0E-4C96-9F9A-ABA8913E5EC3}" zu oft fehl.
Der Sicherungssuchdienst wird beendet.
Error: (12/24/2017 01:28:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 118.2.0.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Suchen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x64&eng=2.1.14202.0&sig=118.2.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: Network Inspection System
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.14202.0
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved
Error: (12/24/2017 01:28:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.259.668.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Suchen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.14405.2&avdelta=1.259.668.0&asdelta=1.259.668.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: AntiSpyware
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14405.2
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved
Error: (12/24/2017 01:28:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.259.668.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Suchen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.14405.2&avdelta=1.259.668.0&asdelta=1.259.668.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: AntiVirus
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14405.2
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved
Error: (12/24/2017 01:28:02 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.259.668.0
Aktualisierungsquelle: Microsoft Update Server
Aktualisierungsphase: Suchen
Quellpfad: hxxp://www.microsoft.com
Signaturtyp: AntiVirus
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\SYSTEM
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14405.2
Fehlercode: 0x8024402c
Fehlerbeschreibung: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
Error: (12/24/2017 01:27:56 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 118.2.0.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Suchen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=260974&clcid=0x409&NRI=true&arch=x64&eng=2.1.14202.0&sig=118.2.0.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: Network Inspection System
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 2.1.14202.0
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved
Error: (12/24/2017 01:27:56 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von Microsoft-Antischadsoftware ein Fehler festgestellt.
Neue Signaturversion:
Vorherige Signaturversion: 1.259.668.0
Aktualisierungsquelle: Microsoft Malware Protection Center
Aktualisierungsphase: Suchen
Quellpfad: hxxp://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.14405.2&avdelta=1.259.668.0&asdelta=1.259.668.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094
Signaturtyp: AntiSpyware
Aktualisierungstyp: Vollständig
Benutzer: NT AUTHORITY\NETWORK SERVICE
Aktuelle Modulversion:
Vorherige Modulversion: 1.1.14405.2
Fehlercode: 0x80072ee7
Fehlerbeschreibung: The server name or address could not be resolved
CodeIntegrity:
===================================
Date: 2013-10-16 18:39:51.517
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-16 18:39:51.439
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-11 16:04:17.492
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-11 16:04:17.430
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-09 15:50:25.365
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-09 15:50:25.287
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-09 15:47:28.840
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-09 15:47:28.778
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-07 17:41:37.168
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2013-10-07 17:41:37.106
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\drivers\avmaura.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T7250 @ 2.00GHz
Percentage of memory in use: 51%
Total physical RAM: 8181.97 MB
Available physical RAM: 3991.39 MB
Total Virtual: 24564.15 MB
Available Virtual: 20659.02 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:80 GB) (Free:30.03 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Daten) (Fixed) (Total:370 GB) (Free:78.82 GB) NTFS
Drive p: (Portable_Programme) (Fixed) (Total:100 GB) (Free:73.69 GB) NTFS
Drive u: () (Network) (Total:0.5 GB) (Free:0.4 GB)
Drive w: (Virtuelle-Welt) (Fixed) (Total:48.64 GB) (Free:40 GB) NTFS
Drive z: (Install) (Fixed) (Total:100 GB) (Free:14.74 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: D3D06160)
Partition 1: (Active) - (Size=80 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=370 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=148.6 GB) - (Type=OF Extended)
==================== End of Addition.txt ============================
--- --- ---
Danke |
FRST 32-Bit | FRST 64-Bit
Lesestoff:
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
dann auf 
und dann auf 
.